linux-kernel - Re: [REGRESSION] BUG: KFENCE: memory corruption in drm_gem_put

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4e6f1351-b318-48d8-bdc0-1c826ef0ac7a@suse.de>
Date:   Thu, 5 Oct 2023 09:42:50 +0200
From:   Thomas Zimmermann <tzimmermann@...e.de>
To:     Oleksandr Natalenko <oleksandr@...alenko.name>,
        linux-kernel@...r.kernel.org
Cc:     Linux Regressions <regressions@...ts.linux.dev>,
        Maxime Ripard <mripard@...nel.org>,
        Christian König <christian.koenig@....com>,
        linaro-mm-sig@...ts.linaro.org, dri-devel@...ts.freedesktop.org,
        Sumit Semwal <sumit.semwal@...aro.org>,
        linux-media@...r.kernel.org
Subject: Re: [REGRESSION] BUG: KFENCE: memory corruption in
 drm_gem_put_pages+0x186/0x250

Hi

Am 01.10.23 um 18:32 schrieb Oleksandr Natalenko:
> Hello.
> 
> I've got a VM from a cloud provider, and since v6.5 I observe the following kfence splat in dmesg during boot:
> 
> ```
> BUG: KFENCE: memory corruption in drm_gem_put_pages+0x186/0x250
> 
> Corrupted memory at 0x00000000e173a294 [ ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ] (in kfence-#108):
>   drm_gem_put_pages+0x186/0x250
>   drm_gem_shmem_put_pages_locked+0x43/0xc0
>   drm_gem_shmem_object_vunmap+0x83/0xe0
>   drm_gem_vunmap_unlocked+0x46/0xb0
>   drm_fbdev_generic_helper_fb_dirty+0x1dc/0x310
>   drm_fb_helper_damage_work+0x96/0x170
>   process_one_work+0x254/0x470
>   worker_thread+0x55/0x4f0
>   kthread+0xe8/0x120
>   ret_from_fork+0x34/0x50
>   ret_from_fork_asm+0x1b/0x30
> 
> kfence-#108: 0x00000000cda343af-0x00000000aec2c095, size=3072, cache=kmalloc-4k
> 
> allocated by task 51 on cpu 0 at 14.668667s:
>   drm_gem_get_pages+0x94/0x2b0
>   drm_gem_shmem_get_pages+0x5d/0x110
>   drm_gem_shmem_object_vmap+0xc4/0x1e0
>   drm_gem_vmap_unlocked+0x3c/0x70
>   drm_client_buffer_vmap+0x23/0x50
>   drm_fbdev_generic_helper_fb_dirty+0xae/0x310
>   drm_fb_helper_damage_work+0x96/0x170
>   process_one_work+0x254/0x470
>   worker_thread+0x55/0x4f0
>   kthread+0xe8/0x120
>   ret_from_fork+0x34/0x50
>   ret_from_fork_asm+0x1b/0x30
> 
> freed by task 51 on cpu 0 at 14.668697s:
>   drm_gem_put_pages+0x186/0x250
>   drm_gem_shmem_put_pages_locked+0x43/0xc0
>   drm_gem_shmem_object_vunmap+0x83/0xe0
>   drm_gem_vunmap_unlocked+0x46/0xb0
>   drm_fbdev_generic_helper_fb_dirty+0x1dc/0x310
>   drm_fb_helper_damage_work+0x96/0x170
>   process_one_work+0x254/0x470
>   worker_thread+0x55/0x4f0
>   kthread+0xe8/0x120
>   ret_from_fork+0x34/0x50
>   ret_from_fork_asm+0x1b/0x30
> 
> CPU: 0 PID: 51 Comm: kworker/0:2 Not tainted 6.5.0-pf4 #1 8b557a4173114d86eef7240f7a080080cfc4617e
> Hardware name: Red Hat KVM, BIOS 1.11.0-2.el7 04/01/2014
> Workqueue: events drm_fb_helper_damage_work
> ```
> 
> This repeats a couple of times and then stops.
> 
> Currently, I'm running v6.5.5. So far, there's no impact on how VM functions for me.
> 
> The VGA adapter is as follows: 00:02.0 VGA compatible controller: Cirrus Logic GD 5446

There's nothing special about the cirrus driver. Can you please provide 
the full output of 'lspci -v' ?

Would you be able to bisect this bug?

Best regards
Thomas

> 
> Please check.
> 
> Thanks.
> 

-- 
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (841 bytes)