[BUG] general protection fault in stv06xx_write_sensor

[Farhad Alemi]

Hello,

We are reporting the following crash (reproducer attached):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)

[   45.011080][ T9488] Oops: general protection fault, probably for
non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI
[   45.012184][ T9488] KASAN: null-ptr-deref in range
[0x0000000000000020-0x0000000000000027]
[   45.012951][ T9488] CPU: 1 UID: 0 PID: 9488 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[   45.013900][ T9488] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[   45.014860][ T9488] RIP: 0010:stv06xx_write_sensor+0xa0/0x190
[   45.015416][ T9488] Code: a3 28 0d 00 00 4c 89 e0 48 c1 e8 03 42 80
3c 28 00 74 08 4c 89 e7 e8 7f b7 ff f9 4d 8b 24 24 49 83 c4 22 4c 89
e0 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 b9 00 00 00 45 0f b6 24 24
bf 02 00 00
[   45.017145][ T9488] RSP: 0018:ffffc9000388f420 EFLAGS: 00010202
[   45.017703][ T9488] RAX: 0000000000000004 RBX: ffff88802c616000
RCX: ffff8881096c2640
[   45.018417][ T9488] RDX: 0000000000000000 RSI: 0000000000000001
RDI: ffff88802c616000
[   45.019193][ T9488] RBP: ffffc9000388f4d0 R08: ffffffff90563d7f
R09: 1ffffffff20ac7af
[   45.019939][ T9488] R10: dffffc0000000000 R11: fffffbfff20ac7b0
R12: 0000000000000022
[   45.020655][ T9488] R13: dffffc0000000000 R14: 1ffff92000711e88
R15: 0000000000000001
[   45.021370][ T9488] FS:  00007f1761e486c0(0000)
GS:ffff8881da588000(0000) knlGS:0000000000000000
[   45.022173][ T9488] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   45.022771][ T9488] CR2: 000055f682688a50 CR3: 000000002bf7b000
CR4: 0000000000752ef0
[   45.023489][ T9488] PKRU: 55555554
[   45.023820][ T9488] Call Trace:
[   45.024132][ T9488]  <TASK>
[   45.024411][ T9488]  ? __pfx_stv06xx_write_sensor+0x10/0x10
[   45.024938][ T9488]  ? usb_ifnum_to_if+0x262/0x2f0
[   45.025400][ T9488]  ? usb_altnum_to_altsetting+0xe3/0x120
[   45.025917][ T9488]  pb0100_start+0x27b/0x4c0
[   45.026335][ T9488]  stv06xx_start+0x2a3/0x6b0
[   45.026765][ T9488]  gspca_init_transfer+0x2470/0x3060
[   45.027255][ T9488]  ? __pfx_gspca_init_transfer+0x10/0x10
[   45.027771][ T9488]  ? add_lock_to_list+0xc7/0x100
[   45.028229][ T9488]  ? __lock_acquire+0x74c/0x2db0
[   45.028756][ T9488]  ? __pfx_do_raw_spin_lock+0x10/0x10
[   45.029245][ T9488]  ? __pfx_gspca_start_streaming+0x10/0x10
[   45.029779][ T9488]  gspca_start_streaming+0x6f/0x250
[   45.030254][ T9488]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[   45.030795][ T9488]  ? __pfx_gspca_start_streaming+0x10/0x10
[   45.031326][ T9488]  vb2_start_streaming+0x128/0x460
[   45.031798][ T9488]  vb2_core_streamon+0x2e0/0x4f0
[   45.032255][ T9488]  __vb2_init_fileio+0xca2/0xff0
[   45.032716][ T9488]  __vb2_perform_fileio+0x282/0x1620
[   45.033199][ T9488]  ? __lock_acquire+0x74c/0x2db0
[   45.033657][ T9488]  vb2_fop_read+0x273/0x360
[   45.034073][ T9488]  v4l2_read+0x19c/0x2c0
[   45.034463][ T9488]  ? __pfx_v4l2_read+0x10/0x10
[   45.034905][ T9488]  vfs_read+0x20c/0xa70
[   45.035290][ T9488]  ? __pfx_vfs_read+0x10/0x10
[   45.035725][ T9488]  ? __fget_files+0x2a/0x420
[   45.036149][ T9488]  ? __fget_files+0x2a/0x420
[   45.036575][ T9488]  ? __fget_files+0x3a0/0x420
[   45.037004][ T9488]  ? __fget_files+0x2a/0x420
[   45.037428][ T9488]  ksys_read+0x150/0x270
[   45.037821][ T9488]  ? __pfx_ksys_read+0x10/0x10
[   45.038261][ T9488]  do_syscall_64+0x155/0x510
[   45.038758][ T9488]  ? trace_irq_disable+0x3b/0x140
[   45.039220][ T9488]  ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   45.039775][ T9488]  ? clear_bhb_loop+0x30/0x80
[   45.040207][ T9488]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   45.040747][ T9488] RIP: 0033:0x45e2b2
[   45.041112][ T9488] Code: 08 0f 85 11 eb ff ff 49 89 fb 48 89 f0 48
89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89
5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa
55 48 89 e5
[   45.042833][ T9488] RSP: 002b:00007f1761e47118 EFLAGS: 00000246
ORIG_RAX: 0000000000000000
[   45.043584][ T9488] RAX: ffffffffffffffda RBX: 00007f1761e486c0
RCX: 000000000045e2b2
[   45.044294][ T9488] RDX: 0000000000001000 RSI: 00007f1761e471d0
RDI: 0000000000000004
[   45.045007][ T9488] RBP: 00007f1761e47140 R08: 0000000000000000
R09: 0000000000000000
[   45.045721][ T9488] R10: 0000000000000000 R11: 0000000000000246
R12: 00007f1761e486c0
[   45.046430][ T9488] R13: 00007ffdbfd8c180 R14: 00007f1761e48ce4
R15: 00007ffdbfd8c277
[   45.047145][ T9488]  </TASK>
[   45.047431][ T9488] Modules linked in:
[   45.047847][ T9488] ---[ end trace 0000000000000000 ]---
[   45.048378][ T9488] RIP: 0010:stv06xx_write_sensor+0xa0/0x190
[   45.048391][ T9488] Code: a3 28 0d 00 00 4c 89 e0 48 c1 e8 03 42 80
3c 28 00 74 08 4c 89 e7 e8 7f b7 ff f9 4d 8b 24 24 49 83 c4 22 4c 89
e0 48 c1 e8 03 <42> 0f b6 04 28 84 c0 0f 85 b9 00 00 00 45 0f b6 24 24
bf 02 00 00
[   45.048397][ T9488] RSP: 0018:ffffc9000388f420 EFLAGS: 00010202
[   45.048403][ T9488] RAX: 0000000000000004 RBX: ffff88802c616000
RCX: ffff8881096c2640
[   45.048408][ T9488] RDX: 0000000000000000 RSI: 0000000000000001
RDI: ffff88802c616000
[   45.048412][ T9488] RBP: ffffc9000388f4d0 R08: ffffffff90563d7f
R09: 1ffffffff20ac7af
[   45.048417][ T9488] R10: dffffc0000000000 R11: fffffbfff20ac7b0
R12: 0000000000000022
[   45.048422][ T9488] R13: dffffc0000000000 R14: 1ffff92000711e88
R15: 0000000000000001
[   45.048427][ T9488] FS:  00007f1761e486c0(0000)
GS:ffff8881da588000(0000) knlGS:0000000000000000
[   45.048433][ T9488] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   45.048437][ T9488] CR2: 000055f682688a50 CR3: 000000002bf7b000
CR4: 0000000000752ef0
[   45.048443][ T9488] PKRU: 55555554
[   45.048449][ T9488] Kernel panic - not syncing: Fatal exception
[   45.058375][ T9488] Kernel Offset: disabled
[   45.058962][ T9488] Rebooting in 86400 seconds..

Regards,

Attachment: reproducer.c
Description: Binary data