Re: [PATCH v1] sysfs: fix sysfs_kf_seq_show null pointer dereference

[William McVicker]

On 06/15/2022, Christoph Hellwig wrote:
> On Tue, Jun 14, 2022 at 07:28:31PM +0200, Greg Kroah-Hartman wrote:
> > On Tue, Jun 14, 2022 at 05:24:01PM +0000, Will McVicker wrote:
> > > When the kobj->ktype is null,
> > 
> > How can that happen?  What in-tree code does that?
> 
> Yes, I'd be really curious how we arrived there.  I we ever end in
> this case we're having a major problem, as all the sysfs files
> should go through sysfs_add_file_mode_ns, which already derferences
> kobj->ktype->sysfs_ops directly.  I.e. for this to happen
> kobj->ktype must have been cleared on a live file, or someone
> must have bypassed sysfs_add_file_mode_ns.

Okay, so I was able to figure out that the Android userspace process that
triggers this issue is called rebalance_interrupts. You can find the source
code here [1]. I can reproduce this issue in about 5-10 reboots. As the name
indicates, it rebalances the IRQs. I found that the crash happens when the
program reads the sysfs files: /sys/kernel/irq/<irq>/actions. I haven't looked
into how kobj->ktype becomes null yet. I'll look deeper into that now, but
wanted to update this thread in case this information triggers any hints for
you guys on why this is happening.

Thanks,
Will

[1] https://android.googlesource.com/platform/hardware/google/pixel/+/refs/heads/android12-qpr3-s2-release/rebalance_interrupts