BUG: unable to handle kernel NULL pointer dereference in start_motor

[Wei Chen]

Dear Linux Developer,

Recently when using our tool to fuzz kernel, the following crash was triggered:

HEAD commit: 64570fbc14f8 Linux 5.15-rc5
git tree: upstream
compiler: clang 12.0.0
console output:
https://drive.google.com/file/d/1uCdjFTp2Xv6bJKVrjgr7-TyTZaM3Veb5/view?usp=sharing
kernel config: https://drive.google.com/file/d/1lNwvovjLNrcuyFGrg05IoSmgO5jaKBBJ/view?usp=sharing

Unfortunately, I don't have any reproducer for this crash yet.

BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 10cc9b067 P4D 10cc9b067 PUD 10cc9c067 PMD 0
Oops: 0000 [#1] PREEMPT SMP
CPU: 0 PID: 6765 Comm: kworker/u4:2 Not tainted 5.15.0-rc5 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.13.0-48-gd9c812dda519-prebuilt.qemu.org 04/01/2014
Workqueue: floppy fd_timer_workfn
RIP: 0010:start_motor+0x4d/0x200 drivers/block/floppy.c:1905
Code: 0f b6 1d 76 8b 3d 06 4b 8d 04 a4 44 0f b6 3c c5 2d 8e 98 88 89
d9 48 8b 05 d8 9d 3d 06 83 e1 03 41 d3 e6 44 0f b6 e9 45 21 f7 <f6> 00
04 0f 85 fb 00 00 00 e8 35 14 db fe 49 83 fc 01 0f 87 24 01
RSP: 0018:ffffc90002253dd0 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88810b2e0000 RSI: ffffffff825b026c RDI: ffffffff825b6710
RBP: ffffffff825b6710 R08: 0000000000000000 R09: 0000000000000001
R10: ffffc90002253e70 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000010 R15: 0000000000000010
FS:  0000000000000000(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000010cc9a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 floppy_ready+0x4c/0xc60 drivers/block/floppy.c:1932
 process_one_work+0x34e/0x810 kernel/workqueue.c:2297
 worker_thread+0x42/0x4c0 kernel/workqueue.c:2444
 kthread+0x178/0x1b0 kernel/kthread.c:319
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Modules linked in:
Dumping ftrace buffer:
   (ftrace buffer empty)
CR2: 0000000000000000
---[ end trace 5df88fd80b74c734 ]---
RIP: 0010:start_motor+0x4d/0x200 drivers/block/floppy.c:1905
Code: 0f b6 1d 76 8b 3d 06 4b 8d 04 a4 44 0f b6 3c c5 2d 8e 98 88 89
d9 48 8b 05 d8 9d 3d 06 83 e1 03 41 d3 e6 44 0f b6 e9 45 21 f7 <f6> 00
04 0f 85 fb 00 00 00 e8 35 14 db fe 49 83 fc 01 0f 87 24 01
RSP: 0018:ffffc90002253dd0 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88810b2e0000 RSI: ffffffff825b026c RDI: ffffffff825b6710
RBP: ffffffff825b6710 R08: 0000000000000000 R09: 0000000000000001
R10: ffffc90002253e70 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000010 R15: 0000000000000010
FS:  0000000000000000(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000010cc9a000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0: 0f b6 1d 76 8b 3d 06 movzbl 0x63d8b76(%rip),%ebx        # 0x63d8b7d
   7: 4b 8d 04 a4          lea    (%r12,%r12,4),%rax
   b: 44 0f b6 3c c5 2d 8e movzbl -0x776771d3(,%rax,8),%r15d
  12: 98 88
  14: 89 d9                mov    %ebx,%ecx
  16: 48 8b 05 d8 9d 3d 06 mov    0x63d9dd8(%rip),%rax        # 0x63d9df5
  1d: 83 e1 03              and    $0x3,%ecx
  20: 41 d3 e6              shl    %cl,%r14d
  23: 44 0f b6 e9          movzbl %cl,%r13d
  27: 45 21 f7              and    %r14d,%r15d
* 2a: f6 00 04              testb  $0x4,(%rax) <-- trapping instruction
  2d: 0f 85 fb 00 00 00    jne    0x12e
  33: e8 35 14 db fe        callq  0xfedb146d
  38: 49 83 fc 01          cmp    $0x1,%r12
  3c: 0f                    .byte 0xf
  3d: 87 24 01              xchg   %esp,(%rcx,%rax,1)

Best,
Wei