Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <CA+G9fYs4JsmNxX4+W=wijfSPdDsOy=SWLBSitZper5ncPpdxqA@mail.gmail.com>
 <CAMRc=MdRev1NBz9ga0jcDKD0oZy_W-7caq9R0tQkUG86rBQ=3Q@mail.gmail.com> <CADYN=9Kj9A6utjkPMuAQ4=ytvBiL50GnTzttauRWLQZOn5rzeQ@mail.gmail.com>
In-Reply-To: <CADYN=9Kj9A6utjkPMuAQ4=ytvBiL50GnTzttauRWLQZOn5rzeQ@mail.gmail.com>
From:   Bartosz Golaszewski <brgl@bgdev.pl>
Date:   Wed, 7 Jun 2023 21:34:48 +0200
Message-ID: <CAMRc=Mfyt3wOzDT-4WRUG-2AzyqsJZnt6XikyPCEWhv1O8QTNA@mail.gmail.com>
Subject: Re: arm64: libgpiod: refcount_t: underflow; use-after-free.
To:     Anders Roxell <anders.roxell@linaro.org>
Cc:     Naresh Kamboju <naresh.kamboju@linaro.org>,
        Linux Media Mailing List <linux-media@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>,
        "open list:GPIO SUBSYSTEM" <linux-gpio@vger.kernel.org>,
        lkft-triage@lists.linaro.org,
        Andy Shevchenko <andriy.shevchenko@linux.intel.com>,
        Ferry Toth <fntoth@gmail.com>,
        Linus Walleij <linus.walleij@linaro.org>, warthog618@gmail.com,
        Arnd Bergmann <arnd@arndb.de>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Wed, Jun 7, 2023 at 8:35=E2=80=AFPM Anders Roxell <anders.roxell@linaro.=
org> wrote:
>
> On Wed, 22 Feb 2023 at 13:36, Bartosz Golaszewski <brgl@bgdev.pl> wrote:
> >
> > On Mon, Feb 20, 2023 at 3:59 PM Naresh Kamboju
> > <naresh.kamboju@linaro.org> wrote:
> > >
> > > Following kernel warning notices on qemu-arm64, qemu-arm and also on =
devices
> > > running Linux version v6.2.0 while running libgpiod tests.
> > >
> >
> > I don't see it on v6.2 with libgpiod v1.6.4. Seeing the output of the
> > test script, it seems you're using an old version - what is it?
>
> Yes, I did run libgpiod v1.6.4 by mistake on todays next-20230607 tag.
> Not sure if I should or should not get the use-after-free warning by
> running the "wrong version"
> of a test suite or?
>

It doesn't matter, v1.6.4 is still supported. I'll give it a try tomorrow.

Brt

> >
> > > + ./gpiod.sh /opt/libgpiod/bin/
> >
> > What's in gpiod.sh?
>
> its a wrapper script around gpiod-test [1] to parse the output to be
> understood by our test framework
>
> Cheers,
> Anders
> [1] https://github.com/Linaro/test-definitions/blob/master/automated/linu=
x/gpiod/gpiod.sh
>
> >
> > Bart
> >
> > >   [INFO]    libgpiod test suite
> > >   [INFO]    117 tests registered
> > >   [INFO]    checking the linux kernel version
> > >   [INFO]    kernel release is v6.2.0 - ok to run tests
> > >   [INFO]    using gpio-tools from '/usr/bin'
> > > [   10.499036] ------------[ cut here ]------------
> > > [   10.499656] refcount_t: underflow; use-after-free.
> > > [   10.500264] WARNING: CPU: 2 PID: 291 at lib/refcount.c:28
> > > refcount_warn_saturate+0xf4/0x144
> > > [   10.501306] Modules linked in: gpio_mockup(-) cfg80211 bluetooth
> > > rfkill crct10dif_ce fuse drm
> > > [   10.502364] CPU: 2 PID: 291 Comm: gpiod-test Not tainted 6.2.0 #1
> > > [   10.503229] Hardware name: linux,dummy-virt (DT)
> > > [   10.503883] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS =
BTYPE=3D--)
> > > [   10.505331] pc : refcount_warn_saturate+0xf4/0x144
> > > [   10.505723] lr : refcount_warn_saturate+0xf4/0x144
> > > [   10.506115] sp : ffff800008983cd0
> > > [   10.506391] x29: ffff800008983cd0 x28: ffff0000c4c4c100 x27: 00000=
00000000000
> > > [   10.506961] x26: 0000000000000000 x25: 0000000000000000 x24: 00000=
00000000000
> > > [   10.507533] x23: 0000000000000200 x22: ffff0000c4e66800 x21: ffff0=
000c7734640
> > > [   10.508104] x20: 0000000000000001 x19: ffff0000c7734600 x18: fffff=
fffffffffff
> > > [   10.508677] x17: 3d4d455453595342 x16: ffffcf0234432020 x15: ffff8=
00088983957
> > > [   10.509424] x14: 0000000000000000 x13: 2e656572662d7265 x12: 74666=
12d65737520
> > > [   10.510003] x11: 3b776f6c66726564 x10: ffffcf02365db580 x9 : ffffc=
f0233b20138
> > > [   10.510575] x8 : 00000000ffffefff x7 : ffffcf02365db580 x6 : 00000=
00000000001
> > > [   10.511145] x5 : ffffcf023655f000 x4 : ffffcf023655f2e8 x3 : 00000=
00000000000
> > > [   10.511721] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0=
000c4c4c100
> > > [   10.512294] Call trace:
> > > [   10.512494]  refcount_warn_saturate+0xf4/0x144
> > > [   10.512971]  kobject_put+0x164/0x220
> > > [   10.513224]  fwnode_remove_software_node+0x44/0x60
> > > [   10.513554]  gpio_mockup_unregister_pdevs+0x54/0x70 [gpio_mockup]
> > > [   10.513970]  gpio_mockup_exit+0x10/0x328 [gpio_mockup]
> > > [   10.514322]  __arm64_sys_delete_module+0x190/0x2a0
> > > [   10.514653]  invoke_syscall+0x50/0x120
> > > [   10.514915]  el0_svc_common.constprop.0+0x104/0x124
> > > [   10.515277]  do_el0_svc+0x44/0xcc
> > > [   10.515541]  el0_svc+0x30/0x94
> > > [   10.515788]  el0t_64_sync_handler+0xbc/0x13c
> > > [   10.516126]  el0t_64_sync+0x190/0x194
> > > [   10.516419] ---[ end trace 0000000000000000 ]---
> > >
> > >
> > > Build and test logs,
> > > https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2/t=
estrun/14856342/suite/libgpiod/test/ctxless-get-value-single-line/log
> > > https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.2/t=
estrun/14856342/suite/libgpiod/tests/
> > >
> > >
> > > --
> > > Linaro LKFT
> > > https://lkft.linaro.org