[BUG] general protection fault in si4713_transfer

[Farhad Alemi]

Hello,

We are reporting the following crash (reproducer attached):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)

[   44.353189][ T9493] Oops: general protection fault, probably for
non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
[   44.355892][ T9493] KASAN: null-ptr-deref in range
[0x0000000000000010-0x0000000000000017]
[   44.357779][ T9493] CPU: 1 UID: 0 PID: 9493 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   44.360129][ T9493] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   44.361627][ T9493] RIP: 0010:si4713_transfer+0x185/0x6b0
[   44.362172][ T9493] Code: 65 f9 48 8b 6c 24 38 4d 89 fd 4c 8b 7c 24
40 49 81 ff 90 00 00 00 0f 84 16 04 00 00 e8 e4 6c 65 f9 49 83 c7 0c
48 8b 44 24 58 <42> 0f b6 04 28 84 c0 0f 85 ab 01 00 00 0f b6 5d 00 49
8d bf 80 ba
[   44.363966][ T9493] RSP: 0018:ffffc90021e0fbd0 EFLAGS: 00010246
[   44.364550][ T9493] RAX: 0000000000000002 RBX: 0000000000000000
RCX: ffff888023c78000
[   44.365285][ T9493] RDX: 0000000000000000 RSI: 0000000000000000
RDI: 000000000000003b
[   44.365996][ T9493] RBP: 0000000000000010 R08: ffff888111062df7
R09: 1ffff1102220c5be
[   44.366739][ T9493] R10: dffffc0000000000 R11: ffffffff88622e20
R12: ffff888111062f58
[   44.367491][ T9493] R13: dffffc0000000000 R14: 00000000ffffffea
R15: 0000000000000000
[   44.368239][ T9493] FS:  000000001cfe7400(0000)
GS:ffff8881da588000(0000) knlGS:0000000000000000
[   44.369055][ T9493] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   44.369649][ T9493] CR2: 00007feaba8e0000 CR3: 0000000111292000
CR4: 0000000000752ef0
[   44.370365][ T9493] PKRU: 55555554
[   44.370830][ T9493] Call Trace:
[   44.371165][ T9493]  <TASK>
[   44.371470][ T9493]  __i2c_transfer+0x7a3/0x1f80
[   44.371946][ T9493]  ? i2c_transfer+0xc7/0x2d0
[   44.372408][ T9493]  i2c_transfer+0x1cb/0x2d0
[   44.372826][ T9493]  i2cdev_ioctl_rdwr+0x460/0x740
[   44.373280][ T9493]  i2cdev_ioctl+0x6a5/0x880
[   44.373698][ T9493]  ? __pfx_i2cdev_ioctl+0x10/0x10
[   44.374160][ T9493]  ? __pfx_fput_close_sync+0x10/0x10
[   44.374648][ T9493]  ? bpf_lsm_file_ioctl+0x9/0x20
[   44.375101][ T9493]  ? __pfx_i2cdev_ioctl+0x10/0x10
[   44.375563][ T9493]  __se_sys_ioctl+0xfc/0x170
[   44.375989][ T9493]  do_syscall_64+0x155/0x510
[   44.376425][ T9493]  ? trace_irq_disable+0x3b/0x140
[   44.376888][ T9493]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   44.377436][ T9493]  ? clear_bhb_loop+0x30/0x80
[   44.377871][ T9493]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   44.378405][ T9493] RIP: 0033:0x422cdd
[   44.378770][ T9493] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d
45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10
00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25
28 00 00 00
[   44.380587][ T9493] RSP: 002b:00007ffc38d6e780 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
[   44.381373][ T9493] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 0000000000422cdd
[   44.382117][ T9493] RDX: 00007ffc38d6e810 RSI: 0000000000000707
RDI: 0000000000000004
[   44.382850][ T9493] RBP: 00007ffc38d6e7d0 R08: 0000000000000000
R09: 0000000000000000
[   44.383596][ T9493] R10: 0000000000000000 R11: 0000000000000246
R12: 00007ffc38d6ec18
[   44.384330][ T9493] R13: 00007ffc38d6ec28 R14: 0000000000000002
R15: 00000000004bca00
[   44.385078][ T9493]  </TASK>
[   44.385380][ T9493] Modules linked in:
[   44.385816][ T9493] ---[ end trace 0000000000000000 ]---
[   44.386558][ T9493] RIP: 0010:si4713_transfer+0x185/0x6b0
[   44.386573][ T9493] Code: 65 f9 48 8b 6c 24 38 4d 89 fd 4c 8b 7c 24
40 49 81 ff 90 00 00 00 0f 84 16 04 00 00 e8 e4 6c 65 f9 49 83 c7 0c
48 8b 44 24 58 <42> 0f b6 04 28 84 c0 0f 85 ab 01 00 00 0f b6 5d 00 49
8d bf 80 ba
[   44.386579][ T9493] RSP: 0018:ffffc90021e0fbd0 EFLAGS: 00010246
[   44.386585][ T9493] RAX: 0000000000000002 RBX: 0000000000000000
RCX: ffff888023c78000
[   44.386590][ T9493] RDX: 0000000000000000 RSI: 0000000000000000
RDI: 000000000000003b
[   44.386594][ T9493] RBP: 0000000000000010 R08: ffff888111062df7
R09: 1ffff1102220c5be
[   44.386599][ T9493] R10: dffffc0000000000 R11: ffffffff88622e20
R12: ffff888111062f58
[   44.386603][ T9493] R13: dffffc0000000000 R14: 00000000ffffffea
R15: 0000000000000000
[   44.386608][ T9493] FS:  000000001cfe7400(0000)
GS:ffff8881da588000(0000) knlGS:0000000000000000
[   44.386614][ T9493] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   44.386619][ T9493] CR2: 0000565274948878 CR3: 0000000111292000
CR4: 0000000000752ef0
[   44.386625][ T9493] PKRU: 55555554
[   44.386631][ T9493] Kernel panic - not syncing: Fatal exception
[   44.396726][ T9493] Kernel Offset: disabled
[   44.397270][ T9493] Rebooting in 86400 seconds..

Regards,

Attachment: reproducer.c
Description: Binary data