Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
MIME-Version: 1.0
References: <20220425083302.GD21864@xsang-OptiPlex-9020> <YmbvxQVNFESRwxxU@bombadil.infradead.org>
 <20220425144607.2c2588e6b1f00ab8a6f3f6ea@linux-foundation.org>
 <YmcqCVLv3HQ+Kxeq@bombadil.infradead.org> <20220425163434.5f8f47e8c301ea30c2f94a5a@linux-foundation.org>
 <Ymc1Zn8BbQMbjb58@bombadil.infradead.org> <Ymd0GIf3Ieh3DRcg@bombadil.infradead.org>
In-Reply-To: <Ymd0GIf3Ieh3DRcg@bombadil.infradead.org>
From:   Yongji Xie <xieyongji@bytedance.com>
Date:   Tue, 26 Apr 2022 12:49:49 +0800
Message-ID: <CACycT3vXkS3vbF2vduUg0XgLv-B=LdvyS1sVA0W=9+Se4AaVXA@mail.gmail.com>
Subject: Re: [proc/sysctl] 1dd38979b2: BUG:kernel_NULL_pointer_dereference,address
To:     Luis Chamberlain <mcgrof@kernel.org>
Cc:     Andrew Morton <akpm@linux-foundation.org>,
        "Michael S. Tsirkin" <mst@redhat.com>,
        Jason Wang <jasowang@redhat.com>,
        Dan Carpenter <dan.carpenter@oracle.com>,
        Eli Cohen <elic@nvidia.com>, Parav Pandit <parav@nvidia.com>,
        guanjun@linux.alibaba.com,
        kernel test robot <oliver.sang@intel.com>,
        Julius Hemanth Pitti <jpitti@cisco.com>,
        Johannes Weiner <hannes@cmpxchg.org>,
        Kees Cook <keescook@chromium.org>,
        Iurii Zaikin <yzaikin@google.com>, Ingo Molnar <mingo@elte.hu>,
        Al Viro <viro@zeniv.linux.org.uk>,
        LKML <linux-kernel@vger.kernel.org>, lkp@lists.01.org,
        lkp@intel.com,
        virtualization <virtualization@lists.linux-foundation.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Tue, Apr 26, 2022 at 12:25 PM Luis Chamberlain <mcgrof@kernel.org> wrote:
>
> On Mon, Apr 25, 2022 at 04:57:26PM -0700, Luis Chamberlain wrote:
> > On Mon, Apr 25, 2022 at 04:34:34PM -0700, Andrew Morton wrote:
> > > On Mon, 25 Apr 2022 16:08:57 -0700 Luis Chamberlain <mcgrof@kernel.org> wrote:
> > >
> > > > On Mon, Apr 25, 2022 at 02:46:07PM -0700, Andrew Morton wrote:
> > > > > On Mon, 25 Apr 2022 12:00:21 -0700 Luis Chamberlain <mcgrof@kernel.org> wrote:
> > > > >
> > > > > > Andrew, can we drop this patch for now?
> > > > >
> > > > > I've been sitting on (ie, forgotten about) this patch
> > > > > (https://lore.kernel.org/all/20200709235115.56954-1-jpitti@cisco.com/T/#u)
> > > >
> > > > Jesh, yeah I see.
> > > >
> > > > > for two years.  Evidently waiting for you/Kees/Ingo to provide
> > > > > guidance.  So sure, the need seems very unurgent so I can drop it.
> > > >
> > > > Well Keew as OK with it, but I yeah I can't decipher the issue at this
> > > > point in time.
> > > >
> > > > > However I fail to see how that patch could have caused this crash.  I'm
> > > > > suspecting a bisection error?
> > > > >
> > > > > Maybe something is unwell in drivers/vdpa/vdpa_user/vduse_dev.c.
> > > >
> > > > At a quick glance, yes it could very well by vduse_init() is messy and
> > > > races somehow with init, but if a race does lurk here my instincts tell
> > > > me this can't be the only place.
> > > >
> > > > Not sure if leaving a patch in place more time to see how else things
> > > > can explode is worth it.
> > >
> > > Confused.  Are you thinking that the above-linked patch was somehow
> > > involved in this crash?  If so, but how?  All it does it to permit
> > > unprivileged reads to four ints via proc_dointvec_minmax()?
> >
> > If the priv allows for it access to dereferencing a pointer is allowed.
> > How that race happens though, indeed is beyond the patch's fault.
>
> Even so, I am 99.99% sure this is a driver bug then. And so if enabling
> this patch just enables more driver bugs so be it.
>
> So driver maintainers: please take a look, I tried to check but
> the driver bug is not obvious to me yet.
>

Yes, I think it's a driver bug. I'll send a patch soon.

Thanks,
Yongji