linux-kernel - Re: BUG: KASAN: use-after-free in enqueue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAMwc25o9wSPd4PgS56j7GApcFYE=ZY9LHpiFvtE6RVgdQKzBFA@mail.gmail.com>
Date:   Tue, 12 Oct 2021 11:48:24 +1000
From:   David Airlie <airlied@...hat.com>
To:     Kim Phillips <kim.phillips@....com>
Cc:     Ainux <ainux.wang@...il.com>,
        Thomas Zimmermann <tzimmermann@...e.de>,
        airlied <airlied@...ux.ie>, "Vetter, Daniel" <daniel@...ll.ch>,
        sterlingteng@...il.com, chenhuacai@...nel.org,
        dri-devel <dri-devel@...ts.freedesktop.org>,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: BUG: KASAN: use-after-free in enqueue_timer+0x4f/0x1e0

On Tue, Oct 12, 2021 at 2:07 AM Kim Phillips <kim.phillips@....com> wrote:
>
> Hi,
>
> On 10/5/21 1:10 PM, Kim Phillips wrote:
> > Hi, I occasionally see the below trace with Linus' master on an
> > AMD Milan system:
> >
> > [   25.657322] BUG: kernel NULL pointer dereference, address: 0000000000000000
> > [   25.665097] #PF: supervisor instruction fetch in kernel mode
> > [   25.671448] #PF: error_code(0x0010) - not-present page
> <snip>
> > That bisection led to this commit:
> >
> > commit aae74ff9caa8de9a45ae2e46068c417817392a26
> > Author: Ainux <ainux.wang@...il.com>
> > Date:   Wed May 26 19:15:15 2021 +0800
> >      drm/ast: Add detect function support
> <snip>
> > I confirmed that if I revert it from v5.15-rc4 (after reverting
> > its dependent 572994bf18ff "drm/ast: Zero is missing in detect
> > function"), the problem goes away.
> >
> > Full .config, dmesg attached.
> >
> > I can test any possible fixes...
>
>
> Ping - if no fixes are in the works, can the offending commit(s)
> be reverted?

tzimmermann?

Dave.