* general protection fault in drm_atomic_set_crtc_for_connector
@ 2020-11-20 7:25 ` syzbot
0 siblings, 0 replies; 3+ messages in thread
From: syzbot @ 2020-11-20 7:25 UTC (permalink / raw)
To: airlied, christian.koenig, daniel, dri-devel, linaro-mm-sig,
linux-kernel, linux-media, maarten.lankhorst, mripard,
sumit.semwal, syzkaller-bugs, tzimmermann
Hello,
syzbot found the following issue on:
HEAD commit: 03430750 Add linux-next specific files for 20201116
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=123c946a500000
kernel config: https://syzkaller.appspot.com/x/.config?x=a1c4c3f27041fdb8
dashboard link: https://syzkaller.appspot.com/bug?extid=1aec08e752387f55c449
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15213981500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16590416500000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1aec08e752387f55c449@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 PID: 8503 Comm: syz-executor619 Not tainted 5.10.0-rc3-next-20201116-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:drm_atomic_set_crtc_for_connector+0x426/0x5f0 drivers/gpu/drm/drm_atomic_uapi.c:342
Code: 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e a6 00 00 00 48 b8 00 00 00 00 00 fc ff df 41 8b 4d 28 <80> 38 00 0f 85 83 01 00 00 48 8b 2c 25 00 00 00 00 48 b8 00 00 00
RSP: 0018:ffffc900018bf938 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff8880116b0100 RCX: 0000000000000022
RDX: 1ffff11003019a66 RSI: ffffffff84302d10 RDI: ffff8880180cd330
RBP: 0000000000000000 R08: ffff888018051900 R09: ffff8880180cd343
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88801a024800
R13: ffff8880180cd308 R14: ffff8880116b0108 R15: ffff88801cd1b700
FS: 0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006cf0a0 CR3: 000000000b08e000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
update_output_state drivers/gpu/drm/drm_atomic.c:1454 [inline]
__drm_atomic_helper_set_config+0x72a/0xe80 drivers/gpu/drm/drm_atomic.c:1568
drm_client_modeset_commit_atomic+0x527/0x7c0 drivers/gpu/drm/drm_client_modeset.c:1023
drm_client_modeset_commit_locked+0x145/0x580 drivers/gpu/drm/drm_client_modeset.c:1145
drm_client_modeset_commit+0x4d/0x80 drivers/gpu/drm/drm_client_modeset.c:1171
__drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:252 [inline]
__drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:231 [inline]
drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:279 [inline]
drm_fb_helper_lastclose drivers/gpu/drm/drm_fb_helper.c:1942 [inline]
drm_fbdev_client_restore+0xe3/0x1a0 drivers/gpu/drm/drm_fb_helper.c:2334
drm_client_dev_restore+0x17f/0x270 drivers/gpu/drm/drm_client.c:226
drm_lastclose drivers/gpu/drm/drm_file.c:468 [inline]
drm_release+0x441/0x530 drivers/gpu/drm/drm_file.c:499
__fput+0x283/0x920 fs/file_table.c:280
task_work_run+0xdd/0x190 kernel/task_work.c:140
exit_task_work include/linux/task_work.h:30 [inline]
do_exit+0xb9b/0x29f0 kernel/exit.c:823
do_group_exit+0x125/0x310 kernel/exit.c:920
__do_sys_exit_group kernel/exit.c:931 [inline]
__se_sys_exit_group kernel/exit.c:929 [inline]
__x64_sys_exit_group+0x3a/0x50 kernel/exit.c:929
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x443b18
Code: Unable to access opcode bytes at RIP 0x443aee.
RSP: 002b:00007fff6ec2d738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443b18
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004c34f0 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d5180 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace f24317b9689e8a7a ]---
RIP: 0010:drm_atomic_set_crtc_for_connector+0x426/0x5f0 drivers/gpu/drm/drm_atomic_uapi.c:342
Code: 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e a6 00 00 00 48 b8 00 00 00 00 00 fc ff df 41 8b 4d 28 <80> 38 00 0f 85 83 01 00 00 48 8b 2c 25 00 00 00 00 48 b8 00 00 00
RSP: 0018:ffffc900018bf938 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff8880116b0100 RCX: 0000000000000022
RDX: 1ffff11003019a66 RSI: ffffffff84302d10 RDI: ffff8880180cd330
RBP: 0000000000000000 R08: ffff888018051900 R09: ffff8880180cd343
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88801a024800
R13: ffff8880180cd308 R14: ffff8880116b0108 R15: ffff88801cd1b700
FS: 0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ee32e491f8 CR3: 0000000018634000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
* general protection fault in drm_atomic_set_crtc_for_connector
@ 2020-11-20 7:25 ` syzbot
0 siblings, 0 replies; 3+ messages in thread
From: syzbot @ 2020-11-20 7:25 UTC (permalink / raw)
To: airlied, christian.koenig, daniel, dri-devel, linaro-mm-sig,
linux-kernel, linux-media, maarten.lankhorst, mripard,
sumit.semwal, syzkaller-bugs, tzimmermann
Hello,
syzbot found the following issue on:
HEAD commit: 03430750 Add linux-next specific files for 20201116
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=123c946a500000
kernel config: https://syzkaller.appspot.com/x/.config?x=a1c4c3f27041fdb8
dashboard link: https://syzkaller.appspot.com/bug?extid=1aec08e752387f55c449
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15213981500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16590416500000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1aec08e752387f55c449@syzkaller.appspotmail.com
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 1 PID: 8503 Comm: syz-executor619 Not tainted 5.10.0-rc3-next-20201116-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:drm_atomic_set_crtc_for_connector+0x426/0x5f0 drivers/gpu/drm/drm_atomic_uapi.c:342
Code: 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e a6 00 00 00 48 b8 00 00 00 00 00 fc ff df 41 8b 4d 28 <80> 38 00 0f 85 83 01 00 00 48 8b 2c 25 00 00 00 00 48 b8 00 00 00
RSP: 0018:ffffc900018bf938 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff8880116b0100 RCX: 0000000000000022
RDX: 1ffff11003019a66 RSI: ffffffff84302d10 RDI: ffff8880180cd330
RBP: 0000000000000000 R08: ffff888018051900 R09: ffff8880180cd343
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88801a024800
R13: ffff8880180cd308 R14: ffff8880116b0108 R15: ffff88801cd1b700
FS: 0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006cf0a0 CR3: 000000000b08e000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
update_output_state drivers/gpu/drm/drm_atomic.c:1454 [inline]
__drm_atomic_helper_set_config+0x72a/0xe80 drivers/gpu/drm/drm_atomic.c:1568
drm_client_modeset_commit_atomic+0x527/0x7c0 drivers/gpu/drm/drm_client_modeset.c:1023
drm_client_modeset_commit_locked+0x145/0x580 drivers/gpu/drm/drm_client_modeset.c:1145
drm_client_modeset_commit+0x4d/0x80 drivers/gpu/drm/drm_client_modeset.c:1171
__drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:252 [inline]
__drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:231 [inline]
drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:279 [inline]
drm_fb_helper_lastclose drivers/gpu/drm/drm_fb_helper.c:1942 [inline]
drm_fbdev_client_restore+0xe3/0x1a0 drivers/gpu/drm/drm_fb_helper.c:2334
drm_client_dev_restore+0x17f/0x270 drivers/gpu/drm/drm_client.c:226
drm_lastclose drivers/gpu/drm/drm_file.c:468 [inline]
drm_release+0x441/0x530 drivers/gpu/drm/drm_file.c:499
__fput+0x283/0x920 fs/file_table.c:280
task_work_run+0xdd/0x190 kernel/task_work.c:140
exit_task_work include/linux/task_work.h:30 [inline]
do_exit+0xb9b/0x29f0 kernel/exit.c:823
do_group_exit+0x125/0x310 kernel/exit.c:920
__do_sys_exit_group kernel/exit.c:931 [inline]
__se_sys_exit_group kernel/exit.c:929 [inline]
__x64_sys_exit_group+0x3a/0x50 kernel/exit.c:929
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x443b18
Code: Unable to access opcode bytes at RIP 0x443aee.
RSP: 002b:00007fff6ec2d738 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000443b18
RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
RBP: 00000000004c34f0 R08: 00000000000000e7 R09: ffffffffffffffd0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00000000006d5180 R14: 0000000000000000 R15: 0000000000000000
Modules linked in:
---[ end trace f24317b9689e8a7a ]---
RIP: 0010:drm_atomic_set_crtc_for_connector+0x426/0x5f0 drivers/gpu/drm/drm_atomic_uapi.c:342
Code: 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e a6 00 00 00 48 b8 00 00 00 00 00 fc ff df 41 8b 4d 28 <80> 38 00 0f 85 83 01 00 00 48 8b 2c 25 00 00 00 00 48 b8 00 00 00
RSP: 0018:ffffc900018bf938 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: ffff8880116b0100 RCX: 0000000000000022
RDX: 1ffff11003019a66 RSI: ffffffff84302d10 RDI: ffff8880180cd330
RBP: 0000000000000000 R08: ffff888018051900 R09: ffff8880180cd343
R10: 0000000000000000 R11: 0000000000000000 R12: ffff88801a024800
R13: ffff8880180cd308 R14: ffff8880116b0108 R15: ffff88801cd1b700
FS: 0000000000000000(0000) GS:ffff8880b9f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ee32e491f8 CR3: 0000000018634000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: general protection fault in drm_atomic_set_crtc_for_connector
@ 2021-08-18 9:35 Desmond Cheong Zhi Xi
0 siblings, 0 replies; 3+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-08-18 9:35 UTC (permalink / raw)
To: syzbot+1aec08e752387f55c449; +Cc: syzkaller-bugs, linux-kernel-mentees
#syz fix: drm: fix oops in drm_atomic_set_crtc_for_connector
At the time of the bug report [1], there was the following call in
update_output_state:
> ret = drm_atomic_set_crtc_for_connector(new_conn_state,
> NULL);
This was followed by
> if (crtc) {
> crtc_state = drm_atomic_get_crtc_state(conn_state->state, crtc);
> if (IS_ERR(crtc_state))
> return PTR_ERR(crtc_state);
>
> crtc_state->connector_mask |=
> drm_connector_mask(conn_state->connector);
>
> drm_connector_get(conn_state->connector);
> conn_state->crtc = crtc;
>
> drm_dbg_atomic(crtc->dev,
> "Link [CONNECTOR:%d:%s] state %p to [CRTC:%d:%s]\n",
> connector->base.id, connector->name,
> conn_state, crtc->base.id, crtc->name);
> } else {
> drm_dbg_atomic(crtc->dev,
> "Link [CONNECTOR:%d:%s] state %p to [NOCRTC]\n",
> connector->base.id, connector->name,
> conn_state);
> }
in drm_atomic_set_crtc_for_connector, which clearly dereferences a null
pointer in the else block. This led to the reported general protection
fault.
commit 0003b687ee6d("drm: fix oops in
drm_atomic_set_crtc_for_connector") fixes this by getting the device
from connector, which can't be NULL.
Link:
https://syzkaller.appspot.com/bug?id=768a24e51bd111e0c1d6b6f4e1f09fac3c54c05d
[1]
Best wishes,
Desmond
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-08-18 9:35 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-11-20 7:25 general protection fault in drm_atomic_set_crtc_for_connector syzbot
2020-11-20 7:25 ` syzbot
-- strict thread matches above, loose matches on Subject: below --
2021-08-18 9:35 Desmond Cheong Zhi Xi
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.