Messages in this thread |  | | Subject | Re: [BUG] rtlwifi: a crash in error handling code of rtl_pci_probe() | From | Jia-Ju Bai <> | Date | Wed, 15 May 2019 09:20:09 +0800 |
| |
On 2019/5/15 9:08, Larry Finger wrote: > On 5/14/19 8:07 AM, Jia-Ju Bai wrote: >> In rtl_pci_probe(), when request_irq() in rtl_pci_intr_mode_legacy() >> in rtl_pci_intr_mode_decide() fails, a crash occurs. >> The crash information is as follows: >> >> [ 108.271155] kasan: CONFIG_KASAN_INLINE enabled >> [ 108.271163] kasan: GPF could be caused by NULL-ptr deref or user >> memory access >> ...... >> [ 108.271193] RIP: 0010:cfg80211_get_drvinfo+0xce/0x3b0 [cfg80211] >> ...... >> [ 108.271235] Call Trace: >> [ 108.271245] ethtool_get_drvinfo+0x110/0x640 >> [ 108.271255] ? cfg80211_get_chan_state+0x7e0/0x7e0 [cfg80211] >> [ 108.271261] ? ethtool_get_settings+0x340/0x340 >> [ 108.271268] ? __read_once_size_nocheck.constprop.7+0x20/0x20 >> [ 108.271279] ? kasan_check_write+0x14/0x20 >> [ 108.271284] dev_ethtool+0x272d/0x4c20 >> [ 108.271290] ? unwind_get_return_address+0x66/0xb0 >> [ 108.271299] ? __save_stack_trace+0x92/0x100 >> [ 108.271307] ? ethtool_get_rxnfc+0x3f0/0x3f0 >> [ 108.271316] ? save_stack+0xa3/0xd0 >> [ 108.271323] ? save_stack+0x43/0xd0 >> [ 108.271331] ? ftrace_graph_ret_addr+0x2d/0x170 >> [ 108.271338] ? ftrace_graph_ret_addr+0x2d/0x170 >> [ 108.271346] ? ftrace_graph_ret_addr+0x2d/0x170 >> [ 108.271354] ? update_stack_state+0x3b2/0x670 >> [ 108.271361] ? update_stack_state+0x3b2/0x670 >> [ 108.271370] ? __read_once_size_nocheck.constprop.7+0x20/0x20 >> [ 108.271379] ? unwind_next_frame.part.5+0x19f/0xa60 >> [ 108.271388] ? bpf_prog_kallsyms_find+0x3e/0x270 >> [ 108.271396] ? is_bpf_text_address+0x1a/0x30 >> [ 108.271408] ? kernel_text_address+0x11d/0x130 >> [ 108.271416] ? __kernel_text_address+0x12/0x40 >> [ 108.271423] ? unwind_get_return_address+0x66/0xb0 >> [ 108.271431] ? __save_stack_trace+0x92/0x100 >> [ 108.271440] ? save_stack+0xa3/0xd0 >> [ 108.271448] ? udp_ioctl+0x35/0xe0 >> [ 108.271457] ? inet_ioctl+0x100/0x320 >> [ 108.271466] ? inet_stream_connect+0xb0/0xb0 >> [ 108.271475] ? alloc_file+0x60/0x480 >> [ 108.271483] ? alloc_file_pseudo+0x19d/0x270 >> [ 108.271495] ? sock_alloc_file+0x51/0x170 >> [ 108.271502] ? __sys_socket+0x12c/0x1f0 >> [ 108.271510] ? __x64_sys_socket+0x78/0xb0 >> [ 108.271520] ? do_syscall_64+0xb1/0x2e0 >> [ 108.271529] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 >> [ 108.271538] ? kasan_check_read+0x11/0x20 >> [ 108.271548] ? mutex_lock+0x8f/0xe0 >> [ 108.271557] ? __mutex_lock_slowpath+0x20/0x20 >> [ 108.271568] dev_ioctl+0x1fb/0xae0 >> [ 108.271576] ? dev_ioctl+0x1fb/0xae0 >> [ 108.271586] ? _copy_from_user+0x71/0xd0 >> [ 108.271594] sock_do_ioctl+0x1e2/0x2f0 >> [ 108.271602] ? kmem_cache_alloc+0xf9/0x250 >> [ 108.271611] ? ___sys_recvmsg+0x5a0/0x5a0 >> [ 108.271621] ? apparmor_file_alloc_security+0x128/0x7e0 >> [ 108.271630] ? kasan_unpoison_shadow+0x35/0x50 >> [ 108.271638] ? kasan_kmalloc+0xad/0xe0 >> [ 108.271652] ? apparmor_file_alloc_security+0x128/0x7e0 >> [ 108.271662] ? apparmor_file_alloc_security+0x269/0x7e0 >> [ 108.271670] sock_ioctl+0x361/0x590 >> [ 108.271678] ? sock_ioctl+0x361/0x590 >> [ 108.271686] ? routing_ioctl+0x470/0x470 >> [ 108.271695] ? kasan_check_write+0x14/0x20 >> [ 108.271703] ? __mutex_init+0xba/0x130 >> [ 108.271713] ? percpu_counter_add_batch+0xc7/0x120 >> [ 108.271722] ? alloc_empty_file+0xae/0x150 >> [ 108.271729] ? routing_ioctl+0x470/0x470 >> [ 108.271738] do_vfs_ioctl+0x1ae/0xfe0 >> [ 108.271745] ? do_vfs_ioctl+0x1ae/0xfe0 >> [ 108.271754] ? alloc_file_pseudo+0x1ad/0x270 >> [ 108.271762] ? ioctl_preallocate+0x1e0/0x1e0 >> [ 108.271770] ? alloc_file+0x480/0x480 >> [ 108.271778] ? kasan_check_read+0x11/0x20 >> [ 108.271786] ? __fget+0x24d/0x320 >> [ 108.271794] ? iterate_fd+0x180/0x180 >> [ 108.271802] ? fd_install+0x52/0x60 >> [ 108.271812] ? security_file_ioctl+0x8c/0xb0 >> [ 108.271820] ksys_ioctl+0x99/0xb0 >> [ 108.271829] __x64_sys_ioctl+0x78/0xb0 >> [ 108.271839] do_syscall_64+0xb1/0x2e0 >> [ 108.271857] ? prepare_exit_to_usermode+0xc8/0x160 >> [ 108.271871] entry_SYSCALL_64_after_hwframe+0x44/0xa9 >> ...... >> >> I checked the driver source code, but cannot find the reason, so I >> only report the crash... >> Can somebody give an explanation about this crash? >> >> This crash is triggered by a runtime fuzzing tool named FIZZER >> written by us. > > Your backtrace does not include any references to rtlwifi routines, > and I have no idea what FIZZER does, thus it is not possible for me to > debug this. If the error situation that you state happens, the code > should end up at label "fail3" in routine rtl_pci_probe(). Insert > printk statements after every line of the following, and report the > last good point before the error. It is certainly possible that > something is being torn down that was never erected. The likelihood of > failure of both MSI and legacy interrupts is not very likely, and we > probably have never hit those conditions. > > fail3: > pci_set_drvdata(pdev, NULL); > rtl_deinit_core(hw); > > fail2: > if (rtlpriv->io.pci_mem_start != 0) > pci_iounmap(pdev, (void __iomem > *)rtlpriv->io.pci_mem_start); > > pci_release_regions(pdev); > complete(&rtlpriv->firmware_loading_complete); > > fail1: > if (hw) > ieee80211_free_hw(hw); > pci_disable_device(pdev); > > return err;
Thanks for the advice :) I will insert some printk statements to debug this problem.
Best wishes, Jia-Ju Bai
|  |