linux-kernel - [regression] opening and closing /dev/dri/card0 in a QEMU KVM instance will shutdown system

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1ff5b407-ff81-40ef-8aa3-9f155491f497@leemhuis.info>
Date: Wed, 24 Jul 2024 17:42:56 +0200
From: "Linux regression tracking (Thorsten Leemhuis)"
 <regressions@...mhuis.info>
To: Thomas Zimmermann <tzimmermann@...e.de>,
 Javier Martinez Canillas <javierm@...hat.com>
Cc: ML dri-devel <dri-devel@...ts.freedesktop.org>,
 Colin Ian King <colin.i.king@...il.com>,
 Linux kernel regressions list <regressions@...ts.linux.dev>,
 LKML <linux-kernel@...r.kernel.org>,
 Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
 Maxime Ripard <mripard@...nel.org>, David Airlie <airlied@...il.com>,
 Daniel Vetter <daniel@...ll.ch>
Subject: [regression] opening and closing /dev/dri/card0 in a QEMU KVM
 instance will shutdown system

Hi, Thorsten here, the Linux kernel's regression tracker.

I noticed a report about a regression in bugzilla.kernel.org that
appears to be related to the simpledrm driver. As many (most?) kernel
developers don't keep an eye on the bug tracker, I decided to write this
mail. To quote from https://bugzilla.kernel.org/show_bug.cgi?id=219007 :

>  Colin Ian King 2024-07-05 16:05:27 UTC
> 
> The following code when run as root on a Debian sid amd64 server
> running in virt-manager (KVM QEMU) will shut the system down with
> 6.10.0-rc6.  The fork() is required to cause racing on the open/close on
> /dev/dri/card0
> 
> #include <fcntl.h>
> #include <unistd.h>
> 
> int main(void)
> {
> 	 pid_t pid = fork();
> 
> 	 while (1) {
> 	 	int fd;
> 
> 	 	fd = openat(AT_FDCWD, "/dev/dri/card0", O_WRONLY|O_NONBLOCK|O_SYNC);
> 	 	close(fd);
> 	 }
> }
> 
> This was originally found using: while true; do sudo ./stress-ng
> --dev 4 --dev-file /dev/dri/card0 -t 5; done and narrowed down to the
> above reproducer. (cf:
> https://github.com/ColinIanKing/stress-ng/issues/407 )
> 
> This does not occur on pre 6.10 kernels, so it looks like a 6.10 regression.

See the ticket for more details, which also contains a dmesg from a boot
in the VM: https://bugzilla.kernel.org/attachment.cgi?id=306610

Ciao, Thorsten (wearing his 'the Linux kernel's regression tracker' hat)
--
Everything you wanna know about Linux kernel regression tracking:
https://linux-regtracking.leemhuis.info/about/#tldr
If I did something stupid, please tell me, as explained on that page.

P.S.: let me use this mail to also add the report to the list of tracked
regressions to ensure it's doesn't fall through the cracks:

#regzbot introduced: v6.9..v6.10
#regzbot title: drm: opening and closing /dev/dri/card0 in a QEMU KVM
instance will shutdown system
#regzbot from: Colin Ian King <colin.i.king@...il.com>
#regzbot duplicate: https://bugzilla.kernel.org/show_bug.cgi?id=219007
#regzbot ignore-activity