| TITLE: WARNING: refcount bug in input_register_device |
| |
| [ 116.957737] ------------[ cut here ]------------ |
| [ 116.963070] refcount_t: increment on 0; use-after-free. |
| [ 116.968562] WARNING: CPU: 1 PID: 4353 at lib/refcount.c:153 refcount_inc+0x47/0x50 |
| [ 116.976271] Kernel panic - not syncing: panic_on_warn set ... |
| [ 116.976271] |
| [ 116.983645] CPU: 1 PID: 4353 Comm: syz-executor5 Not tainted 4.14.89+ #6 |
| [ 116.990488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| [ 116.999846] Call Trace: |
| [ 117.002449] dump_stack+0x114/0x1cf |
| [ 117.006086] ? show_regs_print_info+0x6a/0x6a |
| [ 117.010593] ? _atomic_dec_and_lock+0x171/0x171 |
| [ 117.015311] ? do_raw_spin_trylock+0x190/0x190 |
| [ 117.019907] ? refcount_inc+0x47/0x50 |
| [ 117.023720] panic+0x1bb/0x3a0 |
| [ 117.026918] ? add_taint.cold.6+0x16/0x16 |
| [ 117.031077] ? __warn.cold.9+0x5/0x46 |
| [ 117.034887] ? refcount_inc+0x47/0x50 |
| [ 117.038733] __warn.cold.9+0x20/0x46 |
| [ 117.042485] ? refcount_inc+0x47/0x50 |
| [ 117.046293] report_bug+0x1fd/0x272 |
| [ 117.049928] do_error_trap+0x1c2/0x430 |
| [ 117.053825] ? math_error+0x3e0/0x3e0 |
| [ 117.057636] ? vprintk_func+0x63/0xea |
| [ 117.061440] ? printk+0xa3/0xbf |
| [ 117.064735] ? show_regs_print_info+0x6a/0x6a |
| [ 117.069235] ? trace_hardirqs_off_thunk+0x1a/0x1c |
| [ 117.074091] do_invalid_op+0x20/0x30 |
| [ 117.077813] invalid_op+0x1b/0x40 |
| [ 117.081277] RIP: 0010:refcount_inc+0x47/0x50 |
| [ 117.085913] RSP: 0018:ffff8881c966f878 EFLAGS: 00010282 |
| [ 117.085949] RAX: 000000000000002b RBX: ffff8881d40fa500 RCX: ffffc9000207d000 |
| [ 117.085958] RDX: 00000000000030e2 RSI: ffffffff812d86d3 RDI: ffff8881c966f3c0 |
| [ 117.085966] RBP: ffff8881c966f880 R08: ffff8881a65421c8 R09: 0000000000000006 |
| [ 117.085974] R10: 0000000000000000 R11: ffff8881a6541900 R12: dffffc0000000000 |
| [ 117.085981] R13: ffff8881d40fa4d0 R14: ffff8881d2b7bfc0 R15: ffff8881da3217c8 |
| [ 117.086009] ? vprintk_func+0x63/0xea |
| [ 117.131534] ? refcount_inc+0x47/0x50 |
| [ 117.135349] kobject_get+0x50/0xa0 |
| [ 117.139493] get_device_parent.isra.27+0x3e0/0x5a0 |
| [ 117.144452] device_add+0x301/0x1620 |
| [ 117.144471] ? device_private_init+0x240/0x240 |
| [ 117.144502] ? __kmalloc+0x17f/0x380 |
| [ 117.144520] input_register_device+0x660/0xbb0 |
| [ 117.144546] ? devm_input_allocate_device+0x130/0x130 |
| [ 117.144559] ? lock_release+0x920/0x920 |
| [ 117.144577] uinput_ioctl_handler.isra.9+0x9f3/0x1fe0 |
| [ 117.144591] ? uinput_request_submit.part.8+0x290/0x290 |
| [ 117.144613] ? __fget+0x37b/0x580 |
| [ 117.144622] ? lock_downgrade+0x700/0x700 |
| [ 117.144640] ? expand_files.part.8+0x850/0x850 |
| [ 117.144656] ? static_key_enable.constprop.102+0x1b0/0x1b0 |
| [ 117.144672] ? uinput_compat_ioctl+0x80/0x80 |
| [ 117.144681] uinput_ioctl+0x51/0x60 |
| [ 117.144695] do_vfs_ioctl+0x1a4/0x1540 |
| [ 117.144713] ? ioctl_preallocate+0x2c0/0x2c0 |
| [ 117.144726] ? fget_raw+0x20/0x20 |
| [ 117.144739] ? put_timespec64+0x103/0x190 |
| [ 117.144749] ? nsecs_to_jiffies+0x30/0x30 |
| [ 117.144788] ? SyS_clock_gettime+0x111/0x1c0 |
| [ 117.144802] ? security_file_ioctl+0x94/0xc0 |
| [ 117.144818] SyS_ioctl+0x94/0xc0 |
| [ 117.144830] ? do_vfs_ioctl+0x1540/0x1540 |
| [ 117.144843] do_syscall_64+0x251/0x750 |
| [ 117.144857] ? copy_overflow+0x20/0x20 |
| [ 117.144868] ? syscall_return_slowpath+0x3b0/0x3b0 |
| [ 117.144881] ? syscall_return_slowpath+0x220/0x3b0 |
| [ 117.144893] ? __switch_to_asm+0x34/0x70 |
| [ 117.144906] ? prepare_exit_to_usermode+0x270/0x270 |
| [ 117.144920] ? entry_SYSCALL_64_after_hwframe+0x52/0xb7 |
| [ 117.144936] ? trace_hardirqs_off_thunk+0x1a/0x1c |
| [ 117.144956] entry_SYSCALL_64_after_hwframe+0x42/0xb7 |
| [ 117.144964] RIP: 0033:0x457669 |
| [ 117.144970] RSP: 002b:00007fb14c000c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 |
| [ 117.144982] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000000457669 |
| [ 117.144989] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000004 |
| [ 117.144995] RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000 |
| [ 117.145003] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb14c0016d4 |
| [ 117.145010] R13: 00000000004c17af R14: 00000000004d3390 R15: 00000000ffffffff |
| [ 117.146088] Kernel Offset: disabled |
| [ 117.336935] Rebooting in 86400 seconds.. |
