Attachment 145387 Details for Bug 111682 – dmesg when using cfdabd064b2d(drm/amdgpu: remove the redundant null checks)

dmesg when using cfdabd064b2d(drm/amdgpu: remove the redundant null checks)

dmesg (text/plain), 12.10 KB, created by Pierre-Eric Pelloux-Prayer on 2019-09-17 07:18:52 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Pierre-Eric Pelloux-Prayer

Created: 2019-09-17 07:18:52 UTC

Size: 12.10 KB

patch

obsolete

>[ 1908.329674] BUG: KASAN: use-after-free in amdgpu_vm_update_directories+0x224/0x540 [amdgpu]
>[ 1908.329678] Read of size 8 at addr ffff8886a3737290 by task Xorg/1454
>
>[ 1908.329684] CPU: 0 PID: 1454 Comm: Xorg Tainted: G        W   E     5.2.0-rc1-g04430fc3cbe3-dirty #23
>[ 1908.329686] Hardware name: Gigabyte Technology Co., Ltd. X470 AORUS ULTRA GAMING/X470 AORUS ULTRA GAMING-CF, BIOS F6 01/25/2019
>[ 1908.329688] Call Trace:
>[ 1908.329693]  dump_stack+0x71/0xa0
>[ 1908.329889]  ? amdgpu_vm_update_directories+0x224/0x540 [amdgpu]
>[ 1908.329892]  print_address_description+0x65/0x22e
>[ 1908.330086]  ? amdgpu_vm_update_directories+0x224/0x540 [amdgpu]
>[ 1908.330280]  ? amdgpu_vm_update_directories+0x224/0x540 [amdgpu]
>[ 1908.330282]  __kasan_report.cold.3+0x1a/0x3d
>[ 1908.330477]  ? amdgpu_vm_update_directories+0x224/0x540 [amdgpu]
>[ 1908.330479]  kasan_report+0xe/0x20
>[ 1908.330672]  amdgpu_vm_update_directories+0x224/0x540 [amdgpu]
>[ 1908.330867]  ? amdgpu_vm_map_gart+0x30/0x30 [amdgpu]
>[ 1908.330870]  ? _raw_spin_lock+0x7a/0xd0
>[ 1908.330872]  ? _raw_spin_lock_irqsave+0xf0/0xf0
>[ 1908.331062]  ? amdgpu_mm_wreg+0xc2/0x220 [amdgpu]
>[ 1908.331066]  ? __list_del_entry_valid+0x64/0x7c
>[ 1908.331259]  ? amdgpu_vm_bo_update+0x80b/0xcd0 [amdgpu]
>[ 1908.331453]  amdgpu_gem_va_ioctl+0x716/0x830 [amdgpu]
>[ 1908.331646]  ? amdgpu_gem_metadata_ioctl+0x250/0x250 [amdgpu]
>[ 1908.331649]  ? refcount_dec_if_one+0xb0/0xb0
>[ 1908.331842]  ? amdgpu_gem_object_open+0x1d5/0x230 [amdgpu]
>[ 1908.332042]  ? amdgpu_gem_create_ioctl+0x2c8/0x3f0 [amdgpu]
>[ 1908.332235]  ? amdgpu_gem_object_close+0x300/0x300 [amdgpu]
>[ 1908.332239]  ? __vm_insert_mixed+0x153/0x1a0
>[ 1908.332271]  ? drm_dbg+0xa3/0x140 [drm]
>[ 1908.332468]  ? amdgpu_gem_metadata_ioctl+0x250/0x250 [amdgpu]
>[ 1908.332500]  drm_ioctl_kernel+0x14d/0x1a0 [drm]
>[ 1908.332532]  ? drm_setversion+0x330/0x330 [drm]
>[ 1908.332535]  ? check_stack_object+0x22/0x60
>[ 1908.332567]  drm_ioctl+0x333/0x560 [drm]
>[ 1908.332764]  ? amdgpu_gem_metadata_ioctl+0x250/0x250 [amdgpu]
>[ 1908.332795]  ? drm_version+0x150/0x150 [drm]
>[ 1908.332799]  ? rpm_resume+0x13f/0xab0
>[ 1908.332801]  ? rpm_put_suppliers+0x80/0x80
>[ 1908.332804]  ? _raw_spin_lock_irqsave+0x8d/0xf0
>[ 1908.332806]  ? _raw_write_lock_irqsave+0xe0/0xe0
>[ 1908.333000]  amdgpu_drm_ioctl+0x76/0xd0 [amdgpu]
>[ 1908.333004]  do_vfs_ioctl+0x137/0x8f0
>[ 1908.333007]  ? ioctl_preallocate+0x140/0x140
>[ 1908.333010]  ? __fget+0x14c/0x1b0
>[ 1908.333012]  ? copy_fd_bitmaps+0x110/0x110
>[ 1908.333015]  ? __count_memcg_events.part.50+0xd2/0x100
>[ 1908.333018]  ksys_ioctl+0x60/0x90
>[ 1908.333021]  __x64_sys_ioctl+0x3d/0x50
>[ 1908.333024]  do_syscall_64+0x73/0x170
>[ 1908.333027]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
>[ 1908.333029] RIP: 0033:0x7f72e1128427
>[ 1908.333032] Code: 00 00 90 48 8b 05 69 aa 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 39 aa 0c 00 f7 d8 64 89 01 48
>[ 1908.333033] RSP: 002b:00007ffec5992e18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
>[ 1908.333036] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f72e1128427
>[ 1908.333038] RDX: 00007ffec5992e60 RSI: 00000000c0286448 RDI: 000000000000000d
>[ 1908.333039] RBP: 00007ffec5992e40 R08: ffff800100c00000 R09: 000000000000000e
>[ 1908.333040] R10: 0000000000000035 R11: 0000000000000246 R12: 00007ffec5992e60
>[ 1908.333041] R13: 00000000c0286448 R14: 000000000000000d R15: 0000000000200000
>
>[ 1908.333045] Allocated by task 1454:
>[ 1908.333050]  save_stack+0x19/0x80
>[ 1908.333052]  __kasan_kmalloc.constprop.12+0xc1/0xd0
>[ 1908.333247]  amdgpu_bo_do_create+0x225/0x7a0 [amdgpu]
>[ 1908.333442]  amdgpu_bo_create+0x96/0x3f0 [amdgpu]
>[ 1908.333639]  amdgpu_vm_update_ptes+0x42b/0xa00 [amdgpu]
>[ 1908.333836]  amdgpu_vm_bo_update_mapping+0x159/0x1a0 [amdgpu]
>[ 1908.334033]  amdgpu_vm_bo_update+0x5b1/0xcd0 [amdgpu]
>[ 1908.334229]  amdgpu_gem_va_ioctl+0x804/0x830 [amdgpu]
>[ 1908.334260]  drm_ioctl_kernel+0x14d/0x1a0 [drm]
>[ 1908.334291]  drm_ioctl+0x333/0x560 [drm]
>[ 1908.334484]  amdgpu_drm_ioctl+0x76/0xd0 [amdgpu]
>[ 1908.334486]  do_vfs_ioctl+0x137/0x8f0
>[ 1908.334488]  ksys_ioctl+0x60/0x90
>[ 1908.334490]  __x64_sys_ioctl+0x3d/0x50
>[ 1908.334492]  do_syscall_64+0x73/0x170
>[ 1908.334494]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
>[ 1908.334496] Freed by task 552:
>[ 1908.334500]  save_stack+0x19/0x80
>[ 1908.334502]  __kasan_slab_free+0x125/0x170
>[ 1908.334504]  kfree+0x90/0x1d0
>[ 1908.334513]  ttm_bo_release_list+0x212/0x270 [ttm]
>[ 1908.334522]  ttm_bo_delayed_delete+0x129/0x320 [ttm]
>[ 1908.334530]  ttm_bo_delayed_workqueue+0x17/0x50 [ttm]
>[ 1908.334533]  process_one_work+0x382/0x6c0
>[ 1908.334535]  worker_thread+0x57/0x5b0
>[ 1908.334537]  kthread+0x1ae/0x1d0
>[ 1908.334538]  ret_from_fork+0x22/0x40
>
>[ 1908.334541] The buggy address belongs to the object at ffff8886a3736e80
>                which belongs to the cache kmalloc-2k of size 2048
>[ 1908.334545] The buggy address is located 1040 bytes inside of
>                2048-byte region [ffff8886a3736e80, ffff8886a3737680)
>[ 1908.334547] The buggy address belongs to the page:
>[ 1908.334550] page:ffffea001a8dcc00 refcount:1 mapcount:0 mapping:ffff88877dc0ea00 index:0x0 compound_mapcount: 0
>[ 1908.334553] flags: 0x17fffc000010200(slab|head)
>[ 1908.334557] raw: 017fffc000010200 dead000000000100 dead000000000200 ffff88877dc0ea00
>[ 1908.334559] raw: 0000000000000000 00000000000f000f 00000001ffffffff 0000000000000000
>[ 1908.334560] page dumped because: kasan: bad access detected
>
>[ 1908.334562] Memory state around the buggy address:
>[ 1908.334565]  ffff8886a3737180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>[ 1908.334567]  ffff8886a3737200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>[ 1908.334570] >ffff8886a3737280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>[ 1908.334572]                          ^
>[ 1908.334574]  ffff8886a3737300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>[ 1908.334577]  ffff8886a3737380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>[ 1908.334578] ==================================================================
>[ 1908.334580] Disabling lock debugging due to kernel taint
>[ 1908.334672] BUG: kernel NULL pointer dereference, address: 0000000000000008
>[ 1908.334679] #PF: supervisor read access in kernel mode
>[ 1908.334683] #PF: error_code(0x0000) - not-present page
>[ 1908.334688] PGD 0 P4D 0 
>[ 1908.334697] Oops: 0000 [#1] SMP KASAN NOPTI
>[ 1908.334704] CPU: 0 PID: 1454 Comm: Xorg Tainted: G    B   W   E     5.2.0-rc1-g04430fc3cbe3-dirty #23
>[ 1908.334709] Hardware name: Gigabyte Technology Co., Ltd. X470 AORUS ULTRA GAMING/X470 AORUS ULTRA GAMING-CF, BIOS F6 01/25/2019
>[ 1908.334913] RIP: 0010:amdgpu_vm_update_directories+0x24e/0x540 [amdgpu]
>[ 1908.334920] Code: 49 8b 9f 10 04 00 00 48 85 db 74 13 48 8d bb c8 02 00 00 e8 74 6d 35 e4 48 8b 9b c8 02 00 00 48 8d 7b 08 31 ed e8 62 6d 35 e4 <4c> 8b 73 08 49 8d be 10 04 00 00 e8 52 6d 35 e4 49 8b 86 10 04 00
>[ 1908.334925] RSP: 0018:ffff8887575af708 EFLAGS: 00010246
>[ 1908.334933] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffc0e3d77e
>[ 1908.334937] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000008
>[ 1908.334942] RBP: 0000000000000000 R08: ffffed10efc440bd R09: ffffed10efc440bc
>[ 1908.334946] R10: ffffed10efc440bc R11: ffff88877e2205e7 R12: ffff88876e689980
>[ 1908.334958] R13: ffff88876e6899a0 R14: ffff888755520b78 R15: ffff8886a3736e80
>[ 1908.334964] FS:  00007f72e09e7f00(0000) GS:ffff88877e200000(0000) knlGS:0000000000000000
>[ 1908.334968] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>[ 1908.334973] CR2: 0000000000000008 CR3: 000000075763a000 CR4: 00000000003406f0
>[ 1908.334978] Call Trace:
>[ 1908.335182]  ? amdgpu_vm_map_gart+0x30/0x30 [amdgpu]
>[ 1908.335189]  ? _raw_spin_lock+0x7a/0xd0
>[ 1908.335196]  ? _raw_spin_lock_irqsave+0xf0/0xf0
>[ 1908.335395]  ? amdgpu_mm_wreg+0xc2/0x220 [amdgpu]
>[ 1908.335406]  ? __list_del_entry_valid+0x64/0x7c
>[ 1908.335608]  ? amdgpu_vm_bo_update+0x80b/0xcd0 [amdgpu]
>[ 1908.335812]  amdgpu_gem_va_ioctl+0x716/0x830 [amdgpu]
>[ 1908.336039]  ? amdgpu_gem_metadata_ioctl+0x250/0x250 [amdgpu]
>[ 1908.336048]  ? refcount_dec_if_one+0xb0/0xb0
>[ 1908.336243]  ? amdgpu_gem_object_open+0x1d5/0x230 [amdgpu]
>[ 1908.336453]  ? amdgpu_gem_create_ioctl+0x2c8/0x3f0 [amdgpu]
>[ 1908.336659]  ? amdgpu_gem_object_close+0x300/0x300 [amdgpu]
>[ 1908.336670]  ? __vm_insert_mixed+0x153/0x1a0
>[ 1908.336708]  ? drm_dbg+0xa3/0x140 [drm]
>[ 1908.336913]  ? amdgpu_gem_metadata_ioctl+0x250/0x250 [amdgpu]
>[ 1908.336950]  drm_ioctl_kernel+0x14d/0x1a0 [drm]
>[ 1908.336989]  ? drm_setversion+0x330/0x330 [drm]
>[ 1908.336995]  ? check_stack_object+0x22/0x60
>[ 1908.337031]  drm_ioctl+0x333/0x560 [drm]
>[ 1908.337236]  ? amdgpu_gem_metadata_ioctl+0x250/0x250 [amdgpu]
>[ 1908.337273]  ? drm_version+0x150/0x150 [drm]
>[ 1908.337282]  ? rpm_resume+0x13f/0xab0
>[ 1908.337289]  ? rpm_put_suppliers+0x80/0x80
>[ 1908.337294]  ? _raw_spin_lock_irqsave+0x8d/0xf0
>[ 1908.337297]  ? _raw_write_lock_irqsave+0xe0/0xe0
>[ 1908.337496]  amdgpu_drm_ioctl+0x76/0xd0 [amdgpu]
>[ 1908.337504]  do_vfs_ioctl+0x137/0x8f0
>[ 1908.337509]  ? ioctl_preallocate+0x140/0x140
>[ 1908.337512]  ? __fget+0x14c/0x1b0
>[ 1908.337515]  ? copy_fd_bitmaps+0x110/0x110
>[ 1908.337519]  ? __count_memcg_events.part.50+0xd2/0x100
>[ 1908.337525]  ksys_ioctl+0x60/0x90
>[ 1908.337532]  __x64_sys_ioctl+0x3d/0x50
>[ 1908.337537]  do_syscall_64+0x73/0x170
>[ 1908.337541]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
>[ 1908.337543] RIP: 0033:0x7f72e1128427
>[ 1908.337546] Code: 00 00 90 48 8b 05 69 aa 0c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 39 aa 0c 00 f7 d8 64 89 01 48
>[ 1908.337549] RSP: 002b:00007ffec5992e18 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
>[ 1908.337552] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f72e1128427
>[ 1908.337556] RDX: 00007ffec5992e60 RSI: 00000000c0286448 RDI: 000000000000000d
>[ 1908.337562] RBP: 00007ffec5992e40 R08: ffff800100c00000 R09: 000000000000000e
>[ 1908.337566] R10: 0000000000000035 R11: 0000000000000246 R12: 00007ffec5992e60
>[ 1908.337571] R13: 00000000c0286448 R14: 000000000000000d R15: 0000000000200000
>[ 1908.337576] Modules linked in: fuse(E) snd_hda_codec_realtek(E) snd_hda_codec_generic(E) ledtrig_audio(E) binfmt_misc(E) nls_ascii(E) nls_cp437(E) vfat(E) fat(E) snd_hda_codec_hdmi(E) efi_pstore(E) snd_hda_intel(E) snd_hda_codec(E) joydev(E) snd_hwdep(E) snd_hda_core(E) snd_pcm(E) pcspkr(E) snd_timer(E) efivars(E) k10temp(E) ccp(E) snd(E) sg(E) sp5100_tco(E) soundcore(E) rng_core(E) wmi_bmof(E) mxm_wmi(E) pcc_cpufreq(E) evdev(E) wmi(E) button(E) acpi_cpufreq(E) parport_pc(E) ppdev(E) lp(E) parport(E) efivarfs(E) ip_tables(E) x_tables(E) autofs4(E) ext4(E) crc32c_generic(E) crc16(E) mbcache(E) jbd2(E) algif_skcipher(E) af_alg(E) dm_crypt(E) dm_mod(E) hid_generic(E) usbhid(E) hid(E) sd_mod(E) crct10dif_pclmul(E) crc32_pclmul(E) crc32c_intel(E) ghash_clmulni_intel(E) amdgpu(E) gpu_sched(E) ttm(E) aesni_intel(E) ahci(E) aes_x86_64(E) xhci_pci(E) glue_helper(E) libahci(E) drm_kms_helper(E) crypto_simd(E) cryptd(E) xhci_hcd(E) libata(E) drm(E) igb(E) i2c_piix4(E) dca(E) usbcore(E) scsi_mod(E)
>[ 1908.337620]  i2c_algo_bit(E) gpio_amdpt(E) gpio_generic(E)
>[ 1908.337628] CR2: 0000000000000008
>[ 1908.337631] ---[ end trace ce347a45bce0f80d ]---
>[ 1908.554828] RIP: 0010:amdgpu_vm_update_directories+0x24e/0x540 [amdgpu]
>[ 1908.554833] Code: 49 8b 9f 10 04 00 00 48 85 db 74 13 48 8d bb c8 02 00 00 e8 74 6d 35 e4 48 8b 9b c8 02 00 00 48 8d 7b 08 31 ed e8 62 6d 35 e4 <4c> 8b 73 08 49 8d be 10 04 00 00 e8 52 6d 35 e4 49 8b 86 10 04 00
>[ 1908.554835] RSP: 0018:ffff8887575af708 EFLAGS: 00010246
>[ 1908.554838] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffc0e3d77e
>[ 1908.554840] RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000008
>[ 1908.554844] RBP: 0000000000000000 R08: ffffed10efc440bd R09: ffffed10efc440bc
>[ 1908.554846] R10: ffffed10efc440bc R11: ffff88877e2205e7 R12: ffff88876e689980
>[ 1908.554848] R13: ffff88876e6899a0 R14: ffff888755520b78 R15: ffff8886a3736e80
>[ 1908.554851] FS:  00007f72e09e7f00(0000) GS:ffff88877e200000(0000) knlGS:0000000000000000
>[ 1908.554853] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>[ 1908.554855] CR2: 0000000000000008 CR3: 000000075763a000 CR4: 00000000003406f0
>

Actions: View

Attachments on bug 111682: 145345 | 145387

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.