Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <CA+G9fYs4JsmNxX4+W=wijfSPdDsOy=SWLBSitZper5ncPpdxqA@mail.gmail.com>
 <Y/T7unUf10Wis59a@smile.fi.intel.com> <Y/UFV2bgSyBI37vi@smile.fi.intel.com>
In-Reply-To: <Y/UFV2bgSyBI37vi@smile.fi.intel.com>
From:   Anders Roxell <anders.roxell@linaro.org>
Date:   Wed, 7 Jun 2023 20:32:47 +0200
Message-ID: <CADYN=9KCvyakA_8hN1QvSEvurfuUYoEyB1X3T9eYn3K1u2WMNQ@mail.gmail.com>
Subject: Re: arm64: libgpiod: refcount_t: underflow; use-after-free.
To:     Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc:     Naresh Kamboju <naresh.kamboju@linaro.org>,
        Linux Media Mailing List <linux-media@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>,
        "open list:GPIO SUBSYSTEM" <linux-gpio@vger.kernel.org>,
        lkft-triage@lists.linaro.org, Bartosz Golaszewski <brgl@bgdev.pl>,
        Ferry Toth <fntoth@gmail.com>,
        Linus Walleij <linus.walleij@linaro.org>, warthog618@gmail.com,
        Arnd Bergmann <arnd@arndb.de>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Tue, 21 Feb 2023 at 18:54, Andy Shevchenko
<andriy.shevchenko@linux.intel.com> wrote:
>
> On Tue, Feb 21, 2023 at 07:13:31PM +0200, Andy Shevchenko wrote:
> > On Mon, Feb 20, 2023 at 08:29:27PM +0530, Naresh Kamboju wrote:
> > > Following kernel warning notices on qemu-arm64, qemu-arm and also on devices
> > > running Linux version v6.2.0 while running libgpiod tests.
>
> ...
>
> > -             ACPI_COMPANION_SET(&pdev->dev, NULL);
>
> This line should stay otherwise it will remove the device that may share
> the fwnode with this newly created platform device.
>

I was this issue on todays next tag: next-20230607 too, when I ran
libgpiod v1.6.4, and I
trieed to apply your proposed patch, but it didn't solve the
"refcount_t: underflow; use-after-free.".

However, understand that I shouldn't run libgpiod v1.6.4, but I did by
accident. Not sure
that I think I should get a use-after-free if I run the wrong version
of the test-suite or?

Running with libgpiod v2.0.1 I do not see this use-after-free issue.

This is how I reproduced the issue on todays next tag next-20230607, I
use tuxmake [1] to build the kernel and tuxrun [2] to run test with
the booted kernel.
$git checkout next-20230607
$ tuxmake --runtime podman --target-arch arm64 --toolchain gcc-12
--kconfig defconfig --kconfig-add
https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-kernel/linux/files/lkft.config
--kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-kernel/linux/files/lkft-crypto.config
--kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-kernel/linux/files/distro-overrides.config
--kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-kernel/linux/files/systemd.config
--kconfig-add https://raw.githubusercontent.com/Linaro/meta-lkft/kirkstone/meta/recipes-kernel/linux/files/virtio.config
--kconfig-add CONFIG_ARM64_MODULE_PLTS=y --kconfig-add
CONFIG_SYN_COOKIES=y --kconfig-add CONFIG_SCHEDSTATS=y --kconfig-add
CONFIG_GPIOLIB=y --kconfig-add CONFIG_GPIO_CDEV=y --kconfig-add
CONFIG_GPIO_MOCKUP=m --kconfig-add CONFIG_GPIO_SIM=m --results-hook
'tuxrun --runtime podman --device qemu-arm64 --boot-args rw --tuxmake
./ --rootfs https://storage.tuxboot.com/debian/bookworm/arm64/rootfs.ext4.xz
--parameters SKIPFILE=skipfile-lkft.yaml --tests libgpiod --timeouts
boot=30 --overlay
https://storage.dev.tuxboot.com/overlays/debian/bookworm/arm64/libgpiod/v1.6.4/libgpiod.tar.xz
--save-output --log-file -'

Cheers,
Anders
[1] https://tuxmake.org/
[2] https://tuxrun.org/