6.12.7 stable new error: event xe_bo_move has unsafe dereference of argument 4

6.12.7 stable new error: event xe_bo_move has unsafe dereference of argument 4

[Genes Lists]

[-- Attachment #1.1: Type: text/plain, Size: 5694 bytes --]

I have not had a chance to bisect this yet but since its in stable
thought it best to share sooner than later.

If noone spots anything, I will do a bisect soon as I can. Boot
completes and aside from this error things seem fine.

 - Does not happen with 6.12.6.
 - Does happen with Mainline + patch for different drm bug
    mainline commit : d6ef8b40d075c425f548002d2f35ae3f06e9cf96
    Patch: https://patchwork.freedesktop.org/series/141911/
    Patch fixes drm bug reported here (patch not yet in mainline):
       
https://lore.kernel.org/lkml/3b097dddd7095bccabe6791b90899c689f271a35.camel@sapience.com/

Graphics h/w:
  00:02.0 VGA compatible controller: Intel Corporation Raptor Lake-P
[Iris Xe Graphics] (rev 04)

Trace below and full dmesg attached.

gene

[  +0.143567] ------------[ cut here ]------------
[  +0.000003] WARNING: CPU: 6 PID: 344 at
kernel/trace/trace_events.c:577 trace_event_raw_init+0x159/0x660
[  +0.000005] Modules linked in: xe(+) drm_ttm_helper gpu_sched
drm_suballoc_helper drm_gpuvm drm_exec typec_displayport usbhid
hid_sensor_custom hid_sensor_hub intel_ishtp_hid nvme
spi_pxa2xx_platform hid_multitouch dw_dmac nvme_core 8250_dw
spi_pxa2xx_core i915 crct10dif_pclmul crc32_pclmul i2c_algo_bit
crc32c_intel psmouse polyval_clmulni serio_raw polyval_generic
drm_buddy atkbd ghash_clmulni_intel libps2 vivaldi_fmap ttm
sha512_ssse3 sha256_ssse3 intel_gtt sha1_ssse3 aesni_intel gf128mul
drm_display_helper ucsi_acpi crypto_simd typec_ucsi intel_lpss_pci
intel_ish_ipc cryptd intel_lpss roles intel_ishtp idma64 cec vmd typec
i2c_hid_acpi i8042 video i2c_hid serio wmi pkcs8_key_parser wireguard
curve25519_x86_64 libchacha20poly1305 chacha_x86_64 poly1305_x86_64
ip6_udp_tunnel udp_tunnel libcurve25519_generic libchacha loop sg
crypto_user
[  +0.000022] CPU: 6 UID: 0 PID: 344 Comm: (udev-worker) Not tainted
6.12.7-stable-1 #16 8ef5eca39d52f9e2c5a50ace761c4a6858369a18
[  +0.000003] Hardware name: Dell Inc. XPS 9320/0CR6NC, BIOS 2.16.1
09/11/2024
[  +0.000001] RIP: 0010:trace_event_raw_init+0x159/0x660
[  +0.000002] Code: 89 ea 0f 83 3b 04 00 00 e8 84 db ff ff 84 c0 74 10
8b 0c 24 48 c7 c0 fe ff ff ff 48 d3 c0 49 21 c6 4d 85 f6 0f 84 d6 fe ff
ff <0f> 0b bb 01 00 00 00 41 f6 c6 01 0f 85 f3 78 bf 00 66 0f 1f 44 00
[  +0.000001] RSP: 0018:ffffa3c8007bb980 EFLAGS: 00010206
[  +0.000001] RAX: ffffffffffffffdf RBX: ffffffffc0ef8731 RCX:
0000000000000005
[  +0.000001] RDX: 0000000000000002 RSI: 0000000000000001 RDI:
ffffffffc0ef8727
[  +0.000001] RBP: ffffffffc0ef8640 R08: 0000000000000039 R09:
0000000000000000
[  +0.000000] R10: 0000000000000076 R11: 000000000000004e R12:
00000000000000f2
[  +0.000001] R13: ffffffffc0ef9760 R14: 0000000000000018 R15:
0000000000000000
[  +0.000001] FS:  000075f6c10d0880(0000) GS:ffff96b92f500000(0000)
knlGS:0000000000000000
[  +0.000001] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  +0.000000] CR2: 00007be641f52f70 CR3: 000000010cffe000 CR4:
0000000000f50ef0
[  +0.000001] PKRU: 55555554
[  +0.000001] Call Trace:
[  +0.000001]  <TASK>
[  +0.000000]  ? trace_event_raw_init+0x159/0x660
[  +0.000002]  ? __warn.cold+0x93/0xf6
[  +0.000001]  ? trace_event_raw_init+0x159/0x660
[  +0.000003]  ? report_bug+0xff/0x140
[  +0.000002]  ? handle_bug+0x58/0x90
[  +0.000001]  ? exc_invalid_op+0x17/0x70
[  +0.000002]  ? asm_exc_invalid_op+0x1a/0x20
[  +0.000003]  ? trace_event_raw_init+0x159/0x660
[  +0.000002]  event_init+0x28/0x70
[  +0.000002]  trace_module_notify+0x19a/0x250
[  +0.000001]  notifier_call_chain+0x5a/0xd0
[  +0.000002]  blocking_notifier_call_chain_robust+0x65/0xc0
[  +0.000002]  load_module+0x1818/0x1ce0
[  +0.000004]  ? init_module_from_file+0x89/0xe0
[  +0.000001]  init_module_from_file+0x89/0xe0
[  +0.000002]  idempotent_init_module+0x11e/0x310
[  +0.000002]  __x64_sys_finit_module+0x5e/0xb0
[  +0.000002]  do_syscall_64+0x82/0x160
[  +0.000002]  ? syscall_exit_to_user_mode+0x10/0x200
[  +0.000001]  ? do_syscall_64+0x8e/0x160
[  +0.000001]  ? syscall_exit_to_user_mode+0x10/0x200
[  +0.000001]  ? do_syscall_64+0x8e/0x160
[  +0.000001]  ? do_sys_openat2+0x9c/0xe0
[  +0.000002]  ? syscall_exit_to_user_mode+0x10/0x200
[  +0.000001]  ? do_syscall_64+0x8e/0x160
[  +0.000001]  ? do_sys_openat2+0x9c/0xe0
[  +0.000002]  ? syscall_exit_to_user_mode+0x10/0x200
[  +0.000001]  ? do_syscall_64+0x8e/0x160
[  +0.000001]  ? exc_page_fault+0x7e/0x180
[  +0.000001]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[  +0.000002] RIP: 0033:0x75f6c18c71fd
[  +0.000011] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa
48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f
05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e3 fa 0c 00 f7 d8 64 89 01 48
[  +0.000001] RSP: 002b:00007ffdec463948 EFLAGS: 00000246 ORIG_RAX:
0000000000000139
[  +0.000001] RAX: ffffffffffffffda RBX: 000057194ec1c5c0 RCX:
000075f6c18c71fd
[  +0.000001] RDX: 0000000000000004 RSI: 000075f6c10ca05d RDI:
000000000000002b
[  +0.000000] RBP: 00007ffdec463a00 R08: 0000000000000001 R09:
00007ffdec463990
[  +0.000001] R10: 0000000000000040 R11: 0000000000000246 R12:
000075f6c10ca05d
[  +0.000000] R13: 0000000000020000 R14: 000057194ec1dc40 R15:
000057194ec1e900
[  +0.000001]  </TASK>
[  +0.000001] ---[ end trace 0000000000000000 ]---
[  +0.000000] event xe_bo_move has unsafe dereference of argument 4
[  +0.000001] print_fmt: "move_lacks_source:%s, migrate object %p [size
%zu] from %s to %s device_id:%s", REC->move_lacks_source ? "yes" :
"no", REC->bo, REC->size, xe_mem_type_to_name[REC->old_placement],
xe_mem_type_to_name[REC->new_placement], __get_str(device_id)

-- 
Gene


[-- Attachment #1.2: klog-6.12.7 --]
[-- Type: application/x-troff-man, Size: 123723 bytes --]

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

[REGRESSION][BISECTED] Re: 6.12.7 stable new error: event xe_bo_move has unsafe dereference of argument 4

[Genes Lists]

[-- Attachment #1: Type: text/plain, Size: 10410 bytes --]

On Fri, 2024-12-27 at 11:15 -0500, Genes Lists wrote:
> I have not had a chance to bisect this yet but since its in stable
> thought it best to share sooner than later.
> 
> If noone spots anything, I will do a bisect soon as I can. Boot
> completes and aside from this error things seem fine.
> 
>  - Does not happen with 6.12.6.
>  - Does happen with Mainline + patch for different drm bug
>     mainline commit : d6ef8b40d075c425f548002d2f35ae3f06e9cf96
>     Patch: https://patchwork.freedesktop.org/series/141911/
>     Patch fixes drm bug reported here (patch not yet in mainline):
>        
> https://lore.kernel.org/lkml/3b097dddd7095bccabe6791b90899c689f271a35
> .camel@sapience.com/
> 
> Graphics h/w:
>   00:02.0 VGA compatible controller: Intel Corporation Raptor Lake-P
> [Iris Xe Graphics] (rev 04)
> 
> Trace below and full dmesg attached.
> 
> gene
> 
> [  +0.143567] ------------[ cut here ]------------
> [  +0.000003] WARNING: CPU: 6 PID: 344 at
> kernel/trace/trace_events.c:577 trace_event_raw_init+0x159/0x660
> [  +0.000005] Modules linked in: xe(+) drm_ttm_helper gpu_sched
> drm_suballoc_helper drm_gpuvm drm_exec typec_displayport usbhid
> hid_sensor_custom hid_sensor_hub intel_ishtp_hid nvme
> spi_pxa2xx_platform hid_multitouch dw_dmac nvme_core 8250_dw
> spi_pxa2xx_core i915 crct10dif_pclmul crc32_pclmul i2c_algo_bit
> crc32c_intel psmouse polyval_clmulni serio_raw polyval_generic
> drm_buddy atkbd ghash_clmulni_intel libps2 vivaldi_fmap ttm
> sha512_ssse3 sha256_ssse3 intel_gtt sha1_ssse3 aesni_intel gf128mul
> drm_display_helper ucsi_acpi crypto_simd typec_ucsi intel_lpss_pci
> intel_ish_ipc cryptd intel_lpss roles intel_ishtp idma64 cec vmd
> typec
> i2c_hid_acpi i8042 video i2c_hid serio wmi pkcs8_key_parser wireguard
> curve25519_x86_64 libchacha20poly1305 chacha_x86_64 poly1305_x86_64
> ip6_udp_tunnel udp_tunnel libcurve25519_generic libchacha loop sg
> crypto_user
> [  +0.000022] CPU: 6 UID: 0 PID: 344 Comm: (udev-worker) Not tainted
> 6.12.7-stable-1 #16 8ef5eca39d52f9e2c5a50ace761c4a6858369a18
> [  +0.000003] Hardware name: Dell Inc. XPS 9320/0CR6NC, BIOS 2.16.1
> 09/11/2024
> [  +0.000001] RIP: 0010:trace_event_raw_init+0x159/0x660
> [  +0.000002] Code: 89 ea 0f 83 3b 04 00 00 e8 84 db ff ff 84 c0 74
> 10
> 8b 0c 24 48 c7 c0 fe ff ff ff 48 d3 c0 49 21 c6 4d 85 f6 0f 84 d6 fe
> ff
> ff <0f> 0b bb 01 00 00 00 41 f6 c6 01 0f 85 f3 78 bf 00 66 0f 1f 44
> 00
> [  +0.000001] RSP: 0018:ffffa3c8007bb980 EFLAGS: 00010206
> [  +0.000001] RAX: ffffffffffffffdf RBX: ffffffffc0ef8731 RCX:
> 0000000000000005
> [  +0.000001] RDX: 0000000000000002 RSI: 0000000000000001 RDI:
> ffffffffc0ef8727
> [  +0.000001] RBP: ffffffffc0ef8640 R08: 0000000000000039 R09:
> 0000000000000000
> [  +0.000000] R10: 0000000000000076 R11: 000000000000004e R12:
> 00000000000000f2
> [  +0.000001] R13: ffffffffc0ef9760 R14: 0000000000000018 R15:
> 0000000000000000
> [  +0.000001] FS:  000075f6c10d0880(0000) GS:ffff96b92f500000(0000)
> knlGS:0000000000000000
> [  +0.000001] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  +0.000000] CR2: 00007be641f52f70 CR3: 000000010cffe000 CR4:
> 0000000000f50ef0
> [  +0.000001] PKRU: 55555554
> [  +0.000001] Call Trace:
> [  +0.000001]  <TASK>
> [  +0.000000]  ? trace_event_raw_init+0x159/0x660
> [  +0.000002]  ? __warn.cold+0x93/0xf6
> [  +0.000001]  ? trace_event_raw_init+0x159/0x660
> [  +0.000003]  ? report_bug+0xff/0x140
> [  +0.000002]  ? handle_bug+0x58/0x90
> [  +0.000001]  ? exc_invalid_op+0x17/0x70
> [  +0.000002]  ? asm_exc_invalid_op+0x1a/0x20
> [  +0.000003]  ? trace_event_raw_init+0x159/0x660
> [  +0.000002]  event_init+0x28/0x70
> [  +0.000002]  trace_module_notify+0x19a/0x250
> [  +0.000001]  notifier_call_chain+0x5a/0xd0
> [  +0.000002]  blocking_notifier_call_chain_robust+0x65/0xc0
> [  +0.000002]  load_module+0x1818/0x1ce0
> [  +0.000004]  ? init_module_from_file+0x89/0xe0
> [  +0.000001]  init_module_from_file+0x89/0xe0
> [  +0.000002]  idempotent_init_module+0x11e/0x310
> [  +0.000002]  __x64_sys_finit_module+0x5e/0xb0
> [  +0.000002]  do_syscall_64+0x82/0x160
> [  +0.000002]  ? syscall_exit_to_user_mode+0x10/0x200
> [  +0.000001]  ? do_syscall_64+0x8e/0x160
> [  +0.000001]  ? syscall_exit_to_user_mode+0x10/0x200
> [  +0.000001]  ? do_syscall_64+0x8e/0x160
> [  +0.000001]  ? do_sys_openat2+0x9c/0xe0
> [  +0.000002]  ? syscall_exit_to_user_mode+0x10/0x200
> [  +0.000001]  ? do_syscall_64+0x8e/0x160
> [  +0.000001]  ? do_sys_openat2+0x9c/0xe0
> [  +0.000002]  ? syscall_exit_to_user_mode+0x10/0x200
> [  +0.000001]  ? do_syscall_64+0x8e/0x160
> [  +0.000001]  ? exc_page_fault+0x7e/0x180
> [  +0.000001]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [  +0.000002] RIP: 0033:0x75f6c18c71fd
> [  +0.000011] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e
> fa
> 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08
> 0f
> 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e3 fa 0c 00 f7 d8 64 89 01
> 48
> [  +0.000001] RSP: 002b:00007ffdec463948 EFLAGS: 00000246 ORIG_RAX:
> 0000000000000139
> [  +0.000001] RAX: ffffffffffffffda RBX: 000057194ec1c5c0 RCX:
> 000075f6c18c71fd
> [  +0.000001] RDX: 0000000000000004 RSI: 000075f6c10ca05d RDI:
> 000000000000002b
> [  +0.000000] RBP: 00007ffdec463a00 R08: 0000000000000001 R09:
> 00007ffdec463990
> [  +0.000001] R10: 0000000000000040 R11: 0000000000000246 R12:
> 000075f6c10ca05d
> [  +0.000000] R13: 0000000000020000 R14: 000057194ec1dc40 R15:
> 000057194ec1e900
> [  +0.000001]  </TASK>
> [  +0.000001] ---[ end trace 0000000000000000 ]---
> [  +0.000000] event xe_bo_move has unsafe dereference of argument 4
> [  +0.000001] print_fmt: "move_lacks_source:%s, migrate object %p
> [size
> %zu] from %s to %s device_id:%s", REC->move_lacks_source ? "yes" :
> "no", REC->bo, REC->size, xe_mem_type_to_name[REC->old_placement],
> xe_mem_type_to_name[REC->new_placement], __get_str(device_id)
> 

 1) rc5 has the same issue.

 2) Result of git bisect starting with 6.12.6 is :

gene


git bisect good
683eccacc02d2eb25d1c34b8fb0363fcc7e08f64 is the first bad commit
commit 683eccacc02d2eb25d1c34b8fb0363fcc7e08f64
Author: Steven Rostedt <rostedt@goodmis.org>
Date:   Mon Dec 16 21:41:21 2024 -0500

    tracing: Add "%s" check in test_event_printk()
    
    commit 65a25d9f7ac02e0cf361356e834d1c71d36acca9 upstream.
    
    The test_event_printk() code makes sure that when a trace event is
    registered, any dereferenced pointers in from the event's
TP_printk() are
    pointing to content in the ring buffer. But currently it does not
handle
    "%s", as there's cases where the string pointer saved in the ring
buffer
    points to a static string in the kernel that will never be freed.
As that
    is a valid case, the pointer needs to be checked at runtime.
    
    Currently the runtime check is done via trace_check_vprintf(), but
to not
    have to replicate everything in vsnprintf() it does some logic with
the
    va_list that may not be reliable across architectures. In order to
get rid
    of that logic, more work in the test_event_printk() needs to be
done. Some
    of the strings can be validated at this time when it is obvious the
string
    is valid because the string will be saved in the ring buffer
content.
    
    Do all the validation of strings in the ring buffer at boot in
    test_event_printk(), and make sure that the field of the strings
that
    point into the kernel are accessible. This will allow adding checks
at
    runtime that will validate the fields themselves and not rely on
paring
    the TP_printk() format at runtime.
    
    Cc: stable@vger.kernel.org
    Cc: Masami Hiramatsu <mhiramat@kernel.org>
    Cc: Mark Rutland <mark.rutland@arm.com>
    Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Al Viro <viro@ZenIV.linux.org.uk>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Link: https://lore.kernel.org/20241217024720.685917008@goodmis.org
    Fixes: 5013f454a352c ("tracing: Add check of trace event print fmts
for dereferencing pointers")
    Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

 kernel/trace/trace_events.c | 104
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++----
--------
 1 file changed, 89 insertions(+), 15 deletions(-)

3) The git bisect log is:

   git bisect start
   # status: waiting for both good and bad commits
   # good: [e9d65b48ce1aba50e9ec7eab6d9f73d1ba88420e] Linux 6.12.6
   git bisect good e9d65b48ce1aba50e9ec7eab6d9f73d1ba88420e
   # bad: [319addc2ad901dac4d6cc931d77ef35073e0942f] Linux 6.12.7
   git bisect bad 319addc2ad901dac4d6cc931d77ef35073e0942f
   # good: [ced29f2149c9b65ca01008ba64d9db993ad8fad1] USB: serial:
   option: add Telit FE910C04 rmnet compositions
   git bisect good ced29f2149c9b65ca01008ba64d9db993ad8fad1
   # good: [b2f23a1c7181f8c562ea06d3ea14879334d6bdf4] drm/amdgpu/gfx12:
   fix IP version check
   git bisect good b2f23a1c7181f8c562ea06d3ea14879334d6bdf4
   # bad: [2976661ed4de10bd1945e7cca0d7363b44f240dd] of/irq: Fix
   interrupt-map cell length check in of_irq_parse_imap_parent()
   git bisect bad 2976661ed4de10bd1945e7cca0d7363b44f240dd
   # good: [3985cd30472a6a67bfe3f0b42ad23b59fa824033] tracing: Fix
   test_event_printk() to process entire print argument
   git bisect good 3985cd30472a6a67bfe3f0b42ad23b59fa824033
   # bad: [416226eb3f3a3008456903fc3695b0efa8ceafa1] selftests/bpf: Use
   asm constraint "m" for LoongArch
   git bisect bad 416226eb3f3a3008456903fc3695b0efa8ceafa1
   # bad: [683eccacc02d2eb25d1c34b8fb0363fcc7e08f64] tracing: Add "%s"
   check in test_event_printk()
   git bisect bad 683eccacc02d2eb25d1c34b8fb0363fcc7e08f64
   # good: [71a613ceac1ad6235e164aea34abcddb258296af] tracing: Add
   missing helper functions in event pointer dereference check
   git bisect good 71a613ceac1ad6235e164aea34abcddb258296af
   # first bad commit: [683eccacc02d2eb25d1c34b8fb0363fcc7e08f64]
   tracing: Add "%s" check in test_event_printk()
   

-- 
Gene


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [REGRESSION][BISECTED] Re: 6.12.7 stable new error: event xe_bo_move has unsafe dereference of argument 4

[Steven Rostedt]

On Mon, 30 Dec 2024 13:55:00 -0500
Genes Lists <lists@sapience.com> wrote:

> On Fri, 2024-12-27 at 11:15 -0500, Genes Lists wrote:
> > I have not had a chance to bisect this yet but since its in stable
> > thought it best to share sooner than later.
> > 
> > If noone spots anything, I will do a bisect soon as I can. Boot
> > completes and aside from this error things seem fine.
> > 
> >  - Does not happen with 6.12.6.
> >  - Does happen with Mainline + patch for different drm bug
> >     mainline commit : d6ef8b40d075c425f548002d2f35ae3f06e9cf96
> >     Patch: https://patchwork.freedesktop.org/series/141911/
> >     Patch fixes drm bug reported here (patch not yet in mainline):
> >        
> > https://lore.kernel.org/lkml/3b097dddd7095bccabe6791b90899c689f271a35
> > .camel@sapience.com/
> > 
> > Graphics h/w:
> >   00:02.0 VGA compatible controller: Intel Corporation Raptor Lake-P
> > [Iris Xe Graphics] (rev 04)
> > 
> > Trace below and full dmesg attached.
> > 
> > gene
> > 
> > [  +0.143567] ------------[ cut here ]------------
> > [  +0.000003] WARNING: CPU: 6 PID: 344 at
> > kernel/trace/trace_events.c:577 trace_event_raw_init+0x159/0x660
> > [  +0.000005] Modules linked in: xe(+) drm_ttm_helper gpu_sched
> > drm_suballoc_helper drm_gpuvm drm_exec typec_displayport usbhid
> > hid_sensor_custom hid_sensor_hub intel_ishtp_hid nvme
> > spi_pxa2xx_platform hid_multitouch dw_dmac nvme_core 8250_dw
> > spi_pxa2xx_core i915 crct10dif_pclmul crc32_pclmul i2c_algo_bit
> > crc32c_intel psmouse polyval_clmulni serio_raw polyval_generic
> > drm_buddy atkbd ghash_clmulni_intel libps2 vivaldi_fmap ttm
> > sha512_ssse3 sha256_ssse3 intel_gtt sha1_ssse3 aesni_intel gf128mul
> > drm_display_helper ucsi_acpi crypto_simd typec_ucsi intel_lpss_pci
> > intel_ish_ipc cryptd intel_lpss roles intel_ishtp idma64 cec vmd
> > typec
> > i2c_hid_acpi i8042 video i2c_hid serio wmi pkcs8_key_parser wireguard
> > curve25519_x86_64 libchacha20poly1305 chacha_x86_64 poly1305_x86_64
> > ip6_udp_tunnel udp_tunnel libcurve25519_generic libchacha loop sg
> > crypto_user
> > [  +0.000022] CPU: 6 UID: 0 PID: 344 Comm: (udev-worker) Not tainted
> > 6.12.7-stable-1 #16 8ef5eca39d52f9e2c5a50ace761c4a6858369a18
> > [  +0.000003] Hardware name: Dell Inc. XPS 9320/0CR6NC, BIOS 2.16.1
> > 09/11/2024
> > [  +0.000001] RIP: 0010:trace_event_raw_init+0x159/0x660
> > [  +0.000002] Code: 89 ea 0f 83 3b 04 00 00 e8 84 db ff ff 84 c0 74
> > 10
> > 8b 0c 24 48 c7 c0 fe ff ff ff 48 d3 c0 49 21 c6 4d 85 f6 0f 84 d6 fe
> > ff
> > ff <0f> 0b bb 01 00 00 00 41 f6 c6 01 0f 85 f3 78 bf 00 66 0f 1f 44
> > 00
> > [  +0.000001] RSP: 0018:ffffa3c8007bb980 EFLAGS: 00010206
> > [  +0.000001] RAX: ffffffffffffffdf RBX: ffffffffc0ef8731 RCX:
> > 0000000000000005
> > [  +0.000001] RDX: 0000000000000002 RSI: 0000000000000001 RDI:
> > ffffffffc0ef8727
> > [  +0.000001] RBP: ffffffffc0ef8640 R08: 0000000000000039 R09:
> > 0000000000000000
> > [  +0.000000] R10: 0000000000000076 R11: 000000000000004e R12:
> > 00000000000000f2
> > [  +0.000001] R13: ffffffffc0ef9760 R14: 0000000000000018 R15:
> > 0000000000000000
> > [  +0.000001] FS:  000075f6c10d0880(0000) GS:ffff96b92f500000(0000)
> > knlGS:0000000000000000
> > [  +0.000001] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > [  +0.000000] CR2: 00007be641f52f70 CR3: 000000010cffe000 CR4:
> > 0000000000f50ef0
> > [  +0.000001] PKRU: 55555554
> > [  +0.000001] Call Trace:
> > [  +0.000001]  <TASK>
> > [  +0.000000]  ? trace_event_raw_init+0x159/0x660
> > [  +0.000002]  ? __warn.cold+0x93/0xf6
> > [  +0.000001]  ? trace_event_raw_init+0x159/0x660
> > [  +0.000003]  ? report_bug+0xff/0x140
> > [  +0.000002]  ? handle_bug+0x58/0x90
> > [  +0.000001]  ? exc_invalid_op+0x17/0x70
> > [  +0.000002]  ? asm_exc_invalid_op+0x1a/0x20
> > [  +0.000003]  ? trace_event_raw_init+0x159/0x660
> > [  +0.000002]  event_init+0x28/0x70
> > [  +0.000002]  trace_module_notify+0x19a/0x250
> > [  +0.000001]  notifier_call_chain+0x5a/0xd0
> > [  +0.000002]  blocking_notifier_call_chain_robust+0x65/0xc0
> > [  +0.000002]  load_module+0x1818/0x1ce0
> > [  +0.000004]  ? init_module_from_file+0x89/0xe0
> > [  +0.000001]  init_module_from_file+0x89/0xe0
> > [  +0.000002]  idempotent_init_module+0x11e/0x310
> > [  +0.000002]  __x64_sys_finit_module+0x5e/0xb0
> > [  +0.000002]  do_syscall_64+0x82/0x160
> > [  +0.000002]  ? syscall_exit_to_user_mode+0x10/0x200
> > [  +0.000001]  ? do_syscall_64+0x8e/0x160
> > [  +0.000001]  ? syscall_exit_to_user_mode+0x10/0x200
> > [  +0.000001]  ? do_syscall_64+0x8e/0x160
> > [  +0.000001]  ? do_sys_openat2+0x9c/0xe0
> > [  +0.000002]  ? syscall_exit_to_user_mode+0x10/0x200
> > [  +0.000001]  ? do_syscall_64+0x8e/0x160
> > [  +0.000001]  ? do_sys_openat2+0x9c/0xe0
> > [  +0.000002]  ? syscall_exit_to_user_mode+0x10/0x200
> > [  +0.000001]  ? do_syscall_64+0x8e/0x160
> > [  +0.000001]  ? exc_page_fault+0x7e/0x180
> > [  +0.000001]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> > [  +0.000002] RIP: 0033:0x75f6c18c71fd
> > [  +0.000011] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e
> > fa
> > 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08
> > 0f
> > 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e3 fa 0c 00 f7 d8 64 89 01
> > 48
> > [  +0.000001] RSP: 002b:00007ffdec463948 EFLAGS: 00000246 ORIG_RAX:
> > 0000000000000139
> > [  +0.000001] RAX: ffffffffffffffda RBX: 000057194ec1c5c0 RCX:
> > 000075f6c18c71fd
> > [  +0.000001] RDX: 0000000000000004 RSI: 000075f6c10ca05d RDI:
> > 000000000000002b
> > [  +0.000000] RBP: 00007ffdec463a00 R08: 0000000000000001 R09:
> > 00007ffdec463990
> > [  +0.000001] R10: 0000000000000040 R11: 0000000000000246 R12:
> > 000075f6c10ca05d
> > [  +0.000000] R13: 0000000000020000 R14: 000057194ec1dc40 R15:
> > 000057194ec1e900
> > [  +0.000001]  </TASK>
> > [  +0.000001] ---[ end trace 0000000000000000 ]---
> > [  +0.000000] event xe_bo_move has unsafe dereference of argument 4
> > [  +0.000001] print_fmt: "move_lacks_source:%s, migrate object %p
> > [size
> > %zu] from %s to %s device_id:%s", REC->move_lacks_source ? "yes" :
> > "no", REC->bo, REC->size, xe_mem_type_to_name[REC->old_placement],
> > xe_mem_type_to_name[REC->new_placement], __get_str(device_id)
> >   

Yep. That's a false positive :-(

We stopped doing runtime checks of '%s' as it required using va_list
"hacks", so the checks have been moved to the boot up code. The above has:

TRACE_EVENT(xe_bo_move,
            TP_PROTO(struct xe_bo *bo, uint32_t new_placement, uint32_t old_placement,
                     bool move_lacks_source),
            TP_ARGS(bo, new_placement, old_placement, move_lacks_source),
            TP_STRUCT__entry(
                     __field(struct xe_bo *, bo)
                     __field(size_t, size)
                     __field(u32, new_placement)
                     __field(u32, old_placement)
                     __string(device_id, __dev_name_bo(bo))
                     __field(bool, move_lacks_source)
                        ),

            TP_fast_assign(
                   __entry->bo      = bo;
                   __entry->size = bo->size;
                   __entry->new_placement = new_placement;
                   __entry->old_placement = old_placement;
                   __assign_str(device_id);
                   __entry->move_lacks_source = move_lacks_source;
                   ),
            TP_printk("move_lacks_source:%s, migrate object %p [size %zu] from %s to %s device_id:%s",
                      __entry->move_lacks_source ? "yes" : "no", __entry->bo, __entry->size,
                      xe_mem_type_to_name[__entry->old_placement],
                      xe_mem_type_to_name[__entry->new_placement], __get_str(device_id))

Where the xe_mem_type_to_name is an array of strings, that I assume
will always be there for the file of the module.

I guess the "fix" would be to have the check code ignore pointer to
arrays, assuming they are "ok".

The check is mostly to catch the naive use of:

   TP_fast_assign(
	__entry->str = passed_in_string;
   )

   TP_printk("str=%s", __entry->str)

Which was 99% of the bugs that this would catch. I would think if we have:

   TP_fast_assign(
	__entry->idx = passed_in_idx;
   )

   TP_printk("str=%s", some_array[__entry->idx])

Would 99% be OK. For the 1% it's not, oh well, that would be a false
negative. Still better than not having this check.

-- Steve


> 
>  1) rc5 has the same issue.
> 
>  2) Result of git bisect starting with 6.12.6 is :
> 
> gene
> 
> 
> git bisect good
> 683eccacc02d2eb25d1c34b8fb0363fcc7e08f64 is the first bad commit
> commit 683eccacc02d2eb25d1c34b8fb0363fcc7e08f64
> Author: Steven Rostedt <rostedt@goodmis.org>
> Date:   Mon Dec 16 21:41:21 2024 -0500
> 
>     tracing: Add "%s" check in test_event_printk()
>     
>     commit 65a25d9f7ac02e0cf361356e834d1c71d36acca9 upstream.
>     
>     The test_event_printk() code makes sure that when a trace event is
>     registered, any dereferenced pointers in from the event's
> TP_printk() are
>     pointing to content in the ring buffer. But currently it does not
> handle
>     "%s", as there's cases where the string pointer saved in the ring
> buffer
>     points to a static string in the kernel that will never be freed.
> As that
>     is a valid case, the pointer needs to be checked at runtime.
>     
>     Currently the runtime check is done via trace_check_vprintf(), but
> to not
>     have to replicate everything in vsnprintf() it does some logic with
> the
>     va_list that may not be reliable across architectures. In order to
> get rid
>     of that logic, more work in the test_event_printk() needs to be
> done. Some
>     of the strings can be validated at this time when it is obvious the
> string
>     is valid because the string will be saved in the ring buffer
> content.
>     
>     Do all the validation of strings in the ring buffer at boot in
>     test_event_printk(), and make sure that the field of the strings
> that
>     point into the kernel are accessible. This will allow adding checks
> at
>     runtime that will validate the fields themselves and not rely on
> paring
>     the TP_printk() format at runtime.
>     
>     Cc: stable@vger.kernel.org
>     Cc: Masami Hiramatsu <mhiramat@kernel.org>
>     Cc: Mark Rutland <mark.rutland@arm.com>
>     Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
>     Cc: Andrew Morton <akpm@linux-foundation.org>
>     Cc: Al Viro <viro@ZenIV.linux.org.uk>
>     Cc: Linus Torvalds <torvalds@linux-foundation.org>
>     Link: https://lore.kernel.org/20241217024720.685917008@goodmis.org
>     Fixes: 5013f454a352c ("tracing: Add check of trace event print fmts
> for dereferencing pointers")
>     Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
>     Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> 
>  kernel/trace/trace_events.c | 104
> +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++----
> --------
>  1 file changed, 89 insertions(+), 15 deletions(-)
> 
> 3) The git bisect log is:
> 
>    git bisect start
>    # status: waiting for both good and bad commits
>    # good: [e9d65b48ce1aba50e9ec7eab6d9f73d1ba88420e] Linux 6.12.6
>    git bisect good e9d65b48ce1aba50e9ec7eab6d9f73d1ba88420e
>    # bad: [319addc2ad901dac4d6cc931d77ef35073e0942f] Linux 6.12.7
>    git bisect bad 319addc2ad901dac4d6cc931d77ef35073e0942f
>    # good: [ced29f2149c9b65ca01008ba64d9db993ad8fad1] USB: serial:
>    option: add Telit FE910C04 rmnet compositions
>    git bisect good ced29f2149c9b65ca01008ba64d9db993ad8fad1
>    # good: [b2f23a1c7181f8c562ea06d3ea14879334d6bdf4] drm/amdgpu/gfx12:
>    fix IP version check
>    git bisect good b2f23a1c7181f8c562ea06d3ea14879334d6bdf4
>    # bad: [2976661ed4de10bd1945e7cca0d7363b44f240dd] of/irq: Fix
>    interrupt-map cell length check in of_irq_parse_imap_parent()
>    git bisect bad 2976661ed4de10bd1945e7cca0d7363b44f240dd
>    # good: [3985cd30472a6a67bfe3f0b42ad23b59fa824033] tracing: Fix
>    test_event_printk() to process entire print argument
>    git bisect good 3985cd30472a6a67bfe3f0b42ad23b59fa824033
>    # bad: [416226eb3f3a3008456903fc3695b0efa8ceafa1] selftests/bpf: Use
>    asm constraint "m" for LoongArch
>    git bisect bad 416226eb3f3a3008456903fc3695b0efa8ceafa1
>    # bad: [683eccacc02d2eb25d1c34b8fb0363fcc7e08f64] tracing: Add "%s"
>    check in test_event_printk()
>    git bisect bad 683eccacc02d2eb25d1c34b8fb0363fcc7e08f64
>    # good: [71a613ceac1ad6235e164aea34abcddb258296af] tracing: Add
>    missing helper functions in event pointer dereference check
>    git bisect good 71a613ceac1ad6235e164aea34abcddb258296af
>    # first bad commit: [683eccacc02d2eb25d1c34b8fb0363fcc7e08f64]
>    tracing: Add "%s" check in test_event_printk()
>    
> 

Re: [REGRESSION][BISECTED] Re: 6.12.7 stable new error: event xe_bo_move has unsafe dereference of argument 4

[Steven Rostedt]

On Mon, 30 Dec 2024 14:13:29 -0500
Steven Rostedt <rostedt@goodmis.org> wrote:

> I guess the "fix" would be to have the check code ignore pointer to
> arrays, assuming they are "ok".

Can you try this patch?

-- Steve

diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 1545cc8b49d0..770e7ed91716 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -364,6 +364,18 @@ static bool process_string(const char *fmt, int len, struct trace_event_call *ca
 		s = r + 1;
 	} while (s < e);
 
+	/*
+	 * Check for arrays. If the argument has: foo[REC->val]
+	 * then it is very likely that foo is an array of strings
+	 * that are safe to use.
+	 */
+	r = strstr(s, "[");
+	if (r && r < e) {
+		r = strstr(r, "REC->");
+		if (r && r < e)
+			return true;
+	}
+
 	/*
 	 * If there's any strings in the argument consider this arg OK as it
 	 * could be: REC->field ? "foo" : "bar" and we don't want to get into

Re: [REGRESSION][BISECTED] Re: 6.12.7 stable new error: event xe_bo_move has unsafe dereference of argument 4

[Genes Lists]

[-- Attachment #1: Type: text/plain, Size: 348 bytes --]

On Mon, 2024-12-30 at 14:50 -0500, Steven Rostedt wrote:
> On Mon, 30 Dec 2024 14:13:29 -0500
> Steven Rostedt <rostedt@goodmis.org> wrote:
> 
> > I guess the "fix" would be to have the check code ignore pointer to
> > arrays, assuming they are "ok".
> 
> Can you try this patch?

Yep will do.  Will report back shortly.


-- 
Gene


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [REGRESSION][BISECTED] Re: 6.12.7 stable new error: event xe_bo_move has unsafe dereference of argument 4

[Genes Lists]

[-- Attachment #1.1: Type: text/plain, Size: 478 bytes --]

On Mon, 2024-12-30 at 14:50 -0500, Steven Rostedt wrote:
> On Mon, 30 Dec 2024 14:13:29 -0500
> Steven Rostedt <rostedt@goodmis.org> wrote:
> 
> > I guess the "fix" would be to have the check code ignore pointer to
> > arrays, assuming they are "ok".
> 
> Can you try this patch?
> 
> -- Steve

Confirmed - all quiet now with 6.12.7 + your patch - I can test
mainline too but doesn't look that useful.

Thank you for sorting this out so quickly.


-- 
Gene


[-- Attachment #1.2: Type: text/html, Size: 1308 bytes --]

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [REGRESSION][BISECTED] Re: 6.12.7 stable new error: event xe_bo_move has unsafe dereference of argument 4

[Steven Rostedt]

On Mon, 30 Dec 2024 15:52:14 -0500
Genes Lists <lists@sapience.com> wrote:

> On Mon, 2024-12-30 at 14:50 -0500, Steven Rostedt wrote:
> > On Mon, 30 Dec 2024 14:13:29 -0500
> > Steven Rostedt <rostedt@goodmis.org> wrote:
> >   
> > > I guess the "fix" would be to have the check code ignore pointer to
> > > arrays, assuming they are "ok".  
> > 
> > Can you try this patch?
> > 
> > -- Steve  
> 
> Confirmed - all quiet now with 6.12.7 + your patch - I can test
> mainline too but doesn't look that useful.
> 
> Thank you for sorting this out so quickly.
> 
> 

I'll start making it into an official patch. Can I add your "Tested-by" to it?

-- Steve

Re: [REGRESSION][BISECTED] Re: 6.12.7 stable new error: event xe_bo_move has unsafe dereference of argument 4

[Genes Lists]

[-- Attachment #1: Type: text/plain, Size: 257 bytes --]

On Mon, 2024-12-30 at 16:03 -0500, Steven Rostedt wrote:
> > 
> 
> I'll start making it into an official patch. Can I add your "Tested-
> by" to it?
> 
> -- Steve
Terrific thank you and sure:
 Tested-by: Gene C <arch@sapience.com>


-- 
Gene


[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [REGRESSION][BISECTED] Re: 6.12.7 stable new error: event xe_bo_move has unsafe dereference of argument 4

[Thomas Hellström]

Hi!

On Mon, 2024-12-30 at 16:07 -0500, Genes Lists wrote:
> On Mon, 2024-12-30 at 16:03 -0500, Steven Rostedt wrote:
> > > 
> > 
> > I'll start making it into an official patch. Can I add your
> > "Tested-
> > by" to it?
> > 
> > -- Steve
> Terrific thank you and sure:
>  Tested-by: Gene C <arch@sapience.com>
> 
> 

FWIW, we actually worked around this during the holiday in the drm-xe-
next branch in the xe driver since it was breaking our CI. Was planning
to include it for drm-xe-fixes for tomorrow. Since xe appeared to be
the only driver hitting this, our assumption was that it'd be better
fixed in the driver.

Thanks,
Thomas

Re: [REGRESSION][BISECTED] Re: 6.12.7 stable new error: event xe_bo_move has unsafe dereference of argument 4

[Steven Rostedt]

On Wed, 01 Jan 2025 21:55:26 +0100
Thomas Hellström <thomas.hellstrom@linux.intel.com> wrote:

> FWIW, we actually worked around this during the holiday in the drm-xe-
> next branch in the xe driver since it was breaking our CI. Was planning
> to include it for drm-xe-fixes for tomorrow. Since xe appeared to be
> the only driver hitting this, our assumption was that it'd be better
> fixed in the driver.

The driver wasn't broken. I changed the verifier and it incorrectly
flagged that driver's trace event as unsafe. Yeah, it's the only driver
to use an array of strings, but it doesn't mean it was wrong.

-- Steve

[REGRESSION][BISECTED] Re: 6.12.7 stable new error: event xe_bo_move has unsafe dereference of argument 4

[Andrea Amorosi]

Hi to all,

I've just updated my archlinux to |6.12.8-arch1-1 and I still get the 
same issue:|

|gen 04 18:01:34 D9330 kernel: ------------[ cut here ]------------
gen 04 18:01:34 D9330 kernel: WARNING: CPU: 2 PID: 209 at 
kernel/trace/trace_events.c:577 trace_event_raw_init+0x159/0x660
gen 04 18:01:34 D9330 kernel: Modules linked in: xe(+) drm_ttm_helper 
gpu_sched drm_suballoc_helper drm_gpuvm drm_exec uas usb_storage i915 
i2c_algo_bit drm_buddy ttm serio_raw atkbd intel>
gen 04 18:01:34 D9330 kernel: CPU: 2 UID: 0 PID: 209 Comm: (udev-worker) 
Not tainted 6.12.8-arch1-1 #1 099de49ddaebb26408f097c48b36e50b2c8e21c9
gen 04 18:01:34 D9330 kernel: Hardware name: Dell Inc. Latitude 
9330/0RN079, BIOS 1.25.0 11/12/2024
gen 04 18:01:34 D9330 kernel: RIP: 0010:trace_event_raw_init+0x159/0x660
gen 04 18:01:34 D9330 kernel: Code: 89 ea 0f 83 3b 04 00 00 e8 44 db ff 
ff 84 c0 74 10 8b 0c 24 48 c7 c0 fe ff ff ff 48 d3 c0 49 21 c6 4d 85 f6 
0f 84 d6 fe ff ff <0f> 0b bb 01 00 00 00 41 >
gen 04 18:01:34 D9330 kernel: RSP: 0018:ffffa9b940987730 EFLAGS: 00010206
gen 04 18:01:34 D9330 kernel: RAX: ffffffffffffffdf RBX: 
ffffffffc0ca4731 RCX: 0000000000000005
gen 04 18:01:34 D9330 kernel: RDX: 0000000000000002 RSI: 
0000000000000001 RDI: ffffffffc0ca4727
gen 04 18:01:34 D9330 kernel: RBP: ffffffffc0ca4640 R08: 
0000000000000039 R09: 0000000000000000
gen 04 18:01:34 D9330 kernel: R10: 0000000000000076 R11: 
000000000000004e R12: 00000000000000f2
gen 04 18:01:34 D9330 kernel: R13: ffffffffc0ca5760 R14: 
0000000000000018 R15: 0000000000000000
gen 04 18:01:34 D9330 kernel: FS:  00007ba0e9fe9880(0000) 
GS:ffff9d957f500000(0000) knlGS:0000000000000000
gen 04 18:01:34 D9330 kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 
0000000080050033
gen 04 18:01:34 D9330 kernel: CR2: 00007ba0e9dac000 CR3: 
00000001019ac000 CR4: 0000000000f50ef0
gen 04 18:01:34 D9330 kernel: PKRU: 55555554
gen 04 18:01:34 D9330 kernel: Call Trace:
gen 04 18:01:34 D9330 kernel:  <TASK>
gen 04 18:01:34 D9330 kernel:  ? trace_event_raw_init+0x159/0x660
gen 04 18:01:34 D9330 kernel:  ? __warn.cold+0x93/0xf6
gen 04 18:01:34 D9330 kernel:  ? trace_event_raw_init+0x159/0x660
gen 04 18:01:34 D9330 kernel:  ? report_bug+0xff/0x140
gen 04 18:01:34 D9330 kernel:  ? handle_bug+0x58/0x90
gen 04 18:01:34 D9330 kernel:  ? exc_invalid_op+0x17/0x70
gen 04 18:01:34 D9330 kernel:  ? asm_exc_invalid_op+0x1a/0x20
gen 04 18:01:34 D9330 kernel:  ? trace_event_raw_init+0x159/0x660
gen 04 18:01:34 D9330 kernel:  event_init+0x28/0x70
gen 04 18:01:34 D9330 kernel:  trace_module_notify+0x1a4/0x260
gen 04 18:01:34 D9330 kernel:  notifier_call_chain+0x5a/0xd0
gen 04 18:01:34 D9330 kernel: blocking_notifier_call_chain_robust+0x65/0xc0
gen 04 18:01:34 D9330 kernel:  load_module+0x1822/0x1cf0
gen 04 18:01:34 D9330 kernel:  ? vmap+0x83/0xe0
gen 04 18:01:34 D9330 kernel:  ? __vunmap_range_noflush+0x325/0x470
gen 04 18:01:34 D9330 kernel:  ? init_module_from_file+0x89/0xe0
gen 04 18:01:34 D9330 kernel:  init_module_from_file+0x89/0xe0
gen 04 18:01:34 D9330 kernel: idempotent_init_module+0x11e/0x310
gen 04 18:01:34 D9330 kernel:  __x64_sys_finit_module+0x5e/0xb0
gen 04 18:01:34 D9330 kernel:  do_syscall_64+0x82/0x190
gen 04 18:01:34 D9330 kernel:  ? vfs_read+0x299/0x370
gen 04 18:01:34 D9330 kernel:  ? syscall_exit_to_user_mode+0x37/0x1c0
gen 04 18:01:34 D9330 kernel:  ? do_syscall_64+0x8e/0x190
gen 04 18:01:34 D9330 kernel:  ? terminate_walk+0xee/0x100
gen 04 18:01:34 D9330 kernel:  ? path_openat+0x495/0x12e0
gen 04 18:01:34 D9330 kernel:  ? syscall_exit_to_user_mode+0x37/0x1c0
gen 04 18:01:34 D9330 kernel:  ? do_syscall_64+0x8e/0x190
gen 04 18:01:34 D9330 kernel:  ? do_filp_open+0xc4/0x170
gen 04 18:01:34 D9330 kernel:  ? __pfx_page_put_link+0x10/0x10
gen 04 18:01:34 D9330 kernel:  ? do_sys_openat2+0x9c/0xe0
gen 04 18:01:34 D9330 kernel:  ? syscall_exit_to_user_mode+0x37/0x1c0
gen 04 18:01:34 D9330 kernel:  ? do_syscall_64+0x8e/0x190
gen 04 18:01:34 D9330 kernel:  ? do_syscall_64+0x8e/0x190
gen 04 18:01:34 D9330 kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e
gen 04 18:01:34 D9330 kernel: RIP: 0033:0x7ba0ea7e01fd
gen 04 18:01:34 D9330 kernel: Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 
90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 
8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 >
gen 04 18:01:34 D9330 kernel: RSP: 002b:00007ffe5dee8d58 EFLAGS: 
00000246 ORIG_RAX: 0000000000000139
gen 04 18:01:34 D9330 kernel: RAX: ffffffffffffffda RBX: 
00005f717b3029c0 RCX: 00007ba0ea7e01fd
gen 04 18:01:34 D9330 kernel: RDX: 0000000000000004 RSI: 
00007ba0e9fe305d RDI: 0000000000000031
gen 04 18:01:34 D9330 kernel: RBP: 00007ffe5dee8e10 R08: 
0000000000000001 R09: 00007ffe5dee8da0
gen 04 18:01:34 D9330 kernel: R10: 0000000000000040 R11: 
0000000000000246 R12: 00007ba0e9fe305d
gen 04 18:01:34 D9330 kernel: R13: 0000000000020000 R14: 
00005f717b303600 R15: 00005f717b304360
gen 04 18:01:34 D9330 kernel:  </TASK>
gen 04 18:01:34 D9330 kernel: ---[ end trace 0000000000000000 ]---
gen 04 18:01:34 D9330 kernel: event xe_bo_move has unsafe dereference of 
argument 4
gen 04 18:01:34 D9330 kernel: print_fmt: "move_lacks_source:%s, migrate 
object %p [size %zu] from %s to %s device_id:%s", REC->move_lacks_source 
? "yes" : "no", REC->bo, REC->size, xe_mem_>|

|
|

|Later I get this other one which I do not know if it is related to the 
previous one or not:|

|gen 04 18:01:45 D9330 kernel: ------------[ cut here ]------------
gen 04 18:01:45 D9330 kernel: WARNING: CPU: 7 PID: 139 at 
drivers/usb/typec/ucsi/ucsi.c:1361 ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi]
gen 04 18:01:45 D9330 kernel: Modules linked in: fat kvm_intel 
snd_soc_core mei_vsc snd_compress spi_pxa2xx_platform intel_ishtp_hid 
iwlmvm dell_rbtn hid_multitouch dw_dmac ac97_bus moused>
gen 04 18:01:45 D9330 kernel:  processor_thermal_rapl cfg80211 ucsi_acpi 
soundcore mei_me intel_rapl_common intel_lpss_pci i2c_mux typec_ucsi 
thunderbolt intel_lpss mei processor_thermal_w>
gen 04 18:01:45 D9330 kernel:  video cec spi_intel nvme_auth i8042 wmi serio
gen 04 18:01:45 D9330 kernel: CPU: 7 UID: 0 PID: 139 Comm: kworker/7:1 
Tainted: G        W  OE      6.12.8-arch1-1 #1 
099de49ddaebb26408f097c48b36e50b2c8e21c9
gen 04 18:01:45 D9330 kernel: Tainted: [W]=WARN, [O]=OOT_MODULE, 
[E]=UNSIGNED_MODULE
gen 04 18:01:45 D9330 kernel: Hardware name: Dell Inc. Latitude 
9330/0RN079, BIOS 1.25.0 11/12/2024
gen 04 18:01:45 D9330 kernel: Workqueue: events_long ucsi_init_work 
[typec_ucsi]
gen 04 18:01:45 D9330 kernel: RIP: 0010:ucsi_reset_ppm+0x1b4/0x1c0 
[typec_ucsi]
gen 04 18:01:45 D9330 kernel: Code: 8b 44 24 04 a9 00 00 00 08 0f 85 36 
ff ff ff 4c 89 74 24 10 48 8b 05 cb be 59 cf 49 39 c5 79 8f bb 92 ff ff 
ff e9 1b ff ff ff <0f> 0b e9 50 ff ff ff e8 >
gen 04 18:01:45 D9330 kernel: RSP: 0018:ffffa9b9407bfda8 EFLAGS: 00010206
gen 04 18:01:45 D9330 kernel: RAX: 0000000008000000 RBX: 
0000000000000000 RCX: 0000000000000002
gen 04 18:01:45 D9330 kernel: RDX: 00000000fffeaba3 RSI: 
ffffa9b9407bfdac RDI: ffff9d92089d7800
gen 04 18:01:45 D9330 kernel: RBP: ffff9d92089d7800 R08: 
0000000000000000 R09: 0000000000000014
gen 04 18:01:45 D9330 kernel: R10: 0000000000000001 R11: 
0000000000000000 R12: ffffa9b9407bfdac
gen 04 18:01:45 D9330 kernel: R13: 00000000fffeaba0 R14: 
ffff9d92089d7860 R15: ffff9d92089d78c0
gen 04 18:01:45 D9330 kernel: FS:  0000000000000000(0000) 
GS:ffff9d957f780000(0000) knlGS:0000000000000000
gen 04 18:01:45 D9330 kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 
0000000080050033
gen 04 18:01:45 D9330 kernel: CR2: 0000585143bba648 CR3: 
000000023a822000 CR4: 0000000000f50ef0
gen 04 18:01:45 D9330 kernel: PKRU: 55555554
gen 04 18:01:45 D9330 kernel: Call Trace:
gen 04 18:01:45 D9330 kernel:  <TASK>
gen 04 18:01:45 D9330 kernel:  ? ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi 
97866a6a8562a088cda45de0ae83658868b451bb]
gen 04 18:01:45 D9330 kernel:  ? __warn.cold+0x93/0xf6
gen 04 18:01:45 D9330 kernel:  ? ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi 
97866a6a8562a088cda45de0ae83658868b451bb]
gen 04 18:01:45 D9330 kernel:  ? report_bug+0xff/0x140
gen 04 18:01:45 D9330 kernel:  ? handle_bug+0x58/0x90
gen 04 18:01:45 D9330 kernel:  ? exc_invalid_op+0x17/0x70
gen 04 18:01:45 D9330 kernel:  ? asm_exc_invalid_op+0x1a/0x20
gen 04 18:01:45 D9330 kernel:  ? ucsi_reset_ppm+0x1b4/0x1c0 [typec_ucsi 
97866a6a8562a088cda45de0ae83658868b451bb]
gen 04 18:01:45 D9330 kernel:  ? ucsi_reset_ppm+0xc6/0x1c0 [typec_ucsi 
97866a6a8562a088cda45de0ae83658868b451bb]
gen 04 18:01:45 D9330 kernel:  ucsi_init_work+0x3c/0xac0 [typec_ucsi 
97866a6a8562a088cda45de0ae83658868b451bb]
gen 04 18:01:45 D9330 kernel:  process_one_work+0x17b/0x330
gen 04 18:01:45 D9330 kernel:  worker_thread+0x2ce/0x3f0
gen 04 18:01:45 D9330 kernel:  ? __pfx_worker_thread+0x10/0x10
gen 04 18:01:45 D9330 kernel:  kthread+0xcf/0x100
gen 04 18:01:45 D9330 kernel:  ? __pfx_kthread+0x10/0x10
gen 04 18:01:45 D9330 kernel:  ret_from_fork+0x31/0x50
gen 04 18:01:45 D9330 kernel:  ? __pfx_kthread+0x10/0x10
gen 04 18:01:45 D9330 kernel:  ret_from_fork_asm+0x1a/0x30
gen 04 18:01:45 D9330 kernel:  </TASK>
gen 04 18:01:45 D9330 kernel: ---[ end trace 0000000000000000 ]---
|

|
|

|
|

Re: [REGRESSION][BISECTED] Re: 6.12.7 stable new error: event xe_bo_move has unsafe dereference of argument 4

[Genes Lists]

[-- Attachment #1.1: Type: text/plain, Size: 393 bytes --]

On Sat, 2025-01-04 at 18:43 +0100, Andrea Amorosi wrote:
> Hi to all,
> 
> I've just updated my archlinux to |6.12.8-arch1-1 and I still get the
> same issue:|
> 
> 
Right - 6.12.8 (and Arch build of same) does not have Steve Rostedt's
patch.
The patch is in mainline and I believe it will be in 6.12.9.

Since the warning logged is a false positive it is benign.


-- 
Gene


[-- Attachment #1.2: Type: text/html, Size: 1129 bytes --]

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

Re: [REGRESSION][BISECTED] Re: 6.12.7 stable new error: event xe_bo_move has unsafe dereference of argument 4

[Steven Rostedt]

On Sat, 04 Jan 2025 15:09:10 -0500
Genes Lists <lists@sapience.com> wrote:

> On Sat, 2025-01-04 at 18:43 +0100, Andrea Amorosi wrote:
> > Hi to all,
> > 
> > I've just updated my archlinux to |6.12.8-arch1-1 and I still get the
> > same issue:|
> > 
> >   
> Right - 6.12.8 (and Arch build of same) does not have Steve Rostedt's
> patch.
> The patch is in mainline and I believe it will be in 6.12.9.

For completeness, the patch in question is this:

  https://lore.kernel.org/20241231000646.324fb5f7@gandalf.local.home

-- Steve


> 
> Since the warning logged is a false positive it is benign.
> 
>