linux-kernel - Re: Linux 4.8-rc1 Cirrus QEMU crashes on boot.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:	Mon, 8 Aug 2016 14:19:23 -0700
From:	Linus Torvalds <torvalds@...ux-foundation.org>
To:	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Boris Brezillon <boris.brezillon@...e-electrons.com>,
	Daniel Vetter <daniel.vetter@...ll.ch>
Cc:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Dave Airlie <airlied@...hat.com>,
	David Airlie <airlied@...ux.ie>,
	DRI <dri-devel@...ts.freedesktop.org>
Subject: Re: Linux 4.8-rc1 Cirrus QEMU crashes on boot.

On Mon, Aug 8, 2016 at 1:24 PM, Eric W. Biederman <ebiederm@...ssion.com> wrote:
>
> Booting up v4.8-rc1 in qemu today I ran I ran into this beautiful oops.
>
> I am just about to head out the door on vacation until the end of the
> month so hopefully I am tossing out enough information to the right
> people.
>
> I have confirmed that disabling CONFIG_DRM_CIRRUS_QEMU avoids this
> crash.
>
> [    0.720167] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
> [    0.721348] IP: [<ffffffff8d5ef9ac>] drm_pick_crtcs+0xfc/0x270
> [    0.722249] PGD 0
> [    0.722659] Oops: 0000 [#1] SMP
> [    0.723141] Modules linked in:
> [    0.723643] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.8.0-rc1+ #116
> [    0.724602] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
> [    0.725450] task: ffff8800bbf28000 task.stack: ffff8800bbf30000
> [    0.726327] RIP: 0010:[<ffffffff8d5ef9ac>]  [<ffffffff8d5ef9ac>] drm_pick_crtcs+0xfc/0x270
> [    0.727648] RSP: 0000:ffff8800bbf33978  EFLAGS: 00010217
> [    0.728444] RAX: ffffffff8d623a20 RBX: 0000000000000000 RCX: ffff8800baf3f860
> [    0.729498] RDX: 0000000000000000 RSI: 0000000000001000 RDI: ffff8800baf3f800
> [    0.730626] RBP: ffff8800bbf339f8 R08: 0000000000000000 R09: 0000000000000001
> [    0.731704] R10: 0000000000000001 R11: 0000000000000000 R12: ffff8800bbaf3af0
> [    0.732827] R13: ffff8800bbaf3af8 R14: 0000000000000000 R15: ffff8800baf3fc00
> [    0.733863] FS:  0000000000000000(0000) GS:ffff8800bf800000(0000) knlGS:0000000000000000
> [    0.735106] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [    0.735964] CR2: 0000000000000018 CR3: 000000003b219000 CR4: 00000000000006f0
> [    0.737021] Stack:
> [    0.737342]  ffff8800bbf33998 0000000000000246 ffff8800bbaf3b18 ffff8800bbaf3b00
> [    0.738602]  0000100000000001 0000000000000000 ffff8800bbaf3b00 ffff8800baf3f800
> [    0.739807]  0000000300001000 ffff8800bbaf3b18 ffff8800bbf339e8 ffff8800baf3fc00
> [    0.740993] Call Trace:
> [    0.741393]  [<ffffffff8d5efedd>] drm_setup_crtcs+0x3bd/0xb50
> [    0.742252]  [<ffffffff8d0edaa1>] ? mark_held_locks+0x71/0x90
> [    0.743176]  [<ffffffff8db0db6b>] ? __mutex_unlock_slowpath+0xeb/0x1c0
> [    0.744138]  [<ffffffff8d5f08c1>] drm_fb_helper_initial_config+0x81/0x3c0
> [    0.745166]  [<ffffffff8d6110b4>] ? drm_modeset_unlock_all+0x54/0x80
> [    0.746136]  [<ffffffff8d624fe0>] cirrus_fbdev_init+0xa0/0xb0
> [    0.747033]  [<ffffffff8d6245fb>] cirrus_modeset_init+0x18b/0x1e0
> .. snip snip ..
> [    0.771023] Code: e8 ba e1 ff ff 48 8b 55 b8 48 83 f8 01 83 5d c4 ff 48 8b 7d b8 48 8b 82 98 02 00 00 49 8b 57 08 48 8b 40 10 48 8b 92 00 0a 00 00 <48> 83 7a 18 00 74 09 48 85 c0 0f 84 53 01 00 00 ff d0 49 89 c3

This decodes to

   0: e8 ba e1 ff ff       callq  ...
   5: 48 8b 55 b8           mov    -0x48(%rbp),%rdx
   9: 48 83 f8 01           cmp    $0x1,%rax
   d: 83 5d c4 ff           sbbl   $0xffffffff,-0x3c(%rbp)
  11: 48 8b 7d b8           mov    -0x48(%rbp),%rdi
  15: 48 8b 82 98 02 00 00 mov    0x298(%rdx),%rax
  1c: 49 8b 57 08           mov    0x8(%r15),%rdx
  20: 48 8b 40 10           mov    0x10(%rax),%rax
  24: 48 8b 92 00 0a 00 00 mov    0xa00(%rdx),%rdx
  2b:* 48 83 7a 18 00       cmpq   $0x0,0x18(%rdx) <-- trapping instruction
  30: 74 09                 je     0x3b
  32: 48 85 c0             test   %rax,%rax
  35: 0f 84 53 01 00 00     je     0x18e
  3b: ff d0                 callq  *%rax
  3d: 49 89 c3             mov    %rax,%r11


and trying to find matching code I think the oops is from this:

        if (fb_helper->dev->mode_config.funcs->atomic_commit &&
            !connector_funcs->best_encoder)
                encoder = drm_atomic_helper_best_encoder(connector);
        else
                encoder = connector_funcs->best_encoder(connector);

in particular, the trapping instruction is the load of "atomic_commit".

(The "callq *%rax" seems to be the "connector_funcs->best_encoder()" call)

So I *think* we have "fb_helper->dev->mode_config.funcs" being NULL.

But I might have gotten the code matching wrong. I don't have the same
compiler as Eric, so even when using his config my code generation
doesn't really match. But there is only one indirect call in that
function, which is that ->best_encoder() call, so it does seem to
match up.

Adding Boris Brezillon and Daniel Vetter to the cc, since assuming I'm
right, the main suspect is commit c61b93fe51b1 ("drm/atomic: Fix
remaining places where !funcs->best_encoder is valid").

Boris? Daniel?

              Linus