| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <857A08C1-89B4-4F75-AB7C-C7FB5D9F6429@oracle.com>
Date: Sat, 23 Oct 2021 19:11:27 +0000
From: Chuck Lever III <chuck.lever@...cle.com>
To: Kim Phillips <kim.phillips@....com>
CC: Thomas Zimmermann <tzimmermann@...e.de>,
Ainux <ainux.wang@...il.com>, David Airlie <airlied@...hat.com>,
David Airlie <airlied@...ux.ie>,
Daniel Vetter <daniel@...ll.ch>,
"sterlingteng@...il.com" <sterlingteng@...il.com>,
"chenhuacai@...nel.org" <chenhuacai@...nel.org>,
Borislav Petkov <bp@...en8.de>, Borislav Petkov <bp@...e.de>,
Jon Grimm <jon.grimm@....com>,
dri-devel <dri-devel@...ts.freedesktop.org>,
linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] Revert "drm/ast: Add detect function support"
> On Oct 21, 2021, at 11:30 AM, Kim Phillips <kim.phillips@....com> wrote:
>
> This reverts commit aae74ff9caa8de9a45ae2e46068c417817392a26,
> since it prevents my AMD Milan system from booting, with:
>
> [ 27.189558] BUG: kernel NULL pointer dereference, address: 0000000000000000
> [ 27.197506] #PF: supervisor write access in kernel mode
> [ 27.203333] #PF: error_code(0x0002) - not-present page
> [ 27.209064] PGD 0 P4D 0
> [ 27.211885] Oops: 0002 [#1] PREEMPT SMP NOPTI
> [ 27.216744] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.15.0-rc6+ #15
> [ 27.223928] Hardware name: AMD Corporation ETHANOL_X/ETHANOL_X, BIOS RXM1006B 08/20/2021
> [ 27.232955] RIP: 0010:run_timer_softirq+0x38b/0x4a0
> [ 27.238397] Code: 4c 89 f7 e8 37 27 ac 00 49 c7 46 08 00 00 00 00 49 8b 04 24 48 85 c0 74 71 4d 8b 3c 24 4d 89 7e 08 66 90 49 8b 07 49 8b 57 08 <48> 89 02 48 85 c0 74 04 48 89 50 08 49 8b 77 18 41 f6 47 22 20 4c
> [ 27.259350] RSP: 0018:ffffc42d00003ee8 EFLAGS: 00010086
> [ 27.265176] RAX: dead000000000122 RBX: 0000000000000000 RCX: 0000000000000101
> [ 27.273134] RDX: 0000000000000000 RSI: 0000000000000087 RDI: 0000000000000001
> [ 27.281084] RBP: ffffc42d00003f70 R08: 0000000000000000 R09: 00000000000003eb
> [ 27.289043] R10: ffffa0860cb300d0 R11: ffffa0c44de290b0 R12: ffffc42d00003ef8
> [ 27.297002] R13: 00000000fffef200 R14: ffffa0c44de18dc0 R15: ffffa0867a882350
> [ 27.304961] FS: 0000000000000000(0000) GS:ffffa0c44de00000(0000) knlGS:0000000000000000
> [ 27.313988] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 27.320396] CR2: 0000000000000000 CR3: 000000014569c001 CR4: 0000000000770ef0
> [ 27.328346] PKRU: 55555554
> [ 27.331359] Call Trace:
> [ 27.334073] <IRQ>
> [ 27.336314] ? __queue_work+0x420/0x420
> [ 27.340589] ? lapic_next_event+0x21/0x30
> [ 27.345060] ? clockevents_program_event+0x8f/0xe0
> [ 27.350402] __do_softirq+0xfb/0x2db
> [ 27.354388] irq_exit_rcu+0x98/0xd0
> [ 27.358275] sysvec_apic_timer_interrupt+0xac/0xd0
> [ 27.363620] </IRQ>
> [ 27.365955] asm_sysvec_apic_timer_interrupt+0x12/0x20
> [ 27.371685] RIP: 0010:cpuidle_enter_state+0xcc/0x390
> [ 27.377292] Code: 3d 01 79 0a 50 e8 44 ed 77 ff 49 89 c6 0f 1f 44 00 00 31 ff e8 f5 f8 77 ff 80 7d d7 00 0f 85 e6 01 00 00 fb 66 0f 1f 44 00 00 <45> 85 ff 0f 88 17 01 00 00 49 63 c7 4c 2b 75 c8 48 8d 14 40 48 8d
> [ 27.398243] RSP: 0018:ffffffffb0e03dc8 EFLAGS: 00000246
> [ 27.404069] RAX: ffffa0c44de00000 RBX: 0000000000000001 RCX: 000000000000001f
> [ 27.412028] RDX: 0000000000000000 RSI: ffffffffb0bafc1f RDI: ffffffffb0bbdb81
> [ 27.419986] RBP: ffffffffb0e03e00 R08: 00000006549f8f3f R09: ffffffffb1065200
> [ 27.427935] R10: ffffa0c44de27ae4 R11: ffffa0c44de27ac4 R12: ffffa0c5634cb000
> [ 27.435894] R13: ffffffffb1065200 R14: 00000006549f8f3f R15: 0000000000000001
> [ 27.443854] ? cpuidle_enter_state+0xbb/0x390
> [ 27.448712] cpuidle_enter+0x2e/0x40
> [ 27.452695] call_cpuidle+0x23/0x40
> [ 27.456584] do_idle+0x1f0/0x270
> [ 27.460181] cpu_startup_entry+0x20/0x30
> [ 27.464553] rest_init+0xd4/0xe0
> [ 27.468149] arch_call_rest_init+0xe/0x1b
> [ 27.472619] start_kernel+0x6bc/0x6e2
> [ 27.476764] x86_64_start_reservations+0x24/0x26
> [ 27.481912] x86_64_start_kernel+0x75/0x79
> [ 27.486477] secondary_startup_64_no_verify+0xb0/0xbb
> [ 27.492111] Modules linked in: kvm_amd(+) kvm ipmi_si(+) ipmi_devintf rapl wmi_bmof ipmi_msghandler input_leds ccp k10temp mac_hid sch_fq_codel msr ip_tables x_tables autofs4 btrfs blake2b_generic zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear ast i2c_algo_bit drm_vram_helper drm_ttm_helper ttm drm_kms_helper crct10dif_pclmul crc32_pclmul ghash_clmulni_intel syscopyarea aesni_intel sysfillrect crypto_simd sysimgblt fb_sys_fops cryptd hid_generic cec nvme ahci usbhid drm e1000e nvme_core hid libahci i2c_piix4 wmi
> [ 27.551789] CR2: 0000000000000000
> [ 27.555482] ---[ end trace 897987dfe93dccc6 ]---
> [ 27.560630] RIP: 0010:run_timer_softirq+0x38b/0x4a0
> [ 27.566069] Code: 4c 89 f7 e8 37 27 ac 00 49 c7 46 08 00 00 00 00 49 8b 04 24 48 85 c0 74 71 4d 8b 3c 24 4d 89 7e 08 66 90 49 8b 07 49 8b 57 08 <48> 89 02 48 85 c0 74 04 48 89 50 08 49 8b 77 18 41 f6 47 22 20 4c
> [ 27.587021] RSP: 0018:ffffc42d00003ee8 EFLAGS: 00010086
> [ 27.592848] RAX: dead000000000122 RBX: 0000000000000000 RCX: 0000000000000101
> [ 27.600808] RDX: 0000000000000000 RSI: 0000000000000087 RDI: 0000000000000001
> [ 27.608765] RBP: ffffc42d00003f70 R08: 0000000000000000 R09: 00000000000003eb
> [ 27.616716] R10: ffffa0860cb300d0 R11: ffffa0c44de290b0 R12: ffffc42d00003ef8
> [ 27.624673] R13: 00000000fffef200 R14: ffffa0c44de18dc0 R15: ffffa0867a882350
> [ 27.632624] FS: 0000000000000000(0000) GS:ffffa0c44de00000(0000) knlGS:0000000000000000
> [ 27.641650] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 27.648159] CR2: 0000000000000000 CR3: 000000014569c001 CR4: 0000000000770ef0
> [ 27.656119] PKRU: 55555554
> [ 27.659133] Kernel panic - not syncing: Fatal exception in interrupt
> [ 29.030411] Shutting down cpus with NMI
> [ 29.034699] Kernel Offset: 0x2e600000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
> [ 29.046790] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
>
> Since unreliable, found by bisecting for KASAN's use-after-free in
> enqueue_timer+0x4f/0x1e0, where the timer callback is called.
Another one of my Supermicro Intel systems had some console-related
misbehavior this week. The console never reaches the login prompt,
but rather it stops at "fb0: switching to ast from EFI VGA" .
The system otherwise seems functional, but the console is not
responsive.
Applying Kim's patch restored expected behavior.
DMI: Supermicro Super Server/X12SPL-F, BIOS 1.1a 08/05/2021
Handle 0x0016, DMI type 41, 11 bytes
Onboard Device
Reference Designation: ASPEED Video AST2600
Type: Video
Status: Enabled
Type Instance: 1
Bus Address: 0000:06:00.0
> Reported-by: Kim Phillips <kim.phillips@....com>
> Signed-off-by: Kim Phillips <kim.phillips@....com>
> Fixes: aae74ff9caa8 ("drm/ast: Add detect function support")
> Link: https://lore.kernel.org/lkml/0f7871be-9ca6-5ae4-3a40-5db9a8fb2365@amd.com/
> Cc: Ainux <ainux.wang@...il.com>
> Cc: Thomas Zimmermann <tzimmermann@...e.de>
> Cc: David Airlie <airlied@...hat.com>
> Cc: David Airlie <airlied@...ux.ie>
> Cc: Daniel Vetter <daniel@...ll.ch>
> Cc: sterlingteng@...il.com
> Cc: chenhuacai@...nel.org
> Cc: Chuck Lever III <chuck.lever@...cle.com>
> Cc: Borislav Petkov <bp@...en8.de>
> Cc: Borislav Petkov <bp@...e.de>
> Cc: Jon Grimm <jon.grimm@....com>
> Cc: dri-devel <dri-devel@...ts.freedesktop.org>
> Cc: linux-kernel <linux-kernel@...r.kernel.org>
> ---
> drivers/gpu/drm/ast/ast_mode.c | 18 +-----------------
> 1 file changed, 1 insertion(+), 17 deletions(-)
>
> diff --git a/drivers/gpu/drm/ast/ast_mode.c b/drivers/gpu/drm/ast/ast_mode.c
> index 6bfaefa01818..1e30eaeb0e1b 100644
> --- a/drivers/gpu/drm/ast/ast_mode.c
> +++ b/drivers/gpu/drm/ast/ast_mode.c
> @@ -1300,18 +1300,6 @@ static enum drm_mode_status ast_mode_valid(struct drm_connector *connector,
> return flags;
> }
>
> -static enum drm_connector_status ast_connector_detect(struct drm_connector
> - *connector, bool force)
> -{
> - int r;
> -
> - r = ast_get_modes(connector);
> - if (r <= 0)
> - return connector_status_disconnected;
> -
> - return connector_status_connected;
> -}
> -
> static void ast_connector_destroy(struct drm_connector *connector)
> {
> struct ast_connector *ast_connector = to_ast_connector(connector);
> @@ -1327,7 +1315,6 @@ static const struct drm_connector_helper_funcs ast_connector_helper_funcs = {
>
> static const struct drm_connector_funcs ast_connector_funcs = {
> .reset = drm_atomic_helper_connector_reset,
> - .detect = ast_connector_detect,
> .fill_modes = drm_helper_probe_single_connector_modes,
> .destroy = ast_connector_destroy,
> .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,
> @@ -1355,8 +1342,7 @@ static int ast_connector_init(struct drm_device *dev)
> connector->interlace_allowed = 0;
> connector->doublescan_allowed = 0;
>
> - connector->polled = DRM_CONNECTOR_POLL_CONNECT |
> - DRM_CONNECTOR_POLL_DISCONNECT;
> + connector->polled = DRM_CONNECTOR_POLL_CONNECT;
>
> drm_connector_attach_encoder(connector, encoder);
>
> @@ -1425,8 +1411,6 @@ int ast_mode_config_init(struct ast_private *ast)
>
> drm_mode_config_reset(dev);
>
> - drm_kms_helper_poll_init(dev);
> -
> return 0;
> }
>
> --
> 2.32.0
>
--
Chuck Lever
Powered by blists - more mailing lists