From: Daniel Vetter <daniel@ffwll.ch>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>,
Tiago Vignatti <tiago.vignatti@nokia.com>,
Dave Airlie <airlied@redhat.com>,
Jesse Barnes <jbarnes@virtuousgeek.org>,
dri-devel@lists.freedesktop.org,
LKML <linux-kernel@vger.kernel.org>,
Kostya Serebryany <kcc@google.com>,
syzkaller <syzkaller@googlegroups.com>,
Alexander Potapenko <glider@google.com>,
Sasha Levin <sasha.levin@oracle.com>
Subject: Re: gpu: kmalloc size WARNING in vga_arb_write
Date: Tue, 26 Jan 2016 12:44:22 +0100 [thread overview]
Message-ID: <20160126114422.GA11240@phenom.ffwll.local> (raw)
In-Reply-To: <CACT4Y+ZB2RkOtqzzaHm8v+Y-aFecjvdLWJ_XdcFq61nvf=5_3Q@mail.gmail.com>
On Tue, Jan 26, 2016 at 11:26:29AM +0100, Dmitry Vyukov wrote:
> Hello,
>
> I've hit the following warning while running syzkaller fuzzer:
>
> ------------[ cut here ]------------
> WARNING: CPU: 2 PID: 29322 at mm/page_alloc.c:2999
> __alloc_pages_nodemask+0x7d2/0x1760()
> Modules linked in:
> CPU: 2 PID: 29322 Comm: syz-executor Tainted: G B 4.5.0-rc1+ #283
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> 00000000ffffffff ffff880069eff670 ffffffff8299a06d 0000000000000000
> ffff8800658a4740 ffffffff864985a0 ffff880069eff6b0 ffffffff8134fcf9
> ffffffff8166de32 ffffffff864985a0 0000000000000bb7 00000000024040c0
> Call Trace:
> [< inline >] __dump_stack lib/dump_stack.c:15
> [<ffffffff8299a06d>] dump_stack+0x6f/0xa2 lib/dump_stack.c:50
> [<ffffffff8134fcf9>] warn_slowpath_common+0xd9/0x140 kernel/panic.c:482
> [<ffffffff8134ff29>] warn_slowpath_null+0x29/0x30 kernel/panic.c:515
> [< inline >] __alloc_pages_slowpath mm/page_alloc.c:2999
> [<ffffffff8166de32>] __alloc_pages_nodemask+0x7d2/0x1760 mm/page_alloc.c:3253
> [<ffffffff81745c99>] alloc_pages_current+0xe9/0x450 mm/mempolicy.c:2090
> [< inline >] alloc_pages include/linux/gfp.h:459
> [<ffffffff81669bb6>] alloc_kmem_pages+0x16/0x100 mm/page_alloc.c:3433
> [<ffffffff816c20af>] kmalloc_order+0x1f/0x80 mm/slab_common.c:1008
> [<ffffffff816c212f>] kmalloc_order_trace+0x1f/0x140 mm/slab_common.c:1019
> [< inline >] kmalloc_large include/linux/slab.h:395
> [<ffffffff81756b24>] __kmalloc+0x2f4/0x340 mm/slub.c:3557
> [< inline >] kmalloc include/linux/slab.h:468
> [<ffffffff832c65a4>] vga_arb_write+0xd4/0xe40 drivers/gpu/vga/vgaarb.c:926
> [<ffffffff817a9831>] do_loop_readv_writev+0x141/0x1e0 fs/read_write.c:719
> [<ffffffff817ad698>] do_readv_writev+0x5f8/0x6e0 fs/read_write.c:849
> [<ffffffff817ad8b6>] vfs_writev+0x86/0xc0 fs/read_write.c:886
> [< inline >] SYSC_writev fs/read_write.c:919
> [<ffffffff817b0a21>] SyS_writev+0x111/0x2b0 fs/read_write.c:911
> [<ffffffff86359636>] entry_SYSCALL_64_fastpath+0x16/0x7a
> arch/x86/entry/entry_64.S:185
> ---[ end trace d543527022b589ec ]---
>
>
> vga_arb_write does:
>
> kbuf = kmalloc(count + 1, GFP_KERNEL);
>
> The kmalloc should use GFP_USER|__GFP_NOWARN flags since the size is
> user-controlled.
>
> On commit 92e963f50fc74041b5e9e744c330dca48e04f08d.
Care to create a patch for this and submit it please? You've done all the
debug work, might as well take credit ;-)
Thanks, Daniel
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
prev parent reply other threads:[~2016-01-26 11:44 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-26 10:26 gpu: kmalloc size WARNING in vga_arb_write Dmitry Vyukov
2016-01-26 11:44 ` Daniel Vetter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160126114422.GA11240@phenom.ffwll.local \
--to=daniel@ffwll.ch \
--cc=airlied@redhat.com \
--cc=benh@kernel.crashing.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=jbarnes@virtuousgeek.org \
--cc=kcc@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=sasha.levin@oracle.com \
--cc=syzkaller@googlegroups.com \
--cc=tiago.vignatti@nokia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox