[syzbot] [dri?] KASAN: slab-use-after-free Read in drm_atomic_helper_wait_for_vblanks (2)

[syzbot] [dri?] KASAN: slab-use-after-free Read in drm_atomic_helper_wait_for_vblanks (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    a5b6244cf87c Merge tag 'block-6.8-2024-02-10' of git://git..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15e9ad50180000
kernel config:  https://syzkaller.appspot.com/x/.config?x=53985487b59d9442
dashboard link: https://syzkaller.appspot.com/bug?extid=0f999d26a4fd79c3a23b
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-a5b6244c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/08ca7654741a/vmlinux-a5b6244c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0396d079aa1e/bzImage-a5b6244c.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0f999d26a4fd79c3a23b@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in drm_atomic_helper_wait_for_vblanks.part.0+0x84f/0x930 drivers/gpu/drm/drm_atomic_helper.c:1661
Read of size 1 at addr ffff888026066009 by task kworker/u16:8/1094

CPU: 2 PID: 1094 Comm: kworker/u16:8 Not tainted 6.8.0-rc3-syzkaller-00293-ga5b6244cf87c #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: events_unbound commit_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc4/0x620 mm/kasan/report.c:488
 kasan_report+0xda/0x110 mm/kasan/report.c:601
 drm_atomic_helper_wait_for_vblanks.part.0+0x84f/0x930 drivers/gpu/drm/drm_atomic_helper.c:1661
 drm_atomic_helper_wait_for_vblanks drivers/gpu/drm/drm_atomic_helper.c:1657 [inline]
 drm_atomic_helper_commit_tail+0xcb/0xf0 drivers/gpu/drm/drm_atomic_helper.c:1757
 commit_tail+0x356/0x410 drivers/gpu/drm/drm_atomic_helper.c:1834
 process_one_work+0x889/0x15e0 kernel/workqueue.c:2633
 process_scheduled_works kernel/workqueue.c:2706 [inline]
 worker_thread+0x8b9/0x12a0 kernel/workqueue.c:2787
 kthread+0x2c6/0x3b0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
 </TASK>

Allocated by task 16480:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:372 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:389
 kmalloc include/linux/slab.h:590 [inline]
 drm_atomic_helper_crtc_duplicate_state+0x70/0xd0 drivers/gpu/drm/drm_atomic_state_helper.c:177
 drm_atomic_get_crtc_state+0x162/0x440 drivers/gpu/drm/drm_atomic.c:362
 page_flip_common+0x57/0x320 drivers/gpu/drm/drm_atomic_helper.c:3629
 drm_atomic_helper_page_flip+0xb6/0x190 drivers/gpu/drm/drm_atomic_helper.c:3690
 drm_mode_page_flip_ioctl+0x103f/0x1470 drivers/gpu/drm/drm_plane.c:1489
 drm_ioctl_kernel+0x1ec/0x3e0 drivers/gpu/drm/drm_ioctl.c:744
 drm_ioctl+0x5d8/0xc00 drivers/gpu/drm/drm_ioctl.c:841
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:871 [inline]
 __se_sys_ioctl fs/ioctl.c:857 [inline]
 __x64_sys_ioctl+0x193/0x220 fs/ioctl.c:857
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77

Freed by task 16474:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640
 poison_slab_object mm/kasan/common.c:241 [inline]
 __kasan_slab_free+0x121/0x1c0 mm/kasan/common.c:257
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2121 [inline]
 slab_free mm/slub.c:4299 [inline]
 kfree+0x124/0x370 mm/slub.c:4409
 drm_atomic_state_default_clear+0x3aa/0xde0 drivers/gpu/drm/drm_atomic.c:225
 drm_atomic_state_clear drivers/gpu/drm/drm_atomic.c:294 [inline]
 __drm_atomic_state_free+0x185/0x2b0 drivers/gpu/drm/drm_atomic.c:311
 kref_put include/linux/kref.h:65 [inline]
 drm_atomic_state_put include/drm/drm_atomic.h:490 [inline]
 drm_client_modeset_commit_atomic+0x6db/0x810 drivers/gpu/drm/drm_client_modeset.c:1057
 drm_client_modeset_commit_locked+0x14d/0x580 drivers/gpu/drm/drm_client_modeset.c:1154
 drm_client_modeset_commit+0x4f/0x80 drivers/gpu/drm/drm_client_modeset.c:1180
 __drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:251 [inline]
 __drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:230 [inline]
 drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:278 [inline]
 drm_fb_helper_lastclose+0xc7/0x160 drivers/gpu/drm/drm_fb_helper.c:2005
 drm_fbdev_generic_client_restore+0x2c/0x40 drivers/gpu/drm/drm_fbdev_generic.c:258
 drm_client_dev_restore+0x188/0x2a0 drivers/gpu/drm/drm_client.c:247
 drm_release+0x32f/0x3e0 drivers/gpu/drm/drm_file.c:437
 __fput+0x270/0xb80 fs/file_table.c:376
 __fput_sync+0x47/0x50 fs/file_table.c:461
 __do_sys_close fs/open.c:1554 [inline]
 __se_sys_close fs/open.c:1539 [inline]
 __x64_sys_close+0x87/0x100 fs/open.c:1539
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77

The buggy address belongs to the object at ffff888026066000
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 9 bytes inside of
 freed 512-byte region [ffff888026066000, ffff888026066200)

The buggy address belongs to the physical page:
page:ffffea0000981900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x26064
head:ffffea0000981900 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888014c42c80 0000000000000000 dead000000000001
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 28, tgid 28 (kworker/1:0), ts 50737339083, free_ts 50338469746
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311
 __alloc_pages+0x22f/0x2440 mm/page_alloc.c:4567
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 alloc_slab_page mm/slub.c:2190 [inline]
 allocate_slab mm/slub.c:2354 [inline]
 new_slab+0xcc/0x3a0 mm/slub.c:2407
 ___slab_alloc+0x4af/0x19a0 mm/slub.c:3540
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3625
 __slab_alloc_node mm/slub.c:3678 [inline]
 slab_alloc_node mm/slub.c:3850 [inline]
 kmalloc_trace+0x30b/0x340 mm/slub.c:4007
 kmalloc include/linux/slab.h:590 [inline]
 kzalloc include/linux/slab.h:711 [inline]
 mca_alloc net/ipv6/mcast.c:880 [inline]
 __ipv6_dev_mc_inc+0x2b7/0xc50 net/ipv6/mcast.c:936
 addrconf_join_solict net/ipv6/addrconf.c:2192 [inline]
 addrconf_dad_begin net/ipv6/addrconf.c:4037 [inline]
 addrconf_dad_work+0x232/0x14c0 net/ipv6/addrconf.c:4162
 process_one_work+0x889/0x15e0 kernel/workqueue.c:2633
 process_scheduled_works kernel/workqueue.c:2706 [inline]
 worker_thread+0x8b9/0x12a0 kernel/workqueue.c:2787
 kthread+0x2c6/0x3b0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
page last free pid 5180 tgid 5180 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2346
 free_unref_page+0x33/0x3c0 mm/page_alloc.c:2486
 qlink_free mm/kasan/quarantine.c:160 [inline]
 qlist_free_all+0x58/0x150 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:324
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3813 [inline]
 slab_alloc_node mm/slub.c:3860 [inline]
 kmalloc_trace+0x148/0x340 mm/slub.c:4007
 kmalloc include/linux/slab.h:590 [inline]
 kzalloc include/linux/slab.h:711 [inline]
 ref_tracker_alloc+0x17c/0x5b0 lib/ref_tracker.c:203
 __netdev_tracker_alloc include/linux/netdevice.h:4147 [inline]
 netdev_hold include/linux/netdevice.h:4176 [inline]
 netdev_hold include/linux/netdevice.h:4171 [inline]
 netdev_queue_add_kobject net/core/net-sysfs.c:1703 [inline]
 netdev_queue_update_kobjects+0x1b3/0x520 net/core/net-sysfs.c:1758
 register_queue_kobjects net/core/net-sysfs.c:1819 [inline]
 netdev_register_kobject+0x290/0x3f0 net/core/net-sysfs.c:2059
 register_netdevice+0x1392/0x1db0 net/core/dev.c:10261
 geneve_configure+0x6a7/0xa10 drivers/net/geneve.c:1366
 geneve_newlink+0x12f/0x2b0 drivers/net/geneve.c:1617
 rtnl_newlink_create net/core/rtnetlink.c:3515 [inline]
 __rtnl_newlink+0x1197/0x1960 net/core/rtnetlink.c:3735
 rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3748
 rtnetlink_rcv_msg+0x3c7/0xe10 net/core/rtnetlink.c:6615
 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2543

Memory state around the buggy address:
 ffff888026065f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888026065f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888026066000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff888026066080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888026066100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_atomic_helper_wait_for_vblanks (2)

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    c664e16bb1ba Merge tag 'docs-6.8-fixes2' of git://git.lwn...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14f8d1e0180000
kernel config:  https://syzkaller.appspot.com/x/.config?x=df82262440d95bc4
dashboard link: https://syzkaller.appspot.com/bug?extid=0f999d26a4fd79c3a23b
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1086cd48180000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11fcdba2180000

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/7bc7510fe41f/non_bootable_disk-c664e16b.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c838390fdb6c/vmlinux-c664e16b.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d25123cb1896/bzImage-c664e16b.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0f999d26a4fd79c3a23b@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in drm_atomic_helper_wait_for_vblanks.part.0+0x84f/0x930 drivers/gpu/drm/drm_atomic_helper.c:1661
Read of size 1 at addr ffff88802d6f0409 by task kworker/u16:1/13

CPU: 1 PID: 13 Comm: kworker/u16:1 Not tainted 6.8.0-rc4-syzkaller-00005-gc664e16bb1ba #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: events_unbound commit_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc4/0x620 mm/kasan/report.c:488
 kasan_report+0xda/0x110 mm/kasan/report.c:601
 drm_atomic_helper_wait_for_vblanks.part.0+0x84f/0x930 drivers/gpu/drm/drm_atomic_helper.c:1661
 drm_atomic_helper_wait_for_vblanks drivers/gpu/drm/drm_atomic_helper.c:1657 [inline]
 drm_atomic_helper_commit_tail+0xcb/0xf0 drivers/gpu/drm/drm_atomic_helper.c:1757
 commit_tail+0x356/0x410 drivers/gpu/drm/drm_atomic_helper.c:1834
 process_one_work+0x889/0x15e0 kernel/workqueue.c:2633
 process_scheduled_works kernel/workqueue.c:2706 [inline]
 worker_thread+0x8b9/0x12a0 kernel/workqueue.c:2787
 kthread+0x2c6/0x3b0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
 </TASK>

Allocated by task 5401:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:372 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:389
 kmalloc include/linux/slab.h:590 [inline]
 drm_atomic_helper_crtc_duplicate_state+0x70/0xd0 drivers/gpu/drm/drm_atomic_state_helper.c:177
 drm_atomic_get_crtc_state+0x162/0x440 drivers/gpu/drm/drm_atomic.c:362
 page_flip_common+0x57/0x320 drivers/gpu/drm/drm_atomic_helper.c:3629
 drm_atomic_helper_page_flip+0xb6/0x190 drivers/gpu/drm/drm_atomic_helper.c:3690
 drm_mode_page_flip_ioctl+0x103f/0x1470 drivers/gpu/drm/drm_plane.c:1489
 drm_ioctl_kernel+0x1ec/0x3e0 drivers/gpu/drm/drm_ioctl.c:744
 drm_ioctl+0x5d8/0xc00 drivers/gpu/drm/drm_ioctl.c:841
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:871 [inline]
 __se_sys_ioctl fs/ioctl.c:857 [inline]
 __x64_sys_ioctl+0x193/0x220 fs/ioctl.c:857
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77

Freed by task 5401:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640
 poison_slab_object mm/kasan/common.c:241 [inline]
 __kasan_slab_free+0x121/0x1c0 mm/kasan/common.c:257
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2121 [inline]
 slab_free mm/slub.c:4299 [inline]
 kfree+0x124/0x370 mm/slub.c:4409
 drm_atomic_state_default_clear+0x3aa/0xde0 drivers/gpu/drm/drm_atomic.c:225
 drm_atomic_state_clear drivers/gpu/drm/drm_atomic.c:294 [inline]
 __drm_atomic_state_free+0x185/0x2b0 drivers/gpu/drm/drm_atomic.c:311
 kref_put include/linux/kref.h:65 [inline]
 drm_atomic_state_put include/drm/drm_atomic.h:490 [inline]
 drm_client_modeset_commit_atomic+0x6db/0x810 drivers/gpu/drm/drm_client_modeset.c:1057
 drm_client_modeset_commit_locked+0x14d/0x580 drivers/gpu/drm/drm_client_modeset.c:1154
 drm_client_modeset_commit+0x4f/0x80 drivers/gpu/drm/drm_client_modeset.c:1180
 __drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:251 [inline]
 __drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:230 [inline]
 drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:278 [inline]
 drm_fb_helper_lastclose+0xc7/0x160 drivers/gpu/drm/drm_fb_helper.c:2005
 drm_fbdev_generic_client_restore+0x2c/0x40 drivers/gpu/drm/drm_fbdev_generic.c:258
 drm_client_dev_restore+0x188/0x2a0 drivers/gpu/drm/drm_client.c:247
 drm_release+0x32f/0x3e0 drivers/gpu/drm/drm_file.c:437
 __fput+0x270/0xb80 fs/file_table.c:376
 __fput_sync+0x47/0x50 fs/file_table.c:461
 __do_sys_close fs/open.c:1554 [inline]
 __se_sys_close fs/open.c:1539 [inline]
 __x64_sys_close+0x87/0x100 fs/open.c:1539
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77

The buggy address belongs to the object at ffff88802d6f0400
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 9 bytes inside of
 freed 512-byte region [ffff88802d6f0400, ffff88802d6f0600)

The buggy address belongs to the physical page:
page:ffffea0000b5bc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2d6f0
head:ffffea0000b5bc00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888014c42c80 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5401, tgid 5401 (syz-executor102), ts 53592743984, free_ts 53573722996
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311
 __alloc_pages+0x22f/0x2440 mm/page_alloc.c:4567
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 alloc_slab_page mm/slub.c:2190 [inline]
 allocate_slab mm/slub.c:2354 [inline]
 new_slab+0xcc/0x3a0 mm/slub.c:2407
 ___slab_alloc+0x4af/0x19a0 mm/slub.c:3540
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3625
 __slab_alloc_node mm/slub.c:3678 [inline]
 slab_alloc_node mm/slub.c:3850 [inline]
 kmalloc_trace+0x30b/0x340 mm/slub.c:4007
 kmalloc include/linux/slab.h:590 [inline]
 kzalloc include/linux/slab.h:711 [inline]
 drm_master_create+0x43/0x4d0 drivers/gpu/drm/drm_auth.c:136
 drm_new_set_master+0xd6/0x450 drivers/gpu/drm/drm_auth.c:172
 drm_master_open+0x181/0x1f0 drivers/gpu/drm/drm_auth.c:342
 drm_open_helper+0x3fc/0x500 drivers/gpu/drm/drm_file.c:330
 drm_open+0x1a0/0x490 drivers/gpu/drm/drm_file.c:380
 drm_stub_open+0x28e/0x430 drivers/gpu/drm/drm_drv.c:1046
 chrdev_open+0x26d/0x6f0 fs/char_dev.c:414
 do_dentry_open+0x8da/0x18c0 fs/open.c:953
 do_open fs/namei.c:3641 [inline]
 path_openat+0x1e00/0x29a0 fs/namei.c:3798
page last free pid 5398 tgid 5398 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2346
 free_unref_page+0x33/0x3c0 mm/page_alloc.c:2486
 rcu_do_batch kernel/rcu/tree.c:2190 [inline]
 rcu_core+0x819/0x1680 kernel/rcu/tree.c:2465
 __do_softirq+0x21c/0x8e7 kernel/softirq.c:553

Memory state around the buggy address:
 ffff88802d6f0300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88802d6f0380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802d6f0400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff88802d6f0480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802d6f0500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Re: [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_atomic_helper_wait_for_vblanks (2)

[Hillf Danton]

On Tue, 13 Feb 2024 06:08:15 -0800
> HEAD commit:    c664e16bb1ba Merge tag 'docs-6.8-fixes2' of git://git.lwn...
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11fcdba2180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  master

--- x/drivers/gpu/drm/drm_client_modeset.c
+++ y/drivers/gpu/drm/drm_client_modeset.c
@@ -1062,6 +1062,7 @@ out_ctx:
 	return ret;
 
 backoff:
+	cancel_work_sync(&state->commit_work);
 	drm_atomic_state_clear(state);
 	drm_modeset_backoff(&ctx);
 
--

Re: [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_atomic_helper_wait_for_vblanks (2)

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[   12.100286][    T1] Non-volatile memory driver v1.3
[   12.113616][    T1] Linux agpgart interface v0.103
[   12.123143][    T1] ACPI: bus type drm_connector registered
[   12.142579][    T1] [drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0
[   12.162590][    T1] [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1
[   12.287128][    T1] Console: switching to colour frame buffer device 128x48
[   12.310428][    T1] platform vkms: [drm] fb0: vkmsdrmfb frame buffer device
[   12.331206][    C0] vkms_vblank_simulate: vblank timer overrun
[   12.336575][    T1] usbcore: registered new interface driver udl
[   12.342353][    T1] [drm] pci: virtio-vga detected at 0000:00:01.0
[   12.363944][    T1] virtio-pci 0000:00:01.0: vgaarb: deactivate vga console
[   12.373522][    T1] [drm] features: -virgl +edid -resource_blob -host_visible
[   12.373539][    T1] [drm] features: -context_init
[   12.394195][    T1] [drm] number of scanouts: 1
[   12.397944][    T1] [drm] number of cap sets: 0
[   12.411757][    T1] [drm] Initialized virtio_gpu 0.1.0 0 for 0000:00:01.0 on minor 2
[   12.494144][    T1] fbcon: virtio_gpudrmfb (fb1) is primary device
[   12.494166][    T1] fbcon: Remapping primary device, fb1, to tty 1-63
[   12.529275][    T1] ------------[ cut here ]------------
[   12.529360][    T1] WARNING: CPU: 0 PID: 1 at kernel/workqueue.c:3403 __flush_work+0x879/0xa20
[   12.529392][    T1] Modules linked in:
[   12.529406][    T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.8.0-rc4-syzkaller-g7e90b5c295ec-dirty #0
[   12.529424][    T1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   12.529439][    T1] RIP: 0010:__flush_work+0x879/0xa20
[   12.529458][    T1] Code: c7 60 d1 7a 8d 48 8d 35 00 00 00 00 e8 80 c0 12 00 45 31 ed e9 cc fc ff ff e8 83 5a 33 00 90 0f 0b 90 eb ed e8 78 5a 33 00 90 <0f> 0b 90 eb e2 e8 6d 5a 33 00 e8 68 5a 33 00 e8 63 5a 33 00 48 8b
[   12.529476][    T1] RSP: 0000:ffffc90000046fc0 EFLAGS: 00010293
[   12.529493][    T1] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffff8157ebdd
[   12.529505][    T1] RDX: ffff8880166d8000 RSI: ffffffff8157f3a8 RDI: 0000000000000001
[   12.529517][    T1] RBP: ffff88801e1f1048 R08: 0000000000000001 R09: 0000000000000000
[   12.529529][    T1] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
[   12.529541][    T1] R13: 0000000000000001 R14: ffff88801e1f1060 R15: 0000000000000001
[   12.529559][    T1] FS:  0000000000000000(0000) GS:ffff88806b200000(0000) knlGS:0000000000000000
[   12.529599][    T1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   12.529623][    T1] CR2: ffff88817ffff000 CR3: 000000000d57a000 CR4: 0000000000350ef0
[   12.529636][    T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   12.529647][    T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[   12.529664][    T1] Call Trace:
[   12.529672][    T1]  <TASK>
[   12.529681][    T1]  ? show_regs+0x8f/0xa0
[   12.529709][    T1]  ? __warn+0xe6/0x390
[   12.529734][    T1]  ? __flush_work+0x879/0xa20
[   12.529751][    T1]  ? report_bug+0x3c0/0x580
[   12.529774][    T1]  ? handle_bug+0x3d/0x70
[   12.529792][    T1]  ? exc_invalid_op+0x17/0x50
[   12.529815][    T1]  ? asm_exc_invalid_op+0x1a/0x20
[   12.529905][    T1]  ? __flush_work+0xad/0xa20
[   12.529919][    T1]  ? __flush_work+0x878/0xa20
[   12.529935][    T1]  ? __flush_work+0x879/0xa20
[   12.529951][    T1]  ? rcu_is_watching+0x12/0xc0
[   12.529999][    T1]  ? __pfx___flush_work+0x10/0x10
[   12.530012][    T1]  ? __pfx_mark_lock+0x10/0x10
[   12.530034][    T1]  ? mark_held_locks+0x9f/0xe0
[   12.530052][    T1]  __cancel_work_timer+0x3f3/0x590
[   12.530068][    T1]  ? __pfx___cancel_work_timer+0x10/0x10
[   12.530083][    T1]  ? modeset_lock+0x10e/0x6c0
[   12.530102][    T1]  ? drm_modeset_lock+0x60/0x90
[   12.530120][    T1]  ? drm_atomic_get_crtc_state+0xd2/0x440
[   12.530144][    T1]  ? drm_atomic_get_plane_state+0x17a/0x590
[   12.530168][    T1]  drm_client_modeset_commit_atomic+0x294/0x820
[   12.530195][    T1]  ? trace_contention_end+0xda/0x110
[   12.530217][    T1]  ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10
[   12.530305][    T1]  ? __mutex_lock+0x1a6/0x9d0
[   12.530329][    T1]  ? __mutex_lock+0x1a6/0x9d0
[   12.530351][    T1]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[   12.530374][    T1]  drm_client_modeset_commit_locked+0x14d/0x580
[   12.530397][    T1]  drm_fb_helper_pan_display+0x2a5/0x990
[   12.530416][    T1]  fb_pan_display+0x477/0x7d0
[   12.530436][    T1]  ? __pfx_drm_fb_helper_pan_display+0x10/0x10
[   12.530454][    T1]  bit_update_start+0x49/0x1f0
[   12.530472][    T1]  fbcon_switch+0xbbf/0x12f0
[   12.530489][    T1]  ? __pfx_fbcon_switch+0x10/0x10
[   12.530507][    T1]  ? __pfx_bit_cursor+0x10/0x10
[   12.530525][    T1]  ? fbcon_cursor+0x3e0/0x540
[   12.530542][    T1]  ? is_console_locked+0x9/0x20
[   12.530560][    T1]  ? con_is_visible+0x65/0x150
[   12.530581][    T1]  redraw_screen+0x2bf/0x760
[   12.530596][    T1]  ? fbcon_prepare_logo+0x926/0xc80
[   12.530615][    T1]  ? __pfx_redraw_screen+0x10/0x10
[   12.530631][    T1]  set_con2fb_map+0x796/0x1060
[   12.530649][    T1]  fbcon_fb_registered+0x21d/0x670
[   12.530667][    T1]  ? fb_var_to_videomode+0x4c9/0x690
[   12.530691][    T1]  register_framebuffer+0x4b2/0x860
[   12.530714][    T1]  ? __pfx_register_framebuffer+0x10/0x10
[   12.530738][    T1]  ? drm_fbdev_generic_helper_fb_probe+0x4e2/0x6d0
[   12.530756][    T1]  __drm_fb_helper_initial_config_and_unlock+0xd82/0x1650
[   12.530779][    T1]  ? __pfx___drm_fb_helper_initial_config_and_unlock+0x10/0x10
[   12.530802][    T1]  drm_fb_helper_initial_config+0x44/0x60
[   12.530825][    T1]  drm_fbdev_generic_client_hotplug+0x1a6/0x280
[   12.530843][    T1]  ? __pfx_drm_fbdev_generic_client_hotplug+0x10/0x10
[   12.530860][    T1]  drm_client_register+0x195/0x280
[   12.530884][    T1]  drm_fbdev_generic_setup+0x184/0x340
[   12.530901][    T1]  virtio_gpu_probe+0x29d/0x4e0
[   12.530927][    T1]  virtio_dev_probe+0x5ff/0x9b0
[   12.530943][    T1]  ? __pfx_virtio_dev_probe+0x10/0x10
[   12.530958][    T1]  really_probe+0x23a/0xcb0
[   12.530981][    T1]  __driver_probe_device+0x1de/0x4b0
[   12.530996][    T1]  ? _raw_spin_unlock_irqrestore+0x52/0x80
[   12.531020][    T1]  driver_probe_device+0x4c/0x1b0
[   12.531037][    T1]  __driver_attach+0x283/0x580
[   12.531053][    T1]  ? __pfx___driver_attach+0x10/0x10
[   12.531068][    T1]  bus_for_each_dev+0x13c/0x1d0
[   12.531087][    T1]  ? __pfx_bus_for_each_dev+0x10/0x10
[   12.531108][    T1]  bus_add_driver+0x2ed/0x640
[   12.531128][    T1]  ? __pfx_virtio_gpu_driver_init+0x10/0x10
[   12.531149][    T1]  driver_register+0x15c/0x4b0
[   12.531168][    T1]  do_one_initcall+0x11c/0x670
[   12.531191][    T1]  ? __pfx_do_one_initcall+0x10/0x10
[   12.531214][    T1]  ? trace_kmalloc+0x2e/0xb0
[   12.531238][    T1]  ? __kmalloc+0x218/0x440
[   12.531258][    T1]  kernel_init_freeable+0x68d/0xc10
[   12.531286][    T1]  ? __pfx_kernel_init+0x10/0x10
[   12.531306][    T1]  kernel_init+0x1c/0x2a0
[   12.531325][    T1]  ? __pfx_kernel_init+0x10/0x10
[   12.531343][    T1]  ret_from_fork+0x45/0x80
[   12.531366][    T1]  ? __pfx_kernel_init+0x10/0x10
[   12.531390][    T1]  ret_from_fork_asm+0x1b/0x30
[   12.531420][    T1]  </TASK>
[   12.531431][    T1] Kernel panic - not syncing: kernel: panic_on_warn set ...
[   12.531437][    T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.8.0-rc4-syzkaller-g7e90b5c295ec-dirty #0
[   12.531458][    T1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[   12.531469][    T1] Call Trace:
[   12.531474][    T1]  <TASK>
[   12.531479][    T1]  dump_stack_lvl+0xd9/0x1b0
[   12.531497][    T1]  panic+0x6ee/0x7a0
[   12.531516][    T1]  ? __pfx_panic+0x10/0x10
[   12.531534][    T1]  ? show_trace_log_lvl+0x363/0x500
[   12.531557][    T1]  ? check_panic_on_warn+0x1f/0xb0
[   12.531578][    T1]  ? __flush_work+0x879/0xa20
[   12.531593][    T1]  check_panic_on_warn+0xab/0xb0
[   12.531616][    T1]  __warn+0xf2/0x390
[   12.533508][    T1]  ? __flush_work+0x879/0xa20
[   12.533508][    T1]  report_bug+0x3c0/0x580
[   12.533508][    T1]  handle_bug+0x3d/0x70
[   12.533508][    T1]  exc_invalid_op+0x17/0x50
[   12.533508][    T1]  asm_exc_invalid_op+0x1a/0x20
[   12.533508][    T1] RIP: 0010:__flush_work+0x879/0xa20
[   12.533508][    T1] Code: c7 60 d1 7a 8d 48 8d 35 00 00 00 00 e8 80 c0 12 00 45 31 ed e9 cc fc ff ff e8 83 5a 33 00 90 0f 0b 90 eb ed e8 78 5a 33 00 90 <0f> 0b 90 eb e2 e8 6d 5a 33 00 e8 68 5a 33 00 e8 63 5a 33 00 48 8b
[   12.533508][    T1] RSP: 0000:ffffc90000046fc0 EFLAGS: 00010293
[   12.533508][    T1] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffff8157ebdd
[   12.533508][    T1] RDX: ffff8880166d8000 RSI: ffffffff8157f3a8 RDI: 0000000000000001
[   12.533508][    T1] RBP: ffff88801e1f1048 R08: 0000000000000001 R09: 0000000000000000
[   12.533508][    T1] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
[   12.533508][    T1] R13: 0000000000000001 R14: ffff88801e1f1060 R15: 0000000000000001
[   12.533508][    T1]  ? __flush_work+0xad/0xa20
[   12.533508][    T1]  ? __flush_work+0x878/0xa20
[   12.533508][    T1]  ? rcu_is_watching+0x12/0xc0
[   12.533508][    T1]  ? __pfx___flush_work+0x10/0x10
[   12.533508][    T1]  ? __pfx_mark_lock+0x10/0x10
[   12.533508][    T1]  ? mark_held_locks+0x9f/0xe0
[   12.533508][    T1]  __cancel_work_timer+0x3f3/0x590
[   12.533508][    T1]  ? __pfx___cancel_work_timer+0x10/0x10
[   12.533508][    T1]  ? modeset_lock+0x10e/0x6c0
[   12.533508][    T1]  ? drm_modeset_lock+0x60/0x90
[   12.533508][    T1]  ? drm_atomic_get_crtc_state+0xd2/0x440
[   12.533508][    T1]  ? drm_atomic_get_plane_state+0x17a/0x590
[   12.533508][    T1]  drm_client_modeset_commit_atomic+0x294/0x820
[   12.533508][    T1]  ? trace_contention_end+0xda/0x110
[   12.533508][    T1]  ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10
[   12.533508][    T1]  ? __mutex_lock+0x1a6/0x9d0
[   12.533508][    T1]  ? __mutex_lock+0x1a6/0x9d0
[   12.533508][    T1]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[   12.533508][    T1]  drm_client_modeset_commit_locked+0x14d/0x580
[   12.533508][    T1]  drm_fb_helper_pan_display+0x2a5/0x990
[   12.533508][    T1]  fb_pan_display+0x477/0x7d0
[   12.533508][    T1]  ? __pfx_drm_fb_helper_pan_display+0x10/0x10
[   12.533508][    T1]  bit_update_start+0x49/0x1f0
[   12.533508][    T1]  fbcon_switch+0xbbf/0x12f0
[   12.533508][    T1]  ? __pfx_fbcon_switch+0x10/0x10
[   12.533508][    T1]  ? __pfx_bit_cursor+0x10/0x10
[   12.533508][    T1]  ? fbcon_cursor+0x3e0/0x540
[   12.533508][    T1]  ? is_console_locked+0x9/0x20
[   12.533508][    T1]  ? con_is_visible+0x65/0x150
[   12.533508][    T1]  redraw_screen+0x2bf/0x760
[   12.533508][    T1]  ? fbcon_prepare_logo+0x926/0xc80
[   12.533508][    T1]  ? __pfx_redraw_screen+0x10/0x10
[   12.533508][    T1]  set_con2fb_map+0x796/0x1060
[   12.533508][    T1]  fbcon_fb_registered+0x21d/0x670
[   12.533508][    T1]  ? fb_var_to_videomode+0x4c9/0x690
[   12.533508][    T1]  register_framebuffer+0x4b2/0x860
[   12.533508][    T1]  ? __pfx_register_framebuffer+0x10/0x10
[   12.533508][    T1]  ? drm_fbdev_generic_helper_fb_probe+0x4e2/0x6d0
[   12.533508][    T1]  __drm_fb_helper_initial_config_and_unlock+0xd82/0x1650
[   12.533508][    T1]  ? __pfx___drm_fb_helper_initial_config_and_unlock+0x10/0x10
[   12.533508][    T1]  drm_fb_helper_initial_config+0x44/0x60
[   12.533508][    T1]  drm_fbdev_generic_client_hotplug+0x1a6/0x280
[   12.533508][    T1]  ? __pfx_drm_fbdev_generic_client_hotplug+0x10/0x10
[   12.533508][    T1]  drm_client_register+0x195/0x280
[   12.533508][    T1]  drm_fbdev_generic_setup+0x184/0x340
[   12.533508][    T1]  virtio_gpu_probe+0x29d/0x4e0
[   12.533508][    T1]  virtio_dev_probe+0x5ff/0x9b0
[   12.533508][    T1]  ? __pfx_virtio_dev_probe+0x10/0x10
[   12.533508][    T1]  really_probe+0x23a/0xcb0
[   12.533508][    T1]  __driver_probe_device+0x1de/0x4b0
[   12.533508][    T1]  ? _raw_spin_unlock_irqrestore+0x52/0x80
[   12.533508][    T1]  driver_probe_device+0x4c/0x1b0
[   12.533508][    T1]  __driver_attach+0x283/0x580
[   12.533508][    T1]  ? __pfx___driver_attach+0x10/0x10
[   12.533508][    T1]  bus_for_each_dev+0x13c/0x1d0
[   12.533508][    T1]  ? __pfx_bus_for_each_dev+0x10/0x10
[   12.533508][    T1]  bus_add_driver+0x2ed/0x640
[   12.533508][    T1]  ? __pfx_virtio_gpu_driver_init+0x10/0x10
[   12.533508][    T1]  driver_register+0x15c/0x4b0
[   12.533508][    T1]  do_one_initcall+0x11c/0x670
[   12.533508][    T1]  ? __pfx_do_one_initcall+0x10/0x10
[   12.533508][    T1]  ? trace_kmalloc+0x2e/0xb0
[   12.533508][    T1]  ? __kmalloc+0x218/0x440
[   12.533508][    T1]  kernel_init_freeable+0x68d/0xc10
[   12.533508][    T1]  ? __pfx_kernel_init+0x10/0x10
[   12.533508][    T1]  kernel_init+0x1c/0x2a0
[   12.533508][    T1]  ? __pfx_kernel_init+0x10/0x10
[   12.533508][    T1]  ret_from_fork+0x45/0x80
[   12.533508][    T1]  ? __pfx_kernel_init+0x10/0x10
[   12.533508][    T1]  ret_from_fork_asm+0x1b/0x30
[   12.533508][    T1]  </TASK>
[   12.533508][    T1] Kernel Offset: disabled


syzkaller build log:
go env (err=<nil>)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs/linux/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs/linux/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.20.1"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod"
GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build3587630670=/tmp/go-build -gno-record-gcc-switches"

git status (err=<nil>)
HEAD detached at e66542d78
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:32: run command via tools/syz-env for best compatibility, see:
Makefile:33: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=e66542d78f1cf0c783877440cd239a11fb73fb15 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240213-111349'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=e66542d78f1cf0c783877440cd239a11fb73fb15 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240213-111349'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=e66542d78f1cf0c783877440cd239a11fb73fb15 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240213-111349'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"e66542d78f1cf0c783877440cd239a11fb73fb15\"


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=16112678180000


Tested on:

commit:         7e90b5c2 Merge tag 'trace-tools-v6.8-rc4' of git://git..
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
kernel config:  https://syzkaller.appspot.com/x/.config?x=df82262440d95bc4
dashboard link: https://syzkaller.appspot.com/bug?extid=0f999d26a4fd79c3a23b
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=10c28d14180000

Re: [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_atomic_helper_wait_for_vblanks (2)

[Hillf Danton]

On Tue, 13 Feb 2024 06:08:15 -0800
> HEAD commit:    c664e16bb1ba Merge tag 'docs-6.8-fixes2' of git://git.lwn...
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11fcdba2180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  master

--- x/drivers/gpu/drm/drm_client_modeset.c
+++ y/drivers/gpu/drm/drm_client_modeset.c
@@ -1062,6 +1062,8 @@ out_ctx:
 	return ret;
 
 backoff:
+	if (state->commit_work.func)
+		cancel_work_sync(&state->commit_work);
 	drm_atomic_state_clear(state);
 	drm_modeset_backoff(&ctx);
 
--

Re: [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_atomic_helper_wait_for_vblanks (2)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in drm_atomic_helper_wait_for_vblanks

==================================================================
BUG: KASAN: slab-use-after-free in drm_atomic_helper_wait_for_vblanks.part.0+0x84f/0x930 drivers/gpu/drm/drm_atomic_helper.c:1661
Read of size 1 at addr ffff88802a5f2409 by task kworker/u16:9/1096

CPU: 0 PID: 1096 Comm: kworker/u16:9 Not tainted 6.8.0-rc4-syzkaller-g7e90b5c295ec-dirty #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: events_unbound commit_work
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc4/0x620 mm/kasan/report.c:488
 kasan_report+0xda/0x110 mm/kasan/report.c:601
 drm_atomic_helper_wait_for_vblanks.part.0+0x84f/0x930 drivers/gpu/drm/drm_atomic_helper.c:1661
 drm_atomic_helper_wait_for_vblanks drivers/gpu/drm/drm_atomic_helper.c:1657 [inline]
 drm_atomic_helper_commit_tail+0xcb/0xf0 drivers/gpu/drm/drm_atomic_helper.c:1757
 commit_tail+0x356/0x410 drivers/gpu/drm/drm_atomic_helper.c:1834
 process_one_work+0x889/0x15e0 kernel/workqueue.c:2633
 process_scheduled_works kernel/workqueue.c:2706 [inline]
 worker_thread+0x8b9/0x12a0 kernel/workqueue.c:2787
 kthread+0x2c6/0x3b0 kernel/kthread.c:388
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242
 </TASK>

Allocated by task 5653:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:372 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:389
 kmalloc include/linux/slab.h:590 [inline]
 drm_atomic_helper_crtc_duplicate_state+0x70/0xd0 drivers/gpu/drm/drm_atomic_state_helper.c:177
 drm_atomic_get_crtc_state+0x162/0x440 drivers/gpu/drm/drm_atomic.c:362
 page_flip_common+0x57/0x320 drivers/gpu/drm/drm_atomic_helper.c:3629
 drm_atomic_helper_page_flip+0xb6/0x190 drivers/gpu/drm/drm_atomic_helper.c:3690
 drm_mode_page_flip_ioctl+0x103f/0x1470 drivers/gpu/drm/drm_plane.c:1489
 drm_ioctl_kernel+0x1ec/0x3e0 drivers/gpu/drm/drm_ioctl.c:744
 drm_ioctl+0x5d8/0xc00 drivers/gpu/drm/drm_ioctl.c:841
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:871 [inline]
 __se_sys_ioctl fs/ioctl.c:857 [inline]
 __x64_sys_ioctl+0x193/0x220 fs/ioctl.c:857
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77

Freed by task 5652:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3f/0x60 mm/kasan/generic.c:640
 poison_slab_object mm/kasan/common.c:241 [inline]
 __kasan_slab_free+0x121/0x1c0 mm/kasan/common.c:257
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2121 [inline]
 slab_free mm/slub.c:4299 [inline]
 kfree+0x124/0x370 mm/slub.c:4409
 drm_atomic_state_default_clear+0x3aa/0xde0 drivers/gpu/drm/drm_atomic.c:225
 drm_atomic_state_clear drivers/gpu/drm/drm_atomic.c:294 [inline]
 __drm_atomic_state_free+0x185/0x2b0 drivers/gpu/drm/drm_atomic.c:311
 kref_put include/linux/kref.h:65 [inline]
 drm_atomic_state_put include/drm/drm_atomic.h:490 [inline]
 drm_client_modeset_commit_atomic+0x70f/0x850 drivers/gpu/drm/drm_client_modeset.c:1057
 drm_client_modeset_commit_locked+0x14d/0x580 drivers/gpu/drm/drm_client_modeset.c:1156
 drm_client_modeset_commit+0x4f/0x80 drivers/gpu/drm/drm_client_modeset.c:1182
 __drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:251 [inline]
 __drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:230 [inline]
 drm_fb_helper_restore_fbdev_mode_unlocked drivers/gpu/drm/drm_fb_helper.c:278 [inline]
 drm_fb_helper_lastclose+0xc7/0x160 drivers/gpu/drm/drm_fb_helper.c:2005
 drm_fbdev_generic_client_restore+0x2c/0x40 drivers/gpu/drm/drm_fbdev_generic.c:258
 drm_client_dev_restore+0x188/0x2a0 drivers/gpu/drm/drm_client.c:247
 drm_release+0x32f/0x3e0 drivers/gpu/drm/drm_file.c:437
 __fput+0x270/0xb80 fs/file_table.c:376
 __fput_sync+0x47/0x50 fs/file_table.c:461
 __do_sys_close fs/open.c:1554 [inline]
 __se_sys_close fs/open.c:1539 [inline]
 __x64_sys_close+0x87/0x100 fs/open.c:1539
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77

The buggy address belongs to the object at ffff88802a5f2400
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 9 bytes inside of
 freed 512-byte region [ffff88802a5f2400, ffff88802a5f2600)

The buggy address belongs to the physical page:
page:ffffea0000a97c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802a5f3c00 pfn:0x2a5f0
head:ffffea0000a97c00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000a40(workingset|slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000a40 ffff888014c42c80 ffffea0000a4e410 ffffea00009bd610
raw: ffff88802a5f3c00 000000000010000b 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5166, tgid 5166 (syz-executor.0), ts 45262333507, free_ts 42769982140
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x2d4/0x350 mm/page_alloc.c:1533
 prep_new_page mm/page_alloc.c:1540 [inline]
 get_page_from_freelist+0xa28/0x3780 mm/page_alloc.c:3311
 __alloc_pages+0x22f/0x2440 mm/page_alloc.c:4567
 __alloc_pages_node include/linux/gfp.h:238 [inline]
 alloc_pages_node include/linux/gfp.h:261 [inline]
 alloc_slab_page mm/slub.c:2190 [inline]
 allocate_slab mm/slub.c:2354 [inline]
 new_slab+0xcc/0x3a0 mm/slub.c:2407
 ___slab_alloc+0x4af/0x19a0 mm/slub.c:3540
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3625
 __slab_alloc_node mm/slub.c:3678 [inline]
 slab_alloc_node mm/slub.c:3850 [inline]
 __do_kmalloc_node mm/slub.c:3980 [inline]
 __kmalloc+0x3b8/0x440 mm/slub.c:3994
 kmalloc include/linux/slab.h:594 [inline]
 kzalloc include/linux/slab.h:711 [inline]
 fib6_info_alloc+0x40/0x100 net/ipv6/ip6_fib.c:155
 ip6_route_info_create+0x337/0x1b70 net/ipv6/route.c:3749
 ip6_route_add+0x26/0x150 net/ipv6/route.c:3843
 addrconf_prefix_route+0x2fe/0x510 net/ipv6/addrconf.c:2437
 inet6_addr_add+0x609/0xbe0 net/ipv6/addrconf.c:3004
 inet6_rtm_newaddr+0x11de/0x1ab0 net/ipv6/addrconf.c:4976
 rtnetlink_rcv_msg+0x3c7/0xe10 net/core/rtnetlink.c:6615
 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2543
 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
 netlink_unicast+0x542/0x820 net/netlink/af_netlink.c:1367
page last free pid 5115 tgid 5115 stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1140 [inline]
 free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2346
 free_unref_page+0x33/0x3c0 mm/page_alloc.c:2486
 qlink_free mm/kasan/quarantine.c:160 [inline]
 qlist_free_all+0x58/0x150 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:324
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3813 [inline]
 kmem_cache_alloc_bulk+0x439/0x950 mm/slub.c:4655
 mt_alloc_bulk lib/maple_tree.c:167 [inline]
 mas_alloc_nodes+0x39b/0x860 lib/maple_tree.c:1264
 mas_node_count_gfp+0x105/0x130 lib/maple_tree.c:1322
 mas_preallocate+0x3bb/0x1020 lib/maple_tree.c:5508
 vma_iter_prealloc mm/internal.h:1147 [inline]
 __split_vma+0x47a/0x1190 mm/mmap.c:2348
 split_vma mm/mmap.c:2407 [inline]
 vma_modify+0x32a/0x460 mm/mmap.c:2449
 vma_modify_flags include/linux/mm.h:3283 [inline]
 mprotect_fixup+0x228/0xc90 mm/mprotect.c:635
 do_mprotect_pkey+0x860/0xd70 mm/mprotect.c:809
 __do_sys_mprotect mm/mprotect.c:830 [inline]
 __se_sys_mprotect mm/mprotect.c:827 [inline]
 __x64_sys_mprotect+0x78/0xc0 mm/mprotect.c:827
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x6f/0x77

Memory state around the buggy address:
 ffff88802a5f2300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88802a5f2380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802a5f2400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff88802a5f2480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802a5f2500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


Tested on:

commit:         7e90b5c2 Merge tag 'trace-tools-v6.8-rc4' of git://git..
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=15228d14180000
kernel config:  https://syzkaller.appspot.com/x/.config?x=df82262440d95bc4
dashboard link: https://syzkaller.appspot.com/bug?extid=0f999d26a4fd79c3a23b
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=14fc6742180000

Re: [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_atomic_helper_wait_for_vblanks (2)

[Hillf Danton]

On Tue, 13 Feb 2024 06:08:15 -0800
> HEAD commit:    c664e16bb1ba Merge tag 'docs-6.8-fixes2' of git://git.lwn...
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11fcdba2180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  master

--- x/drivers/gpu/drm/drm_client_modeset.c
+++ y/drivers/gpu/drm/drm_client_modeset.c
@@ -987,6 +987,7 @@ static int drm_client_modeset_commit_ato
 	struct drm_mode_set *mode_set;
 	int ret;
 
+retry:
 	drm_modeset_acquire_init(&ctx, 0);
 
 	state = drm_atomic_state_alloc(dev);
@@ -996,7 +997,6 @@ static int drm_client_modeset_commit_ato
 	}
 
 	state->acquire_ctx = &ctx;
-retry:
 	drm_for_each_plane(plane, dev) {
 		struct drm_plane_state *plane_state;
 
@@ -1051,21 +1051,15 @@ retry:
 		ret = drm_atomic_commit(state);
 
 out_state:
-	if (ret == -EDEADLK)
-		goto backoff;
-
 	drm_atomic_state_put(state);
 out_ctx:
 	drm_modeset_drop_locks(&ctx);
 	drm_modeset_acquire_fini(&ctx);
 
-	return ret;
-
-backoff:
-	drm_atomic_state_clear(state);
-	drm_modeset_backoff(&ctx);
+	if (ret == -EDEADLK)
+		goto retry;
 
-	goto retry;
+	return ret;
 }
 
 static int drm_client_modeset_commit_legacy(struct drm_client_dev *client)
--

Re: [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_atomic_helper_wait_for_vblanks (2)

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

stered
[    7.227065][    T1] io scheduler kyber registered
[    7.230249][    T1] io scheduler bfq registered
[    7.274282][    T1] ACPI: \_SB_.GSIE: Enabled at IRQ 20
[    7.283915][    T1] pcieport 0000:00:04.0: PME: Signaling with IRQ 25
[    7.291488][    T1] pcieport 0000:00:04.0: AER: enabled with IRQ 26
[    7.301097][    T1] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0
[    7.307815][    T1] ACPI: button: Power Button [PWRF]
[    7.590815][    T1] ioatdma: Intel(R) QuickData Technology Driver 5.00
[    7.624170][    T1] ACPI: \_SB_.GSIF: Enabled at IRQ 21
[    7.661185][    T1] ACPI: \_SB_.GSIH: Enabled at IRQ 23
[    8.035591][    T1] N_HDLC line discipline registered with maxframe=4096
[    8.039643][    T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[    8.046882][    T1] 00:04: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[    8.094343][    T1] Non-volatile memory driver v1.3
[    8.103986][    T1] Linux agpgart interface v0.103
[    8.113180][    T1] ACPI: bus type drm_connector registered
[    8.121142][    T1] [drm] Initialized vgem 1.0.0 20120112 for vgem on minor 0
[    8.134946][    T1] [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 1
[    8.237474][    T1] Console: switching to colour frame buffer device 128x48
[    8.257199][    T1] platform vkms: [drm] fb0: vkmsdrmfb frame buffer device
[    8.263052][    T1] usbcore: registered new interface driver udl
[    8.269025][    T1] [drm] pci: virtio-vga detected at 0000:00:01.0
[    8.274892][    T1] virtio-pci 0000:00:01.0: vgaarb: deactivate vga console
[    8.283302][    T1] [drm] features: -virgl +edid -resource_blob -host_visible
[    8.283317][    T1] [drm] features: -context_init
[    8.301233][    T1] [drm] number of scanouts: 1
[    8.304828][    T1] [drm] number of cap sets: 0
[    8.316672][    T1] [drm] Initialized virtio_gpu 0.1.0 0 for 0000:00:01.0 on minor 2
[    8.382391][    T1] fbcon: virtio_gpudrmfb (fb1) is primary device
[    8.382410][    T1] fbcon: Remapping primary device, fb1, to tty 1-63
[    8.400286][    T1] ------------[ cut here ]------------
[    8.400336][    T1] WARNING: CPU: 0 PID: 1 at drivers/gpu/drm/drm_modeset_lock.c:276 drm_modeset_drop_locks+0x17a/0x210
[    8.400389][    T1] Modules linked in:
[    8.400398][    T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.8.0-rc4-syzkaller-g7e90b5c295ec-dirty #0
[    8.400408][    T1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[    8.400414][    T1] RIP: 0010:drm_modeset_drop_locks+0x17a/0x210
[    8.400428][    T1] Code: 00 75 39 49 8b 44 24 70 49 39 c5 0f 85 31 ff ff ff 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f e9 cc 75 83 fc e8 c7 75 83 fc 90 <0f> 0b 90 e9 c4 fe ff ff 48 89 df e8 66 9f dc fc eb 9e 4c 89 ef e8
[    8.400437][    T1] RSP: 0000:ffffc90000047168 EFLAGS: 00010293
[    8.400447][    T1] RAX: 0000000000000000 RBX: ffffc90000047240 RCX: ffffffff85023ebc
[    8.400454][    T1] RDX: ffff8880166d8000 RSI: ffffffff8507d859 RDI: ffffc900000472a0
[    8.400460][    T1] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
[    8.400466][    T1] R10: 0000000000000004 R11: 0000000000000009 R12: ffffc90000047240
[    8.400473][    T1] R13: dffffc0000000000 R14: 0000000000000001 R15: ffffffffffffffdd
[    8.400483][    T1] FS:  0000000000000000(0000) GS:ffff88806b200000(0000) knlGS:0000000000000000
[    8.400508][    T1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    8.400518][    T1] CR2: ffff88817ffff000 CR3: 000000000d57a000 CR4: 0000000000350ef0
[    8.400525][    T1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    8.400531][    T1] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[    8.400537][    T1] Call Trace:
[    8.400542][    T1]  <TASK>
[    8.400547][    T1]  ? show_regs+0x8f/0xa0
[    8.400561][    T1]  ? __warn+0xe6/0x390
[    8.400575][    T1]  ? drm_modeset_drop_locks+0x17a/0x210
[    8.400587][    T1]  ? report_bug+0x3c0/0x580
[    8.400599][    T1]  ? handle_bug+0x3d/0x70
[    8.400609][    T1]  ? exc_invalid_op+0x17/0x50
[    8.400619][    T1]  ? asm_exc_invalid_op+0x1a/0x20
[    8.400662][    T1]  ? drm_dev_put.part.0+0x5c/0x140
[    8.400676][    T1]  ? drm_modeset_drop_locks+0x179/0x210
[    8.400688][    T1]  ? drm_modeset_drop_locks+0x17a/0x210
[    8.400700][    T1]  ? drm_modeset_drop_locks+0x179/0x210
[    8.400712][    T1]  drm_client_modeset_commit_atomic+0x2c2/0x800
[    8.400726][    T1]  ? trace_contention_end+0xda/0x110
[    8.400739][    T1]  ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10
[    8.400753][    T1]  ? __mutex_lock+0x1a6/0x9d0
[    8.400766][    T1]  ? __mutex_lock+0x1a6/0x9d0
[    8.400780][    T1]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[    8.400798][    T1]  drm_client_modeset_commit_locked+0x14d/0x580
[    8.400812][    T1]  drm_fb_helper_pan_display+0x2a5/0x990
[    8.400824][    T1]  fb_pan_display+0x477/0x7d0
[    8.400837][    T1]  ? __pfx_drm_fb_helper_pan_display+0x10/0x10
[    8.400848][    T1]  bit_update_start+0x49/0x1f0
[    8.400860][    T1]  fbcon_switch+0xbbf/0x12f0
[    8.400871][    T1]  ? __pfx_fbcon_switch+0x10/0x10
[    8.400882][    T1]  ? __pfx_bit_cursor+0x10/0x10
[    8.400892][    T1]  ? fbcon_cursor+0x3e0/0x540
[    8.400903][    T1]  ? is_console_locked+0x9/0x20
[    8.400913][    T1]  ? con_is_visible+0x65/0x150
[    8.400926][    T1]  redraw_screen+0x2bf/0x760
[    8.400935][    T1]  ? __pfx_redraw_screen+0x10/0x10
[    8.400944][    T1]  ? fb_get_color_depth+0x120/0x250
[    8.400956][    T1]  fbcon_prepare_logo+0x9f8/0xc80
[    8.400968][    T1]  set_con2fb_map+0xcf4/0x1060
[    8.400979][    T1]  fbcon_fb_registered+0x21d/0x670
[    8.400990][    T1]  ? fb_var_to_videomode+0x4c9/0x690
[    8.401003][    T1]  register_framebuffer+0x4b2/0x860
[    8.401015][    T1]  ? __pfx_register_framebuffer+0x10/0x10
[    8.401028][    T1]  ? drm_fbdev_generic_helper_fb_probe+0x4e2/0x6d0
[    8.401038][    T1]  __drm_fb_helper_initial_config_and_unlock+0xd82/0x1650
[    8.401051][    T1]  ? __pfx___drm_fb_helper_initial_config_and_unlock+0x10/0x10
[    8.401064][    T1]  drm_fb_helper_initial_config+0x44/0x60
[    8.401075][    T1]  drm_fbdev_generic_client_hotplug+0x1a6/0x280
[    8.401085][    T1]  ? __pfx_drm_fbdev_generic_client_hotplug+0x10/0x10
[    8.401095][    T1]  drm_client_register+0x195/0x280
[    8.401107][    T1]  drm_fbdev_generic_setup+0x184/0x340
[    8.401118][    T1]  virtio_gpu_probe+0x29d/0x4e0
[    8.401131][    T1]  virtio_dev_probe+0x5ff/0x9b0
[    8.401142][    T1]  ? __pfx_virtio_dev_probe+0x10/0x10
[    8.401151][    T1]  really_probe+0x23a/0xcb0
[    8.401165][    T1]  __driver_probe_device+0x1de/0x4b0
[    8.401174][    T1]  ? _raw_spin_unlock_irqrestore+0x52/0x80
[    8.401187][    T1]  driver_probe_device+0x4c/0x1b0
[    8.401196][    T1]  __driver_attach+0x283/0x580
[    8.401204][    T1]  ? __pfx___driver_attach+0x10/0x10
[    8.401213][    T1]  bus_for_each_dev+0x13c/0x1d0
[    8.401225][    T1]  ? __pfx_bus_for_each_dev+0x10/0x10
[    8.401237][    T1]  bus_add_driver+0x2ed/0x640
[    8.401250][    T1]  ? __pfx_virtio_gpu_driver_init+0x10/0x10
[    8.401263][    T1]  driver_register+0x15c/0x4b0
[    8.401273][    T1]  do_one_initcall+0x11c/0x670
[    8.401286][    T1]  ? __pfx_do_one_initcall+0x10/0x10
[    8.401299][    T1]  ? trace_kmalloc+0x2e/0xb0
[    8.401313][    T1]  ? __kmalloc+0x218/0x440
[    8.401323][    T1]  kernel_init_freeable+0x68d/0xc10
[    8.401338][    T1]  ? __pfx_kernel_init+0x10/0x10
[    8.401349][    T1]  kernel_init+0x1c/0x2a0
[    8.401359][    T1]  ? __pfx_kernel_init+0x10/0x10
[    8.401370][    T1]  ret_from_fork+0x45/0x80
[    8.401383][    T1]  ? __pfx_kernel_init+0x10/0x10
[    8.401393][    T1]  ret_from_fork_asm+0x1b/0x30
[    8.401407][    T1]  </TASK>
[    8.401412][    T1] Kernel panic - not syncing: kernel: panic_on_warn set ...
[    8.401417][    T1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.8.0-rc4-syzkaller-g7e90b5c295ec-dirty #0
[    8.401426][    T1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
[    8.401430][    T1] Call Trace:
[    8.401433][    T1]  <TASK>
[    8.401436][    T1]  dump_stack_lvl+0xd9/0x1b0
[    8.401447][    T1]  panic+0x6ee/0x7a0
[    8.401458][    T1]  ? __pfx_panic+0x10/0x10
[    8.401469][    T1]  ? show_trace_log_lvl+0x363/0x500
[    8.401482][    T1]  ? check_panic_on_warn+0x1f/0xb0
[    8.401493][    T1]  ? drm_modeset_drop_locks+0x17a/0x210
[    8.401504][    T1]  check_panic_on_warn+0xab/0xb0
[    8.401516][    T1]  __warn+0xf2/0x390
[    8.401527][    T1]  ? drm_modeset_drop_locks+0x17a/0x210
[    8.401538][    T1]  report_bug+0x3c0/0x580
[    8.401547][    T1]  handle_bug+0x3d/0x70
[    8.401556][    T1]  exc_invalid_op+0x17/0x50
[    8.401565][    T1]  asm_exc_invalid_op+0x1a/0x20
[    8.401576][    T1] RIP: 0010:drm_modeset_drop_locks+0x17a/0x210
[    8.401587][    T1] Code: 00 75 39 49 8b 44 24 70 49 39 c5 0f 85 31 ff ff ff 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f e9 cc 75 83 fc e8 c7 75 83 fc 90 <0f> 0b 90 e9 c4 fe ff ff 48 89 df e8 66 9f dc fc eb 9e 4c 89 ef e8
[    8.401595][    T1] RSP: 0000:ffffc90000047168 EFLAGS: 00010293
[    8.401602][    T1] RAX: 0000000000000000 RBX: ffffc90000047240 RCX: ffffffff85023ebc
[    8.401607][    T1] RDX: ffff8880166d8000 RSI: ffffffff8507d859 RDI: ffffc900000472a0
[    8.401612][    T1] RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000
[    8.401617][    T1] R10: 0000000000000004 R11: 0000000000000009 R12: ffffc90000047240
[    8.401622][    T1] R13: dffffc0000000000 R14: 0000000000000001 R15: ffffffffffffffdd
[    8.401628][    T1]  ? drm_dev_put.part.0+0x5c/0x140
[    8.401640][    T1]  ? drm_modeset_drop_locks+0x179/0x210
[    8.401651][    T1]  ? drm_modeset_drop_locks+0x179/0x210
[    8.401662][    T1]  drm_client_modeset_commit_atomic+0x2c2/0x800
[    8.401674][    T1]  ? trace_contention_end+0xda/0x110
[    8.401685][    T1]  ? __pfx_drm_client_modeset_commit_atomic+0x10/0x10
[    8.401697][    T1]  ? __mutex_lock+0x1a6/0x9d0
[    8.401709][    T1]  ? __mutex_lock+0x1a6/0x9d0
[    8.401721][    T1]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[    8.401734][    T1]  drm_client_modeset_commit_locked+0x14d/0x580
[    8.401746][    T1]  drm_fb_helper_pan_display+0x2a5/0x990
[    8.401756][    T1]  fb_pan_display+0x477/0x7d0
[    8.401766][    T1]  ? __pfx_drm_fb_helper_pan_display+0x10/0x10
[    8.401776][    T1]  bit_update_start+0x49/0x1f0
[    8.401786][    T1]  fbcon_switch+0xbbf/0x12f0
[    8.401799][    T1]  ? __pfx_fbcon_switch+0x10/0x10
[    8.401808][    T1]  ? __pfx_bit_cursor+0x10/0x10
[    8.401818][    T1]  ? fbcon_cursor+0x3e0/0x540
[    8.401827][    T1]  ? is_console_locked+0x9/0x20
[    8.401836][    T1]  ? con_is_visible+0x65/0x150
[    8.401847][    T1]  redraw_screen+0x2bf/0x760
[    8.401854][    T1]  ? __pfx_redraw_screen+0x10/0x10
[    8.401862][    T1]  ? fb_get_color_depth+0x120/0x250
[    8.401873][    T1]  fbcon_prepare_logo+0x9f8/0xc80
[    8.401883][    T1]  set_con2fb_map+0xcf4/0x1060
[    8.401893][    T1]  fbcon_fb_registered+0x21d/0x670
[    8.401902][    T1]  ? fb_var_to_videomode+0x4c9/0x690
[    8.401914][    T1]  register_framebuffer+0x4b2/0x860
[    8.401925][    T1]  ? __pfx_register_framebuffer+0x10/0x10
[    8.401936][    T1]  ? drm_fbdev_generic_helper_fb_probe+0x4e2/0x6d0
[    8.401945][    T1]  __drm_fb_helper_initial_config_and_unlock+0xd82/0x1650
[    8.401956][    T1]  ? __pfx___drm_fb_helper_initial_config_and_unlock+0x10/0x10
[    8.401968][    T1]  drm_fb_helper_initial_config+0x44/0x60
[    8.401977][    T1]  drm_fbdev_generic_client_hotplug+0x1a6/0x280
[    8.401986][    T1]  ? __pfx_drm_fbdev_generic_client_hotplug+0x10/0x10
[    8.401994][    T1]  drm_client_register+0x195/0x280
[    8.402005][    T1]  drm_fbdev_generic_setup+0x184/0x340
[    8.402014][    T1]  virtio_gpu_probe+0x29d/0x4e0
[    8.402025][    T1]  virtio_dev_probe+0x5ff/0x9b0
[    8.402033][    T1]  ? __pfx_virtio_dev_probe+0x10/0x10
[    8.402041][    T1]  really_probe+0x23a/0xcb0
[    8.402053][    T1]  __driver_probe_device+0x1de/0x4b0
[    8.402061][    T1]  ? _raw_spin_unlock_irqrestore+0x52/0x80
[    8.402072][    T1]  driver_probe_device+0x4c/0x1b0
[    8.402080][    T1]  __driver_attach+0x283/0x580
[    8.402088][    T1]  ? __pfx___driver_attach+0x10/0x10
[    8.402095][    T1]  bus_for_each_dev+0x13c/0x1d0
[    8.402106][    T1]  ? __pfx_bus_for_each_dev+0x10/0x10
[    8.402116][    T1]  bus_add_driver+0x2ed/0x640
[    8.402128][    T1]  ? __pfx_virtio_gpu_driver_init+0x10/0x10
[    8.402138][    T1]  driver_register+0x15c/0x4b0
[    8.402147][    T1]  do_one_initcall+0x11c/0x670
[    8.402158][    T1]  ? __pfx_do_one_initcall+0x10/0x10
[    8.402169][    T1]  ? trace_kmalloc+0x2e/0xb0
[    8.402181][    T1]  ? __kmalloc+0x218/0x440
[    8.402190][    T1]  kernel_init_freeable+0x68d/0xc10
[    8.402203][    T1]  ? __pfx_kernel_init+0x10/0x10
[    8.402212][    T1]  kernel_init+0x1c/0x2a0
[    8.402221][    T1]  ? __pfx_kernel_init+0x10/0x10
[    8.402230][    T1]  ret_from_fork+0x45/0x80
[    8.402241][    T1]  ? __pfx_kernel_init+0x10/0x10
[    8.402251][    T1]  ret_from_fork_asm+0x1b/0x30
[    8.402263][    T1]  </TASK>
[    8.403059][    T1] Kernel Offset: disabled


syzkaller build log:
go env (err=<nil>)
GO111MODULE="auto"
GOARCH="amd64"
GOBIN=""
GOCACHE="/syzkaller/.cache/go-build"
GOENV="/syzkaller/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/syzkaller/jobs/linux/gopath/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/syzkaller/jobs/linux/gopath"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.20.1"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/syzkaller/jobs/linux/gopath/src/github.com/google/syzkaller/go.mod"
GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build253358196=/tmp/go-build -gno-record-gcc-switches"

git status (err=<nil>)
HEAD detached at e66542d78
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:32: run command via tools/syz-env for best compatibility, see:
Makefile:33: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' ./sys/syz-sysgen | grep -q false || go install ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=e66542d78f1cf0c783877440cd239a11fb73fb15 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240213-111349'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-fuzzer github.com/google/syzkaller/syz-fuzzer
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=e66542d78f1cf0c783877440cd239a11fb73fb15 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240213-111349'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
GOOS=linux GOARCH=amd64 go build "-ldflags=-s -w -X github.com/google/syzkaller/prog.GitRevision=e66542d78f1cf0c783877440cd239a11fb73fb15 -X 'github.com/google/syzkaller/prog.gitRevisionDate=20240213-111349'" "-tags=syz_target syz_os_linux syz_arch_amd64 " -o ./bin/linux_amd64/syz-stress github.com/google/syzkaller/tools/syz-stress
mkdir -p ./bin/linux_amd64
gcc -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -fpermissive -w -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"e66542d78f1cf0c783877440cd239a11fb73fb15\"


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=1395d592180000


Tested on:

commit:         7e90b5c2 Merge tag 'trace-tools-v6.8-rc4' of git://git..
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
kernel config:  https://syzkaller.appspot.com/x/.config?x=df82262440d95bc4
dashboard link: https://syzkaller.appspot.com/bug?extid=0f999d26a4fd79c3a23b
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1247ec62180000

Re: [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_atomic_helper_wait_for_vblanks (2)

[Hillf Danton]

On Tue, 13 Feb 2024 06:08:15 -0800
> HEAD commit:    c664e16bb1ba Merge tag 'docs-6.8-fixes2' of git://git.lwn...
> git tree:       upstream
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=11fcdba2180000

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git  master

--- x/drivers/gpu/drm/drm_atomic_helper.c
+++ y/drivers/gpu/drm/drm_atomic_helper.c
@@ -1849,7 +1849,11 @@ static void commit_work(struct work_stru
 	struct drm_atomic_state *state = container_of(work,
 						      struct drm_atomic_state,
 						      commit_work);
+	struct drm_device *dev = state->dev;
+
+	mutex_lock(&dev->master_mutex);
 	commit_tail(state);
+	mutex_unlock(&dev->master_mutex);
 }
 
 /**
--

Re: [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_atomic_helper_wait_for_vblanks (2)

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+0f999d26a4fd79c3a23b@syzkaller.appspotmail.com

Tested on:

commit:         7e90b5c2 Merge tag 'trace-tools-v6.8-rc4' of git://git..
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=1790f698180000
kernel config:  https://syzkaller.appspot.com/x/.config?x=df82262440d95bc4
dashboard link: https://syzkaller.appspot.com/bug?extid=0f999d26a4fd79c3a23b
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=12fa241c180000

Note: testing is done by a robot and is best-effort only.

Re: [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_atomic_helper_wait_for_vblanks (2)

[Edward Adam Davis]

please test uaf in drm_atomic_helper_wait_for_vblanks

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 39ef0a6addeb..b16ff9020097 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1743,7 +1743,9 @@ EXPORT_SYMBOL(drm_atomic_helper_wait_for_flip_done);
 void drm_atomic_helper_commit_tail(struct drm_atomic_state *old_state)
 {
 	struct drm_device *dev = old_state->dev;
+	static DEFINE_MUTEX(lock);
 
+	mutex_lock(&lock);
 	drm_atomic_helper_commit_modeset_disables(dev, old_state);
 
 	drm_atomic_helper_commit_planes(dev, old_state, 0);
@@ -1757,6 +1759,7 @@ void drm_atomic_helper_commit_tail(struct drm_atomic_state *old_state)
 	drm_atomic_helper_wait_for_vblanks(dev, old_state);
 
 	drm_atomic_helper_cleanup_planes(dev, old_state);
+	mutex_unlock(&lock);
 }
 EXPORT_SYMBOL(drm_atomic_helper_commit_tail);
 

Re: [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_atomic_helper_wait_for_vblanks (2)

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+0f999d26a4fd79c3a23b@syzkaller.appspotmail.com

Tested on:

commit:         8d3dea21 Merge tag 'mips-fixes_6.8_2' of git://git.ker..
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=161f04d0180000
kernel config:  https://syzkaller.appspot.com/x/.config?x=df82262440d95bc4
dashboard link: https://syzkaller.appspot.com/bug?extid=0f999d26a4fd79c3a23b
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=167a4410180000

Note: testing is done by a robot and is best-effort only.

[PATCH] drm/atomic-helpers: fix uaf in drm_atomic_helper_wait_for_vblanks

[Edward Adam Davis]

To briefly summarize the issues reported by syzbot, there are two task call stacks
as follows:

Task A                                 Task B
------------------------------------   ----------------------------------
drm_atomic_nonblocking_commit          drm_atomic_commit
drm_atomic_helper_commit               drm_atomic_helper_commit
commit_work
commit_tail
drm_atomic_helper_commit_tail          commit_tail 
                                       drm_atomic_helper_commit_tail
                                       drm_client_modeset_commit_atomic
                                       drm_atomic_state_default_clear
drm_atomic_helper_wait_for_vblanks

When two prerequisites are met simultaneously, the current issue will be triggered:
1. There is an overlap in the memory range occupied by the crtcs member set contained
   in the instance state of "struct drm_atomic_state" created by Task A and Task B
2. The context of drm_atomic_helper_commit_tail() has no lock protection, resulting
   in the instance state->crtcs sub item being released by other task

The solution is to add a lock in drm_atomic_helper_commit_tail() to ensure that
there is no other task interference when accessing the instance state.

Reported-and-tested-by: syzbot+0f999d26a4fd79c3a23b@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 drivers/gpu/drm/drm_atomic_helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 39ef0a6addeb..b16ff9020097 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1743,7 +1743,9 @@ EXPORT_SYMBOL(drm_atomic_helper_wait_for_flip_done);
 void drm_atomic_helper_commit_tail(struct drm_atomic_state *old_state)
 {
 	struct drm_device *dev = old_state->dev;
+	static DEFINE_MUTEX(lock);
 
+	mutex_lock(&lock);
 	drm_atomic_helper_commit_modeset_disables(dev, old_state);
 
 	drm_atomic_helper_commit_planes(dev, old_state, 0);
@@ -1757,6 +1759,7 @@ void drm_atomic_helper_commit_tail(struct drm_atomic_state *old_state)
 	drm_atomic_helper_wait_for_vblanks(dev, old_state);
 
 	drm_atomic_helper_cleanup_planes(dev, old_state);
+	mutex_unlock(&lock);
 }
 EXPORT_SYMBOL(drm_atomic_helper_commit_tail);
 
-- 
2.43.0

[PATCH v2] drm/atomic-helpers: fix uaf in drm_atomic_helper_wait_for_vblanks

[Edward Adam Davis]

To briefly summarize the issues reported by syzbot, there are two task call stacks
as follows:

Task A                                 Task B
------------------------------------   ----------------------------------
                                       drm_atomic_commit
                                       drm_atomic_helper_commit
commit_work
commit_tail
drm_atomic_helper_commit_tail          commit_tail 
                                       drm_atomic_helper_commit_tail
                                       drm_client_modeset_commit_atomic
                                       drm_atomic_state_default_clear
drm_atomic_helper_wait_for_vblanks

When two prerequisites are met simultaneously, the current issue will be triggered:
1. There is an overlap in the memory range occupied by the crtcs member set contained
   in the instance state of "struct drm_atomic_state" created by Task A and Task B
2. The context of drm_atomic_helper_commit_tail() has no lock protection, resulting
   in the instance state->crtcs sub item being released by other task

The solution is to add a lock in drm_atomic_helper_commit_tail() to ensure that
there is no other task interference when accessing the instance state.

Reported-and-tested-by: syzbot+0f999d26a4fd79c3a23b@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 drivers/gpu/drm/drm_atomic_helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 39ef0a6addeb..b16ff9020097 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -1743,7 +1743,9 @@ EXPORT_SYMBOL(drm_atomic_helper_wait_for_flip_done);
 void drm_atomic_helper_commit_tail(struct drm_atomic_state *old_state)
 {
 	struct drm_device *dev = old_state->dev;
+	static DEFINE_MUTEX(lock);
 
+	mutex_lock(&lock);
 	drm_atomic_helper_commit_modeset_disables(dev, old_state);
 
 	drm_atomic_helper_commit_planes(dev, old_state, 0);
@@ -1757,6 +1759,7 @@ void drm_atomic_helper_commit_tail(struct drm_atomic_state *old_state)
 	drm_atomic_helper_wait_for_vblanks(dev, old_state);
 
 	drm_atomic_helper_cleanup_planes(dev, old_state);
+	mutex_unlock(&lock);
 }
 EXPORT_SYMBOL(drm_atomic_helper_commit_tail);
 
-- 
2.43.0