Message-ID: <20191107082944.GR29418@shao2-debian>
Date:   Thu, 7 Nov 2019 16:29:44 +0800
From:   kernel test robot <lkp@...el.com>
To:     Rob Clark <robdclark@...il.com>
Cc:     dri-devel@...ts.freedesktop.org, Sean Paul <seanpaul@...omium.org>,
        Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
        Rob Clark <robdclark@...omium.org>,
        Maxime Ripard <mripard@...nel.org>,
        Sean Paul <sean@...rly.run>, David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        open list <linux-kernel@...r.kernel.org>, lkp@...ts.01.org
Subject: [drm/atomic] 1c3cd2f4f9: BUG:kernel_NULL_pointer_dereference,address

FYI, we noticed the following commit (built with gcc-7):

commit: 1c3cd2f4f92e5ecb1e40fb9c955cc19a86ce9fd8 ("[PATCH 2/2 v2] drm/atomic: clear new_state pointers at hw_done")
url: https://github.com/0day-ci/linux/commits/Rob-Clark/drm-atomic-fix-self-refresh-helpers-crtc-state-dereference/20191105-025754


in testcase: blktests
with following parameters:

	disk: 1SSD
	test: nvme-005



on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 8G

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):


+--------------------------------------------------------+------------+------------+
|                                                        | e5ff3aa0d4 | 1c3cd2f4f9 |
+--------------------------------------------------------+------------+------------+
| boot_successes                                         | 4          | 0          |
| boot_failures                                          | 0          | 10         |
| BUG:kernel_NULL_pointer_dereference,address            | 0          | 10         |
| Oops:#[##]                                             | 0          | 10         |
| RIP:drm_atomic_helper_wait_for_vblanks[drm_kms_helper] | 0          | 10         |
| Kernel_panic-not_syncing:Fatal_exception               | 0          | 10         |
+--------------------------------------------------------+------------+------------+


If you fix the issue, kindly add following tag
Reported-by: kernel test robot <lkp@...el.com>


[   12.117517] BUG: kernel NULL pointer dereference, address: 0000000000000009
[   12.117520] #PF: supervisor read access in kernel mode
[   12.117521] #PF: error_code(0x0000) - not-present page
[   12.117522] PGD 0 P4D 0 
[   12.117526] Oops: 0000 [#1] SMP PTI
[   12.117529] CPU: 0 PID: 317 Comm: systemd-udevd Not tainted 5.4.0-rc6-00002-g1c3cd2f4f92e5 #1
[   12.117531] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[   12.117549] RIP: 0010:drm_atomic_helper_wait_for_vblanks+0x6d/0x290 [drm_kms_helper]
[   12.117552] Code: bd 01 00 00 00 49 63 c7 48 8d 1c c5 00 00 00 00 48 29 c3 49 8b 46 20 48 c1 e3 03 48 01 d8 4c 8b 20 4d 85 e4 74 39 48 8b 40 18 <80> 78 09 00 74 2f 4c 89 e7 e8 b5 77 ef ff 85 c0 75 1f 41 8b 8c 24
[   12.117553] RSP: 0018:ffffa483403bb6e0 EFLAGS: 00010286
[   12.117555] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff923b0c8cd000
[   12.117556] RDX: ffff923b0c8cd000 RSI: ffff923b0b5c2280 RDI: ffff923b0c8cd000
[   12.117557] RBP: 0000000000000000 R08: ffff923b0e7ebb68 R09: 0000000000000000
[   12.117558] R10: 0000000000000020 R11: 0000000000000020 R12: ffff923a4f39e050
[   12.117559] R13: 0000000000000001 R14: ffff923b0b5c2280 R15: 0000000000000000
[   12.117561] FS:  00007f90ec25f8c0(0000) GS:ffff923b7fc00000(0000) knlGS:0000000000000000
[   12.117562] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   12.117563] CR2: 0000000000000009 CR3: 000000010f386000 CR4: 00000000000406f0
[   12.117567] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   12.117568] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   12.117569] Call Trace:
[   12.117580]  ? complete_all+0x31/0x40
[   12.117589]  drm_atomic_helper_commit_tail+0x52/0x60 [drm_kms_helper]
[   12.117598]  commit_tail+0xf0/0x100 [drm_kms_helper]
[   12.117605]  drm_atomic_helper_commit+0xfc/0x110 [drm_kms_helper]
[   12.117636]  drm_client_modeset_commit_atomic+0x1d2/0x1f0 [drm]
[   12.117652]  drm_client_modeset_commit_force+0x55/0x170 [drm]
[   12.117660]  drm_fb_helper_restore_fbdev_mode_unlocked+0x45/0x90 [drm_kms_helper]
[   12.117668]  drm_fb_helper_set_par+0x29/0x50 [drm_kms_helper]
[   12.117677]  fbcon_init+0x37a/0x610
[   12.117693]  visual_init+0xce/0x130
[   12.117697]  do_bind_con_driver+0x205/0x410
[   12.117700]  do_take_over_console+0x76/0x1a0
[   12.117704]  do_fbcon_takeover+0x58/0xb0
[   12.117707]  register_framebuffer+0x224/0x330
[   12.117715]  __drm_fb_helper_initial_config_and_unlock+0x2f9/0x520 [drm_kms_helper]
[   12.117723]  drm_fbdev_client_hotplug+0xd8/0x1a0 [drm_kms_helper]
[   12.117729]  drm_fbdev_generic_setup+0x9b/0x110 [drm_kms_helper]
[   12.117736]  bochs_pci_probe+0x12d/0x150 [bochs_drm]
[   12.117743]  local_pci_probe+0x42/0x90
[   12.117748]  ? _cond_resched+0x19/0x30
[   12.117751]  pci_device_probe+0x10b/0x1c0
[   12.117757]  really_probe+0xef/0x420
[   12.117759]  driver_probe_device+0x110/0x120
[   12.117762]  device_driver_attach+0x4f/0x60
[   12.117764]  __driver_attach+0x9a/0x140
[   12.117765]  ? device_driver_attach+0x60/0x60
[   12.117770]  bus_for_each_dev+0x76/0xc0
[   12.117775]  ? klist_add_tail+0x3b/0x70
[   12.117776]  bus_add_driver+0x144/0x220
[   12.117779]  ? 0xffffffffc036e000
[   12.117780]  driver_register+0x5b/0xf0
[   12.117782]  ? 0xffffffffc036e000
[   12.117788]  do_one_initcall+0x46/0x214
[   12.117793]  ? free_unref_page_commit+0x9f/0x120
[   12.117795]  ? _cond_resched+0x19/0x30
[   12.117799]  ? kmem_cache_alloc_trace+0x3b/0x230
[   12.117802]  do_init_module+0x5b/0x223
[   12.117807]  load_module+0x1b8f/0x2010
[   12.117813]  ? ima_post_read_file+0xe2/0x120
[   12.117817]  ? __do_sys_finit_module+0xe9/0x110
[   12.117819]  __do_sys_finit_module+0xe9/0x110
[   12.117823]  do_syscall_64+0x5b/0x1d0
[   12.117829]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   12.117832] RIP: 0033:0x7f90ec9d9f59
[   12.117834] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 07 6f 0c 00 f7 d8 64 89 01 48
[   12.117835] RSP: 002b:00007fff4d2c2e08 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[   12.117837] RAX: ffffffffffffffda RBX: 000055f75e20df60 RCX: 00007f90ec9d9f59
[   12.117838] RDX: 0000000000000000 RSI: 00007f90ecd0d265 RDI: 0000000000000016
[   12.117839] RBP: 00007f90ecd0d265 R08: 0000000000000000 R09: 0000000000000000
[   12.117840] R10: 0000000000000016 R11: 0000000000000246 R12: 0000000000000000
[   12.117841] R13: 000055f75e1ffa10 R14: 0000000000020000 R15: 000055f75cfddcbc
[   12.117842] Modules linked in: crc32_pclmul(+) crc32c_intel sd_mod sg ghash_clmulni_intel ppdev bochs_drm(+) snd_pcm drm_vram_helper snd_timer ata_piix aesni_intel ttm snd drm_kms_helper crypto_simd soundcore syscopyarea sysfillrect sysimgblt libata cryptd fb_sys_fops glue_helper drm pcspkr joydev serio_raw virtio_scsi parport_pc i2c_piix4 floppy parport ip_tables
[   12.117861] CR2: 0000000000000009
[   12.117866] ---[ end trace b448645025d202ae ]---


To reproduce:

        # build kernel
	cd linux
	cp config-5.4.0-rc6-00002-g1c3cd2f4f92e5 .config
	make HOSTCC=gcc-7 CC=gcc-7 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage

        git clone https://github.com/intel/lkp-tests.git
        cd lkp-tests
        bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email



Thanks,
lkp


View attachment "config-5.4.0-rc6-00002-g1c3cd2f4f92e5" of type "text/plain" (200562 bytes)

View attachment "job-script" of type "text/plain" (5337 bytes)

Download attachment "dmesg.xz" of type "application/x-xz" (15664 bytes)

Powered by blists - more mailing lists