linux-kernel - regression/bisected/6.8 commit dfc03588cf8ce2af8ef810cd226dc98ee4fbac38 leads to slab-out-of-bounds in dm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 8 Mar 2024 01:31:30 +0500
From: Mikhail Gavrilov <mikhail.v.gavrilov@...il.com>
To: alex.hung@....com, "Wheeler, Daniel" <daniel.wheeler@....com>, 
	Harry Wentland <harry.wentland@....com>, "Deucher, Alexander" <alexander.deucher@....com>, 
	amd-gfx list <amd-gfx@...ts.freedesktop.org>, 
	Linux List Kernel Mailing <linux-kernel@...r.kernel.org>
Subject: regression/bisected/6.8 commit dfc03588cf8ce2af8ef810cd226dc98ee4fbac38
 leads to slab-out-of-bounds in dm_resume+0x2068/0x24f0 [amdgpu]

Hi,
I already fill the bug report about slab-out-of-bounds in
dm_resume+0x208c/0x2600. It usually happens when the system resumes
from a suspended state.
But it was unclear if it was regression or not.
Today I decided to bisect it.
And first bad commit is:
commit dfc03588cf8ce2af8ef810cd226dc98ee4fbac38
Author: Alex Hung <alex.hung@....com>
Date:   Fri Dec 1 06:25:24 2023 -0700

    drm/amd/display: Initialize writeback connector

    [WHAT]
    Create a drm_writeback_connector when connector signal equals
    SIGNAL_TYPE_VIRTUAL.

    Tested-by: Daniel Wheeler <daniel.wheeler@....com>
    Reviewed-by: Harry Wentland <harry.wentland@....com>
    Signed-off-by: Alex Hung <alex.hung@....com>
    Signed-off-by: Alex Deucher <alexander.deucher@....com>

 drivers/gpu/drm/amd/display/amdgpu_dm/Makefile     |   3 +-
 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c  |  20 +-
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_wb.c   | 209 +++++++++++++++++++++
 .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_wb.h   |  35 ++++
 4 files changed, 265 insertions(+), 2 deletions(-)

So this is definitely a regression in the 6.8 release cycle.
But unfortunately I can't easily revert the commit for double checking.

Bisect log and all kernel logs from each step I attached here.
Also attached build config.

Alex, can you look into it?

[1] https://gitlab.freedesktop.org/drm/amd/-/issues/3199

-- 
Best Regards,
Mike Gavrilov.

Download attachment "kernel-logs.zip" of type "application/zip" (739082 bytes)

Download attachment "git-bisect-log-slab-out-of-bounds-in-dm_resume+0x2068.zip" of type "application/zip" (1439 bytes)

Download attachment ".config.zip" of type "application/zip" (65123 bytes)