linux-kernel

Open Source and information security mailing list archives

Message-ID: <20160829055934.GD10980@phenom.ffwll.local>
Date:   Mon, 29 Aug 2016 07:59:35 +0200
From:   Daniel Vetter <daniel@...ll.ch>
To:     Dmitry Vyukov <dvyukov@...gle.com>
Cc:     airlied@...ux.ie, dri-devel@...ts.freedesktop.org,
        LKML <linux-kernel@...r.kernel.org>,
        Kostya Serebryany <kcc@...gle.com>,
        syzkaller <syzkaller@...glegroups.com>,
        Alexander Potapenko <glider@...gle.com>
Subject: Re: drm: WARNING in drm_irq_by_busid

On Sun, Aug 28, 2016 at 01:30:04PM +0200, Dmitry Vyukov wrote:
> Hello,
> 
> I've got the following WARNING while running syzkaller fuzzer:

This should be fixed in linux-next, can you pls confirm?

Also I'm somewhat suprised that syzkaller can't reproduce this reliably,
at least in the latest code the WARNING happens before anything
complicated (which would be hard to guess correctly for syzkaller) is
checked.
-Daniel

> 
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 16092 at drivers/gpu/drm/drm_pci.c:182
> drm_irq_by_busid+0x3c0/0x4a0
> Kernel panic - not syncing: panic_on_warn set ...
> CPU: 1 PID: 16092 Comm: syz-executor Not tainted 4.8.0-rc3+ #33
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>  ffffffff884b8280 ffff880032c07b00 ffffffff82d1b239 ffffffff01780000
>  fffffbfff1097050 ffffffff86e8eec0 ffff880032c07bd8 ffffffff873a2c00
>  dffffc0000000000 0000000000000009 ffff880032c07bc8 ffffffff816ab4e3
> Call Trace:
>  [<ffffffff81380adc>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:552
>  [<ffffffff83424280>] drm_irq_by_busid+0x3c0/0x4a0 drivers/gpu/drm/drm_pci.c:182
>  [<ffffffff83410a5c>] drm_ioctl+0x7bc/0xc60 drivers/gpu/drm/drm_ioctl.c:724
>  [<     inline     >] vfs_ioctl fs/ioctl.c:43
>  [<ffffffff8186f1fc>] do_vfs_ioctl+0x18c/0x1080 fs/ioctl.c:675
>  [<     inline     >] SYSC_ioctl fs/ioctl.c:690
>  [<ffffffff8187017f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:681
>  [<ffffffff86c25480>] entry_SYSCALL_64_fastpath+0x23/0xc1
> arch/x86/entry/entry_64.S:207
> 
> Unfortunately it's not reproducible. Probably fuzzer can't guess the
> right bus id (there is no simple way to extract correct bus id). But
> it happens regularly.
> 
> On commit 61c04572de404e52a655a36752e696bbcb483cf5 (Auh 25).
> _______________________________________________
> dri-devel mailing list
> dri-devel@...ts.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives