From mboxrd@z Thu Jan 1 00:00:00 1970 From: bugzilla-daemon-CC+yJ3UmIYqDUpFQwHEjaQ@public.gmane.org Subject: [Bug 96306] New: BUG: KASAN: slab-out-of-bounds in OUT_RINGp (via nvc0_fbcon_imageblit) Date: Wed, 01 Jun 2016 11:44:07 +0000 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2078764757==" Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: nouveau-bounces-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org Sender: "Nouveau" To: nouveau-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org List-Id: nouveau.vger.kernel.org --===============2078764757== Content-Type: multipart/alternative; boundary="14647814471.D5ca4.15812"; charset="UTF-8" --14647814471.D5ca4.15812 Date: Wed, 1 Jun 2016 11:44:07 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated https://bugs.freedesktop.org/show_bug.cgi?id=3D96306 Bug ID: 96306 Summary: BUG: KASAN: slab-out-of-bounds in OUT_RINGp (via nvc0_fbcon_imageblit) Product: xorg Version: unspecified Hardware: x86-64 (AMD64) OS: Linux (All) Status: NEW Severity: normal Priority: medium Component: Driver/nouveau Assignee: nouveau-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org Reporter: peter-VTkQYDcBqhK7DlmcbJSQ7g@public.gmane.org QA Contact: xorg-team-go0+a7rfsptAfugRpC6u6w@public.gmane.org Created attachment 124231 --> https://bugs.freedesktop.org/attachment.cgi?id=3D124231&action=3Dedit dmesg output for v4.7-rc1 containing the KASAN report Previously reported by others to mailing lists (with no replies): [4.4-rc1] nouveau: BUG: KASAN: slab-out-of-bounds in memcpy+0x1d/0x40 https://lists.freedesktop.org/archives/dri-devel/2015-November/095100.html [3.10] BUG: drm, nouveau: slab-out-of-bounds read access in nv50_fbcon_imageblit() https://lists.freedesktop.org/archives/dri-devel/2016-May/108270.html Hardware: Optimus laptop with inteldrmfb being the primary framebuffer, an external monitor is connected to DP-1 on the Nvidia card (GTX 965M, 10de:13d9). Steps to reproduce the out-of-bounds issue in my environment: 0. Avoid continuously triggering the error: dmesg -D 1. modprobe nouveau runpm=3D0 (or be sure to wake the device before using con2fbmap, there is a nasty (unrelated) deadlock in there due to recursive console_lockup.) 2. con2fbmap 1 2 (bind console 2 to nouveaufb (1)). This invokes ioctl(/dev/fb0, FBIOPUT_CON2FBMAP, (u32[2]){2, 1})). 3. If you are not there already, switch to tty2 on the nouveau display. 4. Press Enter until you are at the last line of the console (or past it, I forgot). 5. Go to a different tty (e.g. the Intel one) and notice the KASAN report = in dmesg. Attached is yet another log (looks similar to the other ones) for v4.7-rc1 (with two unrelated patchsets applied on top). --=20 You are receiving this mail because: You are the assignee for the bug.= --14647814471.D5ca4.15812 Date: Wed, 1 Jun 2016 11:44:07 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated
Bug ID 96306
Summary BUG: KASAN: slab-out-of-bounds in OUT_RINGp (via nvc0_fbcon_i= mageblit)
Product xorg
Version unspecified
Hardware x86-64 (AMD64)
OS Linux (All)
Status NEW
Severity normal
Priority medium
Component Driver/nouveau
Assignee nouveau@lists.freedesktop.org
Reporter peter@lekensteyn.nl
QA Contact xorg-team@lists.x.org 

Created attachment 124231 [details]
dmesg output for v4.7-rc1 containing the KASAN report

Previously reported by others to mailing lists (with no replies):

[4.4-rc1] nouveau: BUG: KASAN: slab-out-of-bounds in memcpy+0x1d/0x40
https://lists.freedesktop.org/archives/dri-devel/2015-November/=
095100.html

[3.10] BUG: drm, nouveau: slab-out-of-bounds read access in
nv50_fbcon_imageblit()
https://lists.freedesktop.org/archives/dri-devel/2016-May/108270.htm=
l


Hardware:
Optimus laptop with inteldrmfb being the primary framebuffer, an external
monitor is connected to DP-1 on the Nvidia card (GTX 965M, 10de:13d9).

Steps to reproduce the out-of-bounds issue in my environment:
 0. Avoid continuously triggering the error: dmesg -D
 1. modprobe nouveau runpm=3D0 (or be sure to wake the device before using
con2fbmap, there is a nasty (unrelated) deadlock in there due to recursive
console_lockup.)
 2. con2fbmap 1 2 (bind console 2 to nouveaufb (1)). This invokes
ioctl(/dev/fb0, FBIOPUT_CON2FBMAP, (u32[2]){2, 1})).
 3. If you are not there already, switch to tty2 on the nouveau display.
 4. Press Enter until you are at the last line of the console (or past it, I
forgot).
 5. Go to a different tty (e.g. the Intel one) and notice the KASAN report =
in
dmesg.

Attached is yet another log (looks similar to the other ones) for v4.7-rc1
(with two unrelated patchsets applied on top).

You are receiving this mail because:
  • You are the assignee for the bug.
= --14647814471.D5ca4.15812-- --===============2078764757== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KTm91dmVhdSBt YWlsaW5nIGxpc3QKTm91dmVhdUBsaXN0cy5mcmVlZGVza3RvcC5vcmcKaHR0cHM6Ly9saXN0cy5m cmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0aW5mby9ub3V2ZWF1Cg== --===============2078764757==--