[BUG] general protection fault in opera1_xilinx_rw

[Farhad Alemi]

Hello,

We are reporting the following crash (reproducer attached):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)

[   44.243595][ T9493] Oops: general protection fault, probably for
non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN NOPTI
[   44.247392][ T9493] KASAN: null-ptr-deref in range
[0x0000000000000010-0x0000000000000017]
[   44.248988][ T9493] CPU: 0 UID: 0 PID: 9493 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   44.250992][ T9493] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   44.252986][ T9493] RIP: 0010:opera1_xilinx_rw+0x138/0x2f0
[   44.254082][ T9493] Code: bf b1 00 00 00 89 de e8 b6 0e b1 f9 80 fb
b1 0f 85 e8 00 00 00 89 6c 24 04 4d 89 f5 49 c1 ed 03 48 bd 00 00 00
00 00 fc ff df <41> 0f b6 44 2d 00 84 c0 0f 85 28 01 00 00 41 0f b6 06
88 04 24 48
[   44.257084][ T9493] RSP: 0018:ffffc90007faf8d8 EFLAGS: 00010202
[   44.257640][ T9493] RAX: ffffffff8816914a RBX: 00000000000000b1
RCX: ffff88802936cc80
[   44.258349][ T9493] RDX: 0000000000000000 RSI: 00000000000000b1
RDI: 00000000000000b1
[   44.259089][ T9493] RBP: dffffc0000000000 R08: ffffffff90563d7f
R09: 1ffffffff20ac7af
[   44.259801][ T9493] R10: dffffc0000000000 R11: fffffbfff20ac7b0
R12: 0000000000000000
[   44.260513][ T9493] R13: 0000000000000002 R14: 0000000000000010
R15: 0000000000000001
[   44.261223][ T9493] FS:  000000001cc7a400(0000)
GS:ffff8880d7388000(0000) knlGS:0000000000000000
[   44.262018][ T9493] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   44.262610][ T9493] CR2: 0000559e493b0b00 CR3: 000000010bb36000
CR4: 0000000000752ef0
[   44.263322][ T9493] PKRU: 55555554
[   44.263652][ T9493] Call Trace:
[   44.263962][ T9493]  <TASK>
[   44.264247][ T9493]  opera1_i2c_xfer+0x23e/0x3b0
[   44.264692][ T9493]  __i2c_transfer+0x7a3/0x1f80
[   44.265137][ T9493]  ? __lock_acquire+0x25db/0x2db0
[   44.265603][ T9493]  __i2c_smbus_xfer+0x105c/0x1f70
[   44.266082][ T9493]  ? __pfx___i2c_smbus_xfer+0x10/0x10
[   44.266581][ T9493]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   44.267184][ T9493]  ? rt_mutex_lock_nested+0x15c/0x1d0
[   44.267677][ T9493]  i2c_smbus_xfer+0x1f5/0x310
[   44.268112][ T9493]  i2cdev_ioctl_smbus+0x1e7/0x730
[   44.268578][ T9493]  ? __pfx_i2cdev_ioctl_smbus+0x10/0x10
[   44.269084][ T9493]  i2cdev_ioctl+0x615/0x880
[   44.269504][ T9493]  ? __pfx_i2cdev_ioctl+0x10/0x10
[   44.269964][ T9493]  ? __fget_files+0x2a/0x420
[   44.270392][ T9493]  ? __fget_files+0x3a0/0x420
[   44.270822][ T9493]  ? bpf_lsm_file_ioctl+0x9/0x20
[   44.271275][ T9493]  ? __pfx_i2cdev_ioctl+0x10/0x10
[   44.271737][ T9493]  __se_sys_ioctl+0xfc/0x170
[   44.272161][ T9493]  do_syscall_64+0x155/0x510
[   44.272591][ T9493]  ? trace_irq_disable+0x3b/0x140
[   44.273053][ T9493]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   44.273605][ T9493]  ? clear_bhb_loop+0x30/0x80
[   44.274036][ T9493]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   44.274576][ T9493] RIP: 0033:0x42709d
[   44.274940][ T9493] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d
45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10
00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25
28 00 00 00
[   44.276834][ T9493] RSP: 002b:00007fff29c1b880 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
[   44.277587][ T9493] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 000000000042709d
[   44.278298][ T9493] RDX: 00007fff29c1b900 RSI: 0000000000000720
RDI: 0000000000000005
[   44.279011][ T9493] RBP: 00007fff29c1b8d0 R08: 0000000000000001
R09: 0000000000000000
[   44.279727][ T9493] R10: 0000000000008040 R11: 0000000000000246
R12: 00007fff29c1bb98
[   44.280440][ T9493] R13: 00007fff29c1bba8 R14: 0000000000000002
R15: 00000000004caa40
[   44.281230][ T9493]  </TASK>
[   44.281542][ T9493] Modules linked in:
[   44.282087][ T9493] ---[ end trace 0000000000000000 ]---
[   44.284444][ T9493] RIP: 0010:opera1_xilinx_rw+0x138/0x2f0
[   44.284459][ T9493] Code: bf b1 00 00 00 89 de e8 b6 0e b1 f9 80 fb
b1 0f 85 e8 00 00 00 89 6c 24 04 4d 89 f5 49 c1 ed 03 48 bd 00 00 00
00 00 fc ff df <41> 0f b6 44 2d 00 84 c0 0f 85 28 01 00 00 41 0f b6 06
88 04 24 48
[   44.284465][ T9493] RSP: 0018:ffffc90007faf8d8 EFLAGS: 00010202
[   44.284472][ T9493] RAX: ffffffff8816914a RBX: 00000000000000b1
RCX: ffff88802936cc80
[   44.284478][ T9493] RDX: 0000000000000000 RSI: 00000000000000b1
RDI: 00000000000000b1
[   44.284482][ T9493] RBP: dffffc0000000000 R08: ffffffff90563d7f
R09: 1ffffffff20ac7af
[   44.284487][ T9493] R10: dffffc0000000000 R11: fffffbfff20ac7b0
R12: 0000000000000000
[   44.284492][ T9493] R13: 0000000000000002 R14: 0000000000000010
R15: 0000000000000001
[   44.284496][ T9493] FS:  000000001cc7a400(0000)
GS:ffff8880d7388000(0000) knlGS:0000000000000000
[   44.284502][ T9493] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   44.284507][ T9493] CR2: 00007f50595301e0 CR3: 000000010bb36000
CR4: 0000000000752ef0
[   44.284513][ T9493] PKRU: 55555554
[   44.284520][ T9493] Kernel panic - not syncing: Fatal exception
[   44.294754][ T9493] Kernel Offset: disabled
[   44.295298][ T9493] Rebooting in 86400 seconds..

Regards,

Attachment: reproducer.c
Description: Binary data