drm: WARNING in drm_irq_by_busid

drm: WARNING in drm_irq_by_busid

[Dmitry Vyukov]

Hello,

I've got the following WARNING while running syzkaller fuzzer:

------------[ cut here ]------------
WARNING: CPU: 1 PID: 16092 at drivers/gpu/drm/drm_pci.c:182
drm_irq_by_busid+0x3c0/0x4a0
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 16092 Comm: syz-executor Not tainted 4.8.0-rc3+ #33
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 ffffffff884b8280 ffff880032c07b00 ffffffff82d1b239 ffffffff01780000
 fffffbfff1097050 ffffffff86e8eec0 ffff880032c07bd8 ffffffff873a2c00
 dffffc0000000000 0000000000000009 ffff880032c07bc8 ffffffff816ab4e3
Call Trace:
 [<ffffffff81380adc>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:552
 [<ffffffff83424280>] drm_irq_by_busid+0x3c0/0x4a0 drivers/gpu/drm/drm_pci.c:182
 [<ffffffff83410a5c>] drm_ioctl+0x7bc/0xc60 drivers/gpu/drm/drm_ioctl.c:724
 [<     inline     >] vfs_ioctl fs/ioctl.c:43
 [<ffffffff8186f1fc>] do_vfs_ioctl+0x18c/0x1080 fs/ioctl.c:675
 [<     inline     >] SYSC_ioctl fs/ioctl.c:690
 [<ffffffff8187017f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:681
 [<ffffffff86c25480>] entry_SYSCALL_64_fastpath+0x23/0xc1
arch/x86/entry/entry_64.S:207

Unfortunately it's not reproducible. Probably fuzzer can't guess the
right bus id (there is no simple way to extract correct bus id). But
it happens regularly.

On commit 61c04572de404e52a655a36752e696bbcb483cf5 (Auh 25).

Re: drm: WARNING in drm_irq_by_busid

[Daniel Vetter]

On Sun, Aug 28, 2016 at 01:30:04PM +0200, Dmitry Vyukov wrote:
> Hello,
> 
> I've got the following WARNING while running syzkaller fuzzer:

This should be fixed in linux-next, can you pls confirm?

Also I'm somewhat suprised that syzkaller can't reproduce this reliably,
at least in the latest code the WARNING happens before anything
complicated (which would be hard to guess correctly for syzkaller) is
checked.
-Daniel

> 
> ------------[ cut here ]------------
> WARNING: CPU: 1 PID: 16092 at drivers/gpu/drm/drm_pci.c:182
> drm_irq_by_busid+0x3c0/0x4a0
> Kernel panic - not syncing: panic_on_warn set ...
> CPU: 1 PID: 16092 Comm: syz-executor Not tainted 4.8.0-rc3+ #33
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>  ffffffff884b8280 ffff880032c07b00 ffffffff82d1b239 ffffffff01780000
>  fffffbfff1097050 ffffffff86e8eec0 ffff880032c07bd8 ffffffff873a2c00
>  dffffc0000000000 0000000000000009 ffff880032c07bc8 ffffffff816ab4e3
> Call Trace:
>  [<ffffffff81380adc>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:552
>  [<ffffffff83424280>] drm_irq_by_busid+0x3c0/0x4a0 drivers/gpu/drm/drm_pci.c:182
>  [<ffffffff83410a5c>] drm_ioctl+0x7bc/0xc60 drivers/gpu/drm/drm_ioctl.c:724
>  [<     inline     >] vfs_ioctl fs/ioctl.c:43
>  [<ffffffff8186f1fc>] do_vfs_ioctl+0x18c/0x1080 fs/ioctl.c:675
>  [<     inline     >] SYSC_ioctl fs/ioctl.c:690
>  [<ffffffff8187017f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:681
>  [<ffffffff86c25480>] entry_SYSCALL_64_fastpath+0x23/0xc1
> arch/x86/entry/entry_64.S:207
> 
> Unfortunately it's not reproducible. Probably fuzzer can't guess the
> right bus id (there is no simple way to extract correct bus id). But
> it happens regularly.
> 
> On commit 61c04572de404e52a655a36752e696bbcb483cf5 (Auh 25).
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch