From: Anirudh Rayabharam <mail@anirudhrb.com>
To: kernel test robot <oliver.sang@intel.com>
Cc: Igor Matheus Andrade Torrente <igormtorrente@gmail.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Ferenc Bakonyi <fero@drama.obuda.kando.hu>,
Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>,
stable <stable@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
lkp@lists.01.org, lkp@intel.com
Subject: Re: [video] dc13cac486: BUG:KASAN:stack-out-of-bounds_in_hgafb_open
Date: Mon, 17 May 2021 00:33:26 +0530 [thread overview]
Message-ID: <YKFsfoaofqs1MQDw@anirudhrb.com> (raw)
In-Reply-To: <20210516150019.GB25903@xsang-OptiPlex-9020>
On Sun, May 16, 2021 at 11:00:19PM +0800, kernel test robot wrote:
>
>
> Greeting,
>
> FYI, we noticed the following commit (built with gcc-9):
>
> commit: dc13cac4862cc68ec74348a80b6942532b7735fa ("video: hgafb: fix potential NULL pointer dereference")
> https://git.kernel.org/cgit/linux/kernel/git/gregkh/char-misc.git char-misc-linus
>
>
> in testcase: trinity
> version: trinity-static-x86_64-x86_64-f93256fb_2019-08-28
> with following parameters:
>
> number: 99999
> group: group-02
>
> test-description: Trinity is a linux system call fuzz tester.
> test-url: http://codemonkey.org.uk/projects/trinity/
>
>
> on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
>
> caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
>
>
> +---------------------------------------------+------------+------------+
> | | 58c0cc2d90 | dc13cac486 |
> +---------------------------------------------+------------+------------+
> | boot_successes | 42 | 14 |
> | boot_failures | 0 | 34 |
> | BUG:KASAN:stack-out-of-bounds_in_hgafb_open | 0 | 34 |
> +---------------------------------------------+------------+------------+
>
>
> If you fix the issue, kindly add following tag
> Reported-by: kernel test robot <oliver.sang@intel.com>
>
>
> [ 419.568887] BUG: KASAN: stack-out-of-bounds in hgafb_open (kbuild/src/consumer/drivers/video/fbdev/hgafb.c:375)
Looks like the return value of hga_card_detect() is not properly
handled causing the probe function to succeed even though
hga_card_detect() has failed. Since probe has succeeded, hgafb_open()
can be called which will end up operating on an unmapped hga_vram.
Patch on the way.
Thanks!
- Anirudh.
prev parent reply other threads:[~2021-05-16 19:03 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-16 15:00 [video] dc13cac486: BUG:KASAN:stack-out-of-bounds_in_hgafb_open kernel test robot
2021-05-16 19:03 ` Anirudh Rayabharam [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YKFsfoaofqs1MQDw@anirudhrb.com \
--to=mail@anirudhrb.com \
--cc=b.zolnierkie@samsung.com \
--cc=fero@drama.obuda.kando.hu \
--cc=gregkh@linuxfoundation.org \
--cc=igormtorrente@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=lkp@intel.com \
--cc=lkp@lists.01.org \
--cc=oliver.sang@intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox