linux-kernel - drm: WARNING in drm_irq_by

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 28 Aug 2016 13:30:04 +0200
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     airlied@...ux.ie, dri-devel@...ts.freedesktop.org,
        LKML <linux-kernel@...r.kernel.org>
Cc:     syzkaller <syzkaller@...glegroups.com>,
        Kostya Serebryany <kcc@...gle.com>,
        Alexander Potapenko <glider@...gle.com>
Subject: drm: WARNING in drm_irq_by_busid

Hello,

I've got the following WARNING while running syzkaller fuzzer:

------------[ cut here ]------------
WARNING: CPU: 1 PID: 16092 at drivers/gpu/drm/drm_pci.c:182
drm_irq_by_busid+0x3c0/0x4a0
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 16092 Comm: syz-executor Not tainted 4.8.0-rc3+ #33
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 ffffffff884b8280 ffff880032c07b00 ffffffff82d1b239 ffffffff01780000
 fffffbfff1097050 ffffffff86e8eec0 ffff880032c07bd8 ffffffff873a2c00
 dffffc0000000000 0000000000000009 ffff880032c07bc8 ffffffff816ab4e3
Call Trace:
 [<ffffffff81380adc>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:552
 [<ffffffff83424280>] drm_irq_by_busid+0x3c0/0x4a0 drivers/gpu/drm/drm_pci.c:182
 [<ffffffff83410a5c>] drm_ioctl+0x7bc/0xc60 drivers/gpu/drm/drm_ioctl.c:724
 [<     inline     >] vfs_ioctl fs/ioctl.c:43
 [<ffffffff8186f1fc>] do_vfs_ioctl+0x18c/0x1080 fs/ioctl.c:675
 [<     inline     >] SYSC_ioctl fs/ioctl.c:690
 [<ffffffff8187017f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:681
 [<ffffffff86c25480>] entry_SYSCALL_64_fastpath+0x23/0xc1
arch/x86/entry/entry_64.S:207

Unfortunately it's not reproducible. Probably fuzzer can't guess the
right bus id (there is no simple way to extract correct bus id). But
it happens regularly.

On commit 61c04572de404e52a655a36752e696bbcb483cf5 (Auh 25).