lkrg-org / lkrg

Linux Kernel Runtime Guard
https://lkrg.org
Other
410 stars 72 forks source link

Linux post-6.3: cpufreq_unregister_notifier NULL deref #268

Open Adam-pi3 opened 1 year ago

Adam-pi3 commented 1 year ago

NULL deref bug is hit during LKRG unloading when cpufreq_unregister_notifier is executed. I'm not sure it has anything to do with LKRG itself. From the quick look it seems to be the Linux kernel problem but I want to spend more time on it when I have more time. Some notes:

[Tue May  2 23:08:28 2023] LKRG: DYING: Unloading LKRG
[Tue May  2 23:08:28 2023] BUG: kernel NULL pointer dereference, address: 0000000000000000
[Tue May  2 23:08:28 2023] #PF: supervisor write access in kernel mode
[Tue May  2 23:08:28 2023] #PF: error_code(0x0002) - not-present page
[Tue May  2 23:08:28 2023] PGD 0 P4D 0 
[Tue May  2 23:08:28 2023] Oops: 0002 [#1] PREEMPT SMP PTI
[Tue May  2 23:08:28 2023] CPU: 0 PID: 5596 Comm: rmmod Tainted: G           O       6.3.0+ #1
[Tue May  2 23:08:28 2023] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
[Tue May  2 23:08:28 2023] RIP: 0010:rcu_segcblist_enqueue+0x38/0x50
[Tue May  2 23:08:28 2023] Code: 00 48 8b 47 48 48 83 c0 01 48 89 47 48 f0 83 44 24 fc 00 48 8b 47 68 48 83 c0 01 48 89 47 68 48 c7 06 00 00 00 00 48 8b 47 20 <48> 89 30 5d 48 89 77 20 31 c0 31 f6 31 ff c3 cc cc cc cc 0f 1f 44
[Tue May  2 23:08:28 2023] RSP: 0018:ffffc900009b3c40 EFLAGS: 00010002
[Tue May  2 23:08:28 2023] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[Tue May  2 23:08:28 2023] RDX: 0000000000000000 RSI: ffffc900009b3cd0 RDI: ffff888235e30848
[Tue May  2 23:08:28 2023] RBP: ffffc900009b3c40 R08: 0000000000000000 R09: 0000000000000000
[Tue May  2 23:08:28 2023] R10: 0000000000000000 R11: 0000000000000000 R12: ffff888235e30800
[Tue May  2 23:08:28 2023] R13: ffffffff82f4a2e0 R14: ffff888235e30840 R15: ffff888235e30848
[Tue May  2 23:08:28 2023] FS:  00007f8efddf9040(0000) GS:ffff888235e00000(0000) knlGS:0000000000000000
[Tue May  2 23:08:28 2023] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[Tue May  2 23:08:28 2023] CR2: 0000000000000000 CR3: 0000000116540003 CR4: 00000000003706f0
[Tue May  2 23:08:28 2023] Call Trace:
[Tue May  2 23:08:28 2023]  <TASK>
[Tue May  2 23:08:28 2023]  srcu_gp_start_if_needed+0x110/0x540
[Tue May  2 23:08:28 2023]  ? kretprobe_rethook_handler+0x45/0x80
[Tue May  2 23:08:28 2023]  __synchronize_srcu+0x87/0xd0
[Tue May  2 23:08:28 2023]  ? __pfx_wakeme_after_rcu+0x10/0x10
[Tue May  2 23:08:28 2023]  ? ktime_get_mono_fast_ns+0x43/0xb0
[Tue May  2 23:08:28 2023]  synchronize_srcu+0xb9/0x110
[Tue May  2 23:08:28 2023]  srcu_notifier_chain_unregister+0x4c/0x80
[Tue May  2 23:08:28 2023]  cpufreq_unregister_notifier+0x71/0xb0
[Tue May  2 23:08:28 2023]  p_deregister_notifiers+0x17/0x70 [lkrg]
[Tue May  2 23:08:28 2023]  p_lkrg_deregister+0x26/0xcb0 [lkrg]
[Tue May  2 23:08:28 2023]  __do_sys_delete_module.constprop.0+0x1a0/0x2f0
[Tue May  2 23:08:28 2023]  __x64_sys_delete_module+0x12/0x20
[Tue May  2 23:08:28 2023]  do_syscall_64+0x58/0x90
[Tue May  2 23:08:28 2023]  ? exit_to_user_mode_prepare+0x39/0x170
[Tue May  2 23:08:28 2023]  ? syscall_exit_to_user_mode+0x29/0x50
[Tue May  2 23:08:28 2023]  ? do_syscall_64+0x67/0x90
[Tue May  2 23:08:28 2023]  ? irqentry_exit+0x43/0x50
[Tue May  2 23:08:28 2023]  ? exc_page_fault+0x91/0x1b0
[Tue May  2 23:08:28 2023]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
[Tue May  2 23:08:28 2023] RIP: 0033:0x7f8efd51ec0b
[Tue May  2 23:08:28 2023] Code: 73 01 c3 48 8b 0d 0d 72 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d dd 71 0d 00 f7 d8 64 89 01 48
[Tue May  2 23:08:28 2023] RSP: 002b:00007fff970cb8a8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
[Tue May  2 23:08:28 2023] RAX: ffffffffffffffda RBX: 000055884a7ec6e0 RCX: 00007f8efd51ec0b
[Tue May  2 23:08:28 2023] RDX: 0000000000000000 RSI: 0000000000000a00 RDI: 000055884a7ec748
[Tue May  2 23:08:28 2023] RBP: 0000000000000200 R08: 00007f8efd5f6ce0 R09: 00000000000000b0
[Tue May  2 23:08:28 2023] R10: 0000000000000000 R11: 0000000000000206 R12: 00007fff970cbb08
[Tue May  2 23:08:28 2023] R13: 00007fff970cc65a R14: 000055884a7ec2a0 R15: 00007fff970cbb10
[Tue May  2 23:08:28 2023]  </TASK>