| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20220520070237.GB12591@xsang-OptiPlex-9020>
Date: Fri, 20 May 2022 15:02:37 +0800
From: kernel test robot <oliver.sang@...el.com>
To: Christian König
<ckoenig.leichtzumerken@...il.com>
Cc: 0day robot <lkp@...el.com>,
Christian König <christian.koenig@....com>,
LKML <linux-kernel@...r.kernel.org>, lkp@...ts.01.org,
intel-gfx@...ts.freedesktop.org, matthew.william.auld@...il.com,
dri-devel@...ts.freedesktop.org
Subject: [drm/ttm] 47e8c5019b: BUG:kernel_NULL_pointer_dereference,address
Greeting,
FYI, we noticed the following commit (built with gcc-11):
commit: 47e8c5019b432cfa8f875fe068254b8d4e2dd3c6 ("[PATCH 10/11] drm/ttm: stop allocating dummy resources during BO creation")
url: https://github.com/intel-lab-lkp/linux/commits/Christian-K-nig/drm-radeon-switch-over-to-ttm_bo_init_reserved/20220519-185504
base: git://anongit.freedesktop.org/drm/drm-tip drm-tip
patch link: https://lore.kernel.org/intel-gfx/20220519095508.115203-11-christian.koenig@amd.com
in testcase: boot
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+---------------------------------------------+------------+------------+
| | abd7815e9a | 47e8c5019b |
+---------------------------------------------+------------+------------+
| boot_successes | 36 | 0 |
| boot_failures | 0 | 36 |
| BUG:kernel_NULL_pointer_dereference,address | 0 | 36 |
| Oops:#[##] | 0 | 36 |
| RIP:ttm_bo_move_memcpy[ttm] | 0 | 36 |
| Kernel_panic-not_syncing:Fatal_exception | 0 | 36 |
+---------------------------------------------+------------+------------+
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <oliver.sang@...el.com>
[ 9.741361][ T197] BUG: kernel NULL pointer dereference, address: 0000000000000010
[ 9.742532][ T197] #PF: supervisor read access in kernel mode
[ 9.743345][ T197] #PF: error_code(0x0000) - not-present page
[ 9.744148][ T197] PGD 0 P4D 0
[ 9.744608][ T197] Oops: 0000 [#1] SMP PTI
[ 9.745191][ T197] CPU: 0 PID: 197 Comm: systemd-udevd Not tainted 5.18.0-rc7-01546-g47e8c5019b43 #1
[ 9.746444][ T197] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014
[ 9.747818][ T197] RIP: 0010:ttm_bo_move_memcpy (include/drm/ttm/ttm_device.h:285 drivers/gpu/drm/ttm/ttm_bo_util.c:141) ttm
[ 9.748653][ T197] Code: 01 00 00 65 48 8b 04 25 28 00 00 00 48 89 44 24 50 31 c0 48 63 42 10 4d 8b bc c6 90 00 00 00 48 8b 87 58 01 00 00 48 89 04 24 <48> 63 40 10 49 8b 84 c6 90 00 00 00 48 89 44 24 08 4d 85 ed 74 16
All code
========
0: 01 00 add %eax,(%rax)
2: 00 65 48 add %ah,0x48(%rbp)
5: 8b 04 25 28 00 00 00 mov 0x28,%eax
c: 48 89 44 24 50 mov %rax,0x50(%rsp)
11: 31 c0 xor %eax,%eax
13: 48 63 42 10 movslq 0x10(%rdx),%rax
17: 4d 8b bc c6 90 00 00 mov 0x90(%r14,%rax,8),%r15
1e: 00
1f: 48 8b 87 58 01 00 00 mov 0x158(%rdi),%rax
26: 48 89 04 24 mov %rax,(%rsp)
2a:* 48 63 40 10 movslq 0x10(%rax),%rax <-- trapping instruction
2e: 49 8b 84 c6 90 00 00 mov 0x90(%r14,%rax,8),%rax
35: 00
36: 48 89 44 24 08 mov %rax,0x8(%rsp)
3b: 4d 85 ed test %r13,%r13
3e: 74 16 je 0x56
Code starting with the faulting instruction
===========================================
0: 48 63 40 10 movslq 0x10(%rax),%rax
4: 49 8b 84 c6 90 00 00 mov 0x90(%r14,%rax,8),%rax
b: 00
c: 48 89 44 24 08 mov %rax,0x8(%rsp)
11: 4d 85 ed test %r13,%r13
14: 74 16 je 0x2c
[ 9.751280][ T197] RSP: 0000:ffffa9e28060b880 EFLAGS: 00010246
[ 9.752060][ T197] RAX: 0000000000000000 RBX: ffff9781d1227010 RCX: ffff9781cb56aba0
[ 9.753116][ T197] RDX: ffff9781cb56aba0 RSI: ffffa9e28060b9e8 RDI: ffff978180874200
[ 9.754196][ T197] RBP: ffff978180874200 R08: ffffa9e28060b968 R09: ffff9781d2aa8000
[ 9.755274][ T197] R10: 00000000001003e8 R11: 0000000000000000 R12: ffff9781cb56aba0
[ 9.756329][ T197] R13: ffff9781d2e51780 R14: ffff9781d1227010 R15: ffff9781d1227028
[ 9.757385][ T197] FS: 00007f0da77c1d40(0000) GS:ffff9784afc00000(0000) knlGS:0000000000000000
[ 9.758553][ T197] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 9.759459][ T197] CR2: 0000000000000010 CR3: 000000042fd9a000 CR4: 00000000000406f0
[ 9.760463][ T197] Call Trace:
[ 9.760909][ T197] <TASK>
[ 9.761302][ T197] ? kvmalloc_node (mm/util.c:586)
[ 9.761951][ T197] ttm_bo_handle_move_mem (drivers/gpu/drm/ttm/ttm_bo.c:154) ttm
[ 9.762735][ T197] ttm_bo_validate (drivers/gpu/drm/ttm/ttm_bo.c:871 drivers/gpu/drm/ttm/ttm_bo.c:902) ttm
[ 9.763462][ T197] ? drm_vma_offset_add (include/drm/drm_mm.h:439 include/drm/drm_mm.h:462 drivers/gpu/drm/drm_vma_manager.c:209) drm
[ 9.764276][ T197] ttm_bo_init_validate (drivers/gpu/drm/ttm/ttm_bo.c:994) ttm
[ 9.765052][ T197] drm_gem_vram_create (drivers/gpu/drm/drm_gem_vram_helper.c:232) drm_vram_helper
[ 9.765932][ T197] ? bo_driver_evict_flags (drivers/gpu/drm/drm_gem_vram_helper.c:131) drm_vram_helper
[ 9.766866][ T197] drm_gem_vram_fill_create_dumb (drivers/gpu/drm/drm_gem_vram_helper.c:526) drm_vram_helper
[ 9.767857][ T197] drm_client_framebuffer_create (drivers/gpu/drm/drm_client.c:269 drivers/gpu/drm/drm_client.c:419) drm
[ 9.768773][ T197] drm_fb_helper_generic_probe (drivers/gpu/drm/drm_fb_helper.c:2375 (discriminator 4)) drm_kms_helper
[ 9.769762][ T197] drm_fb_helper_single_fb_probe (drivers/gpu/drm/drm_fb_helper.c:1706) drm_kms_helper
[ 9.770775][ T197] __drm_fb_helper_initial_config_and_unlock (drivers/gpu/drm/drm_fb_helper.c:1870) drm_kms_helper
[ 9.771940][ T197] drm_fbdev_client_hotplug (drivers/gpu/drm/drm_fb_helper.c:1964 drivers/gpu/drm/drm_fb_helper.c:1956 drivers/gpu/drm/drm_fb_helper.c:2478) drm_kms_helper
[ 9.772899][ T197] drm_fbdev_generic_setup (drivers/gpu/drm/drm_fb_helper.c:2565) drm_kms_helper
[ 9.773835][ T197] bochs_pci_probe (drivers/gpu/drm/tiny/bochs.c:667 drivers/gpu/drm/tiny/bochs.c:632) bochs
[ 9.774572][ T197] local_pci_probe (drivers/pci/pci-driver.c:323)
[ 9.777192][ T197] pci_call_probe (drivers/pci/pci-driver.c:391)
[ 9.777890][ T197] ? kernfs_create_link (fs/kernfs/symlink.c:48)
[ 9.778587][ T197] pci_device_probe (drivers/pci/pci-driver.c:460)
[ 9.779279][ T197] really_probe (drivers/base/dd.c:542 drivers/base/dd.c:621)
[ 9.779889][ T197] __driver_probe_device (drivers/base/dd.c:752)
[ 9.780598][ T197] driver_probe_device (drivers/base/dd.c:782)
[ 9.781283][ T197] __driver_attach (drivers/base/dd.c:1142)
[ 9.781924][ T197] ? __device_attach_driver (drivers/base/dd.c:1094)
[ 9.782704][ T197] ? __device_attach_driver (drivers/base/dd.c:1094)
[ 9.783436][ T197] bus_for_each_dev (drivers/base/bus.c:301)
[ 9.783998][ T197] bus_add_driver (drivers/base/bus.c:619)
[ 9.784631][ T197] driver_register (drivers/base/driver.c:171)
[ 9.785273][ T197] ? 0xffffffffc0532000
[ 9.785837][ T197] do_one_initcall (init/main.c:1298)
[ 9.786481][ T197] ? kmem_cache_alloc_trace (mm/slub.c:3219 mm/slub.c:3225 mm/slub.c:3256)
[ 9.787268][ T197] do_init_module (kernel/module.c:3731)
[ 9.787931][ T197] __do_sys_finit_module (kernel/module.c:4222)
[ 9.788650][ T197] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
[ 9.789258][ T197] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:115)
[ 9.790062][ T197] RIP: 0033:0x7f0da7fabf59
[ 9.790654][ T197] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 07 6f 0c 00 f7 d8 64 89 01 48
All code
========
0: 00 c3 add %al,%bl
2: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1)
9: 00 00 00
c: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
11: 48 89 f8 mov %rdi,%rax
14: 48 89 f7 mov %rsi,%rdi
17: 48 89 d6 mov %rdx,%rsi
1a: 48 89 ca mov %rcx,%rdx
1d: 4d 89 c2 mov %r8,%r10
20: 4d 89 c8 mov %r9,%r8
23: 4c 8b 4c 24 08 mov 0x8(%rsp),%r9
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 01 jae 0x33
32: c3 retq
33: 48 8b 0d 07 6f 0c 00 mov 0xc6f07(%rip),%rcx # 0xc6f41
3a: f7 d8 neg %eax
3c: 64 89 01 mov %eax,%fs:(%rcx)
3f: 48 rex.W
Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 01 jae 0x9
8: c3 retq
9: 48 8b 0d 07 6f 0c 00 mov 0xc6f07(%rip),%rcx # 0xc6f17
10: f7 d8 neg %eax
12: 64 89 01 mov %eax,%fs:(%rcx)
15: 48 rex.W
To reproduce:
# build kernel
cd linux
cp config-5.18.0-rc7-01546-g47e8c5019b43 .config
make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage modules
make HOSTCC=gcc-11 CC=gcc-11 ARCH=x86_64 INSTALL_MOD_PATH=<mod-install-dir> modules_install
cd <mod-install-dir>
find lib/ | cpio -o -H newc --quiet | gzip > modules.cgz
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> -m modules.cgz job-script # job-script is attached in this email
# if come across any failure that blocks the test,
# please remove ~/.lkp and /lkp dir to run from a clean state.
--
0-DAY CI Kernel Test Service
https://01.org/lkp
View attachment "config-5.18.0-rc7-01546-g47e8c5019b43" of type "text/plain" (162826 bytes)
View attachment "job-script" of type "text/plain" (4788 bytes)
Download attachment "dmesg.xz" of type "application/x-xz" (14448 bytes)
Powered by blists - more mailing lists