| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 7 Nov 2019 16:29:44 +0800
From: kernel test robot <lkp@...el.com>
To: Rob Clark <robdclark@...il.com>
Cc: dri-devel@...ts.freedesktop.org, Sean Paul <seanpaul@...omium.org>,
Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
Rob Clark <robdclark@...omium.org>,
Maxime Ripard <mripard@...nel.org>,
Sean Paul <sean@...rly.run>, David Airlie <airlied@...ux.ie>,
Daniel Vetter <daniel@...ll.ch>,
open list <linux-kernel@...r.kernel.org>, lkp@...ts.01.org
Subject: [drm/atomic] 1c3cd2f4f9: BUG:kernel_NULL_pointer_dereference,address
FYI, we noticed the following commit (built with gcc-7):
commit: 1c3cd2f4f92e5ecb1e40fb9c955cc19a86ce9fd8 ("[PATCH 2/2 v2] drm/atomic: clear new_state pointers at hw_done")
url: https://github.com/0day-ci/linux/commits/Rob-Clark/drm-atomic-fix-self-refresh-helpers-crtc-state-dereference/20191105-025754
in testcase: blktests
with following parameters:
disk: 1SSD
test: nvme-005
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 8G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+--------------------------------------------------------+------------+------------+
| | e5ff3aa0d4 | 1c3cd2f4f9 |
+--------------------------------------------------------+------------+------------+
| boot_successes | 4 | 0 |
| boot_failures | 0 | 10 |
| BUG:kernel_NULL_pointer_dereference,address | 0 | 10 |
| Oops:#[##] | 0 | 10 |
| RIP:drm_atomic_helper_wait_for_vblanks[drm_kms_helper] | 0 | 10 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 10 |
+--------------------------------------------------------+------------+------------+
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <lkp@...el.com>
[ 12.117517] BUG: kernel NULL pointer dereference, address: 0000000000000009
[ 12.117520] #PF: supervisor read access in kernel mode
[ 12.117521] #PF: error_code(0x0000) - not-present page
[ 12.117522] PGD 0 P4D 0
[ 12.117526] Oops: 0000 [#1] SMP PTI
[ 12.117529] CPU: 0 PID: 317 Comm: systemd-udevd Not tainted 5.4.0-rc6-00002-g1c3cd2f4f92e5 #1
[ 12.117531] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[ 12.117549] RIP: 0010:drm_atomic_helper_wait_for_vblanks+0x6d/0x290 [drm_kms_helper]
[ 12.117552] Code: bd 01 00 00 00 49 63 c7 48 8d 1c c5 00 00 00 00 48 29 c3 49 8b 46 20 48 c1 e3 03 48 01 d8 4c 8b 20 4d 85 e4 74 39 48 8b 40 18 <80> 78 09 00 74 2f 4c 89 e7 e8 b5 77 ef ff 85 c0 75 1f 41 8b 8c 24
[ 12.117553] RSP: 0018:ffffa483403bb6e0 EFLAGS: 00010286
[ 12.117555] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff923b0c8cd000
[ 12.117556] RDX: ffff923b0c8cd000 RSI: ffff923b0b5c2280 RDI: ffff923b0c8cd000
[ 12.117557] RBP: 0000000000000000 R08: ffff923b0e7ebb68 R09: 0000000000000000
[ 12.117558] R10: 0000000000000020 R11: 0000000000000020 R12: ffff923a4f39e050
[ 12.117559] R13: 0000000000000001 R14: ffff923b0b5c2280 R15: 0000000000000000
[ 12.117561] FS: 00007f90ec25f8c0(0000) GS:ffff923b7fc00000(0000) knlGS:0000000000000000
[ 12.117562] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 12.117563] CR2: 0000000000000009 CR3: 000000010f386000 CR4: 00000000000406f0
[ 12.117567] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 12.117568] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 12.117569] Call Trace:
[ 12.117580] ? complete_all+0x31/0x40
[ 12.117589] drm_atomic_helper_commit_tail+0x52/0x60 [drm_kms_helper]
[ 12.117598] commit_tail+0xf0/0x100 [drm_kms_helper]
[ 12.117605] drm_atomic_helper_commit+0xfc/0x110 [drm_kms_helper]
[ 12.117636] drm_client_modeset_commit_atomic+0x1d2/0x1f0 [drm]
[ 12.117652] drm_client_modeset_commit_force+0x55/0x170 [drm]
[ 12.117660] drm_fb_helper_restore_fbdev_mode_unlocked+0x45/0x90 [drm_kms_helper]
[ 12.117668] drm_fb_helper_set_par+0x29/0x50 [drm_kms_helper]
[ 12.117677] fbcon_init+0x37a/0x610
[ 12.117693] visual_init+0xce/0x130
[ 12.117697] do_bind_con_driver+0x205/0x410
[ 12.117700] do_take_over_console+0x76/0x1a0
[ 12.117704] do_fbcon_takeover+0x58/0xb0
[ 12.117707] register_framebuffer+0x224/0x330
[ 12.117715] __drm_fb_helper_initial_config_and_unlock+0x2f9/0x520 [drm_kms_helper]
[ 12.117723] drm_fbdev_client_hotplug+0xd8/0x1a0 [drm_kms_helper]
[ 12.117729] drm_fbdev_generic_setup+0x9b/0x110 [drm_kms_helper]
[ 12.117736] bochs_pci_probe+0x12d/0x150 [bochs_drm]
[ 12.117743] local_pci_probe+0x42/0x90
[ 12.117748] ? _cond_resched+0x19/0x30
[ 12.117751] pci_device_probe+0x10b/0x1c0
[ 12.117757] really_probe+0xef/0x420
[ 12.117759] driver_probe_device+0x110/0x120
[ 12.117762] device_driver_attach+0x4f/0x60
[ 12.117764] __driver_attach+0x9a/0x140
[ 12.117765] ? device_driver_attach+0x60/0x60
[ 12.117770] bus_for_each_dev+0x76/0xc0
[ 12.117775] ? klist_add_tail+0x3b/0x70
[ 12.117776] bus_add_driver+0x144/0x220
[ 12.117779] ? 0xffffffffc036e000
[ 12.117780] driver_register+0x5b/0xf0
[ 12.117782] ? 0xffffffffc036e000
[ 12.117788] do_one_initcall+0x46/0x214
[ 12.117793] ? free_unref_page_commit+0x9f/0x120
[ 12.117795] ? _cond_resched+0x19/0x30
[ 12.117799] ? kmem_cache_alloc_trace+0x3b/0x230
[ 12.117802] do_init_module+0x5b/0x223
[ 12.117807] load_module+0x1b8f/0x2010
[ 12.117813] ? ima_post_read_file+0xe2/0x120
[ 12.117817] ? __do_sys_finit_module+0xe9/0x110
[ 12.117819] __do_sys_finit_module+0xe9/0x110
[ 12.117823] do_syscall_64+0x5b/0x1d0
[ 12.117829] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 12.117832] RIP: 0033:0x7f90ec9d9f59
[ 12.117834] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 07 6f 0c 00 f7 d8 64 89 01 48
[ 12.117835] RSP: 002b:00007fff4d2c2e08 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[ 12.117837] RAX: ffffffffffffffda RBX: 000055f75e20df60 RCX: 00007f90ec9d9f59
[ 12.117838] RDX: 0000000000000000 RSI: 00007f90ecd0d265 RDI: 0000000000000016
[ 12.117839] RBP: 00007f90ecd0d265 R08: 0000000000000000 R09: 0000000000000000
[ 12.117840] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000000
[ 12.117841] R13: 000055f75e1ffa10 R14: 0000000000020000 R15: 000055f75cfddcbc
[ 12.117842] Modules linked in: crc32_pclmul(+) crc32c_intel sd_mod sg ghash_clmulni_intel ppdev bochs_drm(+) snd_pcm drm_vram_helper snd_timer ata_piix aesni_intel ttm snd drm_kms_helper crypto_simd soundcore syscopyarea sysfillrect sysimgblt libata cryptd fb_sys_fops glue_helper drm pcspkr joydev serio_raw virtio_scsi parport_pc i2c_piix4 floppy parport ip_tables
[ 12.117861] CR2: 0000000000000009
[ 12.117866] ---[ end trace b448645025d202ae ]---
To reproduce:
# build kernel
cd linux
cp config-5.4.0-rc6-00002-g1c3cd2f4f92e5 .config
make HOSTCC=gcc-7 CC=gcc-7 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email
Thanks,
lkp
View attachment "config-5.4.0-rc6-00002-g1c3cd2f4f92e5" of type "text/plain" (200562 bytes)
View attachment "job-script" of type "text/plain" (5337 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (15664 bytes)
Powered by blists - more mailing lists