[drm/vmwgfx] invalid read access at vmw_du_primary_plane_atomic_check()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Code added by commit 060e2ad57041b42c ("drm/vmwgfx: Add and connect plane helper
functions") is hitting KASAN error shown below. I guess that either *vcs is
invalid or vcs->is_implicit is off-by-one.

----------
[   19.654429] Linux agpgart interface v0.103
[   19.657444] agpgart-intel 0000:00:00.0: Intel 440BX Chipset
[   19.661704] agpgart-intel 0000:00:00.0: AGP aperture is 256M @ 0x0
[   19.694269] [drm] DMA map mode: Using physical TTM page addresses.
[   19.696460] [drm] Capabilities:
[   19.697595] [drm]   Rect copy.
[   19.698678] [drm]   Cursor.
[   19.699661] [drm]   Cursor bypass.
[   19.700835] [drm]   Cursor bypass 2.
[   19.702044] [drm]   8bit emulation.
[   19.703331] [drm]   Alpha cursor.
[   19.704446] [drm]   Extended Fifo.
[   19.705537] [drm]   Multimon.
[   19.706546] [drm]   Pitchlock.
[   19.707671] [drm]   Irq mask.
[   19.708676] [drm]   Display Topology.
[   19.710023] [drm]   GMR.
[   19.710972] [drm]   Traces.
[   19.711971] [drm]   GMR2.
[   19.712897] [drm]   Screen Object 2.
[   19.714082] [drm]   Command Buffers.
[   19.715315] [drm] Max GMR ids is 64
[   19.716496] [drm] Max number of GMR pages is 196608
[   19.718127] [drm] Max dedicated hypervisor surface memory is 786432 kiB
[   19.720173] [drm] Maximum display memory size is 32768 kiB
[   19.721999] [drm] VRAM at 0xe8000000 size is 32768 kiB
[   19.723672] [drm] MMIO at 0xfe000000 size is 2048 kiB
[   19.725354] [drm] global init.
[   19.727593] [TTM] Zone  kernel: Available graphics memory: 1588976 kiB
[   19.729694] [TTM] Initializing pool allocator
[   19.731319] [TTM] Initializing DMA pool allocator
[   19.734882] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
[   19.736920] [drm] No driver support for vblank timestamp query.
[   19.756622] [drm] Screen Objects Display Unit initialized
[   19.759163] [drm] width 1280
[   19.760211] [drm] height 768
[   19.761238] [drm] bpp 32
[   19.788213] [drm] Fifo max 0x00200000 min 0x00001000 cap 0x0000077f
[   19.791354] [drm] Using command buffers with DMA pool.
[   19.793213] [drm] DX: no.
[   19.794084] [drm] Atomic: yes
[   19.860077] fbcon: svgadrmfb (fb0) is primary device
[   19.885281] Console: switching to colour frame buffer device 160x48
[   19.896566] ==================================================================
[   19.897136] BUG: KASAN: slab-out-of-bounds in vmw_du_primary_plane_atomic_check+0x26b/0x360
[   19.897136] Read of size 1 at addr ffff880118a69fe8 by task swapper/0/1
[   19.897136] 
[   19.897136] CPU: 2 PID: 1 Comm: swapper/0 Not tainted 4.13.0-rc3-next-20170801 #140
[   19.897136] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 07/02/2015
[   19.897136] Call Trace:
[   19.897136]  dump_stack+0x86/0xc9
[   19.897136]  print_address_description+0xcb/0x250
[   19.897136]  kasan_report+0x24d/0x360
[   19.897136]  ? vmw_du_primary_plane_atomic_check+0x26b/0x360
[   19.897136]  __asan_load1+0x47/0x50
[   19.897136]  vmw_du_primary_plane_atomic_check+0x26b/0x360 /* vmw_du_primary_plane_atomic_check at drivers/gpu/drm/vmwgfx/vmwgfx_kms.c:487 */
[   19.897136]  ? wait_for_completion+0x200/0x200
[   19.897136]  ? vmw_du_cursor_plane_atomic_update+0x520/0x520
[   19.897136]  ? __radix_tree_lookup+0x21/0x170
[   19.897136]  ? __drm_mode_object_find+0x5a/0xc0
[   19.897136]  ? drm_atomic_helper_check_modeset+0xd80/0x1350
[   19.897136]  drm_atomic_helper_check_planes+0x1a7/0x3c0 /* drm_atomic_helper_check_planes at drivers/gpu/drm/drm_atomic_helper.c:737 */
[   19.897136]  drm_atomic_helper_check+0x32/0x90 /* drm_atomic_helper_check at drivers/gpu/drm/drm_atomic_helper.c:795 */
[   19.897136]  vmw_kms_atomic_check_modeset+0x186/0x1a0 /* vmw_kms_atomic_check_modeset at drivers/gpu/drm/vmwgfx/vmwgfx_kms.c:1566 */
[   19.897136]  drm_atomic_check_only+0x8cd/0xa70 /* drm_atomic_check_only at drivers/gpu/drm/drm_atomic.c:1666 */
[   19.897136]  ? drm_atomic_legacy_backoff+0xe0/0xe0
[   19.897136]  ? drm_atomic_helper_disable_plane+0xf0/0xf0
[   19.897136]  ? drm_atomic_helper_best_encoder+0x70/0x70
[   19.897136]  drm_atomic_commit+0x24/0x80 /* drm_atomic_commit at drivers/gpu/drm/drm_atomic.c:1702 */
[   19.897136]  drm_atomic_helper_set_config+0x7e/0xa0 /* drm_atomic_helper_set_config at drivers/gpu/drm/drm_atomic_helper.c:2607 */
[   19.897136]  ? ww_mutex_lock+0x43/0x70
[   19.897136]  vmw_kms_set_config+0x44/0x50 /* vmw_kms_set_config at drivers/gpu/drm/vmwgfx/vmwgfx_kms.c:2849 */
[   19.897136]  vmwgfx_set_config_internal.constprop.4+0x122/0x2d0 /* vmwgfx_set_config_internal at drivers/gpu/drm/vmwgfx/vmwgfx_fb.c:444 */
[   19.897136]  vmw_fb_set_par+0x528/0xb00 /* vmw_fb_set_par at drivers/gpu/drm/vmwgfx/vmwgfx_fb.c:636 */
[   19.897136]  ? find_held_lock+0x117/0x150
[   19.897136]  ? vmw_fb_kms_detach+0x300/0x300
[   19.897136]  ? lock_downgrade+0x2d0/0x2d0
[   19.897136]  ? __mutex_unlock_slowpath+0xd4/0x3e0
[   19.897136]  ? wait_for_completion+0x200/0x200
[   19.897136]  ? init_timer_key+0x5f/0x70
[   19.897136]  vmw_fb_init+0x839/0x920 /* vmw_fb_init at drivers/gpu/drm/vmwgfx/vmwgfx_fb.c:704 */
[   19.897136]  ? vmw_fb_init+0x839/0x920
[   19.999867] tsc: Refined TSC clocksource calibration: 1995.458 MHz
[   20.000169] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x3986d7607fe, max_idle_ns: 881590663232 ns
[   20.000311]  ? vmw_fb_set_par+0xb00/0xb00
[   20.000311]  ? _raw_spin_unlock+0x22/0x30
[   20.000311]  ? ttm_read_unlock+0x48/0x50
[   20.000311]  vmw_driver_load+0x1937/0x1b10 /* vmw_driver_load at drivers/gpu/drm/vmwgfx/vmwgfx_drv.c:920 */
[   20.000311]  ? vmw_svga_enable+0x30/0x30
[   20.000311]  ? trace_hardirqs_on_caller+0x187/0x260
[   20.000311]  ? kasan_slab_free+0x88/0xc0
[   20.000311]  ? drm_dev_register+0x197/0x310
[   20.000311]  drm_dev_register+0x1ed/0x310 /* drm_dev_register at drivers/gpu/drm/drm_drv.c:802 */
[   20.000311]  drm_get_pci_dev+0xe9/0x250
[   20.000311]  ? vmw_remove+0x40/0x40
[   20.000311]  vmw_probe+0x10/0x20
[   20.000311]  local_pci_probe+0x75/0xd0
[   20.000311]  pci_device_probe+0x2a4/0x300
[   20.000311]  ? pci_device_remove+0xf0/0xf0
[   20.000311]  ? do_raw_spin_unlock+0x86/0x120
[   20.000311]  ? _raw_spin_unlock+0x22/0x30
[   20.000311]  driver_probe_device+0x3e2/0x660
[   20.000311]  ? driver_probe_device+0x660/0x660
[   20.000311]  __driver_attach+0x11c/0x120
[   20.000311]  bus_for_each_dev+0xea/0x150
[   20.000311]  ? subsys_dev_iter_exit+0x10/0x10
[   20.000311]  ? do_raw_spin_unlock+0x86/0x120
[   20.000311]  driver_attach+0x26/0x30
[   20.000311]  bus_add_driver+0x26b/0x3b0
[   20.000311]  driver_register+0xce/0x190
[   20.000311]  __pci_register_driver+0xaf/0xc0
[   20.000311]  ? ttm_init+0x5d/0x5d
[   20.000311]  ? set_debug_rodata+0x12/0x12
[   20.000311]  vmwgfx_init+0x28/0x48
[   20.000311]  do_one_initcall+0x9a/0x204
[   20.000311]  ? initcall_blacklisted+0x150/0x150
[   20.000311]  ? lock_downgrade+0x250/0x2d0
[   20.000311]  ? set_debug_rodata+0x12/0x12
[   20.000311]  kernel_init_freeable+0x35f/0x41c
[   20.000311]  ? start_kernel+0x569/0x569
[   20.000311]  ? lock_downgrade+0x2d0/0x2d0
[   20.000311]  ? finish_task_switch+0xd8/0x310
[   20.000311]  ? finish_task_switch+0x8a/0x310
[   20.000311]  ? rest_init+0xf0/0xf0
[   20.000311]  kernel_init+0xe/0x113
[   20.000311]  ? rest_init+0xf0/0xf0
[   20.000311]  ret_from_fork+0x2a/0x40
[   20.000311] 
[   20.000311] Allocated by task 1:
[   20.000311]  save_stack_trace+0x16/0x20
[   20.000311]  save_stack+0x46/0xd0
[   20.000311]  kasan_kmalloc+0xad/0xe0
[   20.000311]  drm_atomic_helper_connector_duplicate_state+0x5d/0x90 /* drm_atomic_helper_connector_duplicate_state at include/linux/slab.h:393 */
[   20.000311]  drm_atomic_get_connector_state+0x171/0x290 /* drm_atomic_get_connector_state at drivers/gpu/drm/drm_atomic.c:1106 */
[   20.000311]  __drm_atomic_helper_set_config+0x503/0x660 /* update_output_state at drivers/gpu/drm/drm_atomic_helper.c:2541 (inlined by) __drm_atomic_helper_set_config at drivers/gpu/drm/drm_atomic_helper.c:2683 */
[   20.000311]  drm_atomic_helper_set_config+0x51/0xa0 /* drm_atomic_helper_set_config at drivers/gpu/drm/drm_atomic_helper.c:2600 */
[   20.000311]  vmw_kms_set_config+0x44/0x50 /* vmw_kms_set_config at drivers/gpu/drm/vmwgfx/vmwgfx_kms.c:2849 */
[   20.000311]  vmwgfx_set_config_internal.constprop.4+0x122/0x2d0 /* vmwgfx_set_config_internal at drivers/gpu/drm/vmwgfx/vmwgfx_fb.c:444 */
[   20.000311]  vmw_fb_set_par+0x528/0xb00
[   20.000311]  fbcon_init+0x95b/0xa20
[   20.000311]  visual_init+0x197/0x260
[   20.000311]  do_bind_con_driver+0x2c9/0x570
[   20.000311]  do_take_over_console+0x1c8/0x240
[   20.000311]  do_fbcon_takeover+0x8f/0x110
[   20.000311]  fbcon_event_notify+0xa40/0xb90
[   20.000311]  notifier_call_chain+0x6b/0xa0
[   20.000311]  __blocking_notifier_call_chain+0x5c/0x80
[   20.000311]  blocking_notifier_call_chain+0x11/0x20
[   20.000311]  fb_notifier_call_chain+0x16/0x20
[   20.000311]  register_framebuffer+0x403/0x590
[   20.000311]  vmw_fb_init+0x826/0x920
[   20.000311]  vmw_driver_load+0x1937/0x1b10
[   20.000311]  drm_dev_register+0x1ed/0x310
[   20.000311]  drm_get_pci_dev+0xe9/0x250
[   20.000311]  vmw_probe+0x10/0x20
[   20.000311]  local_pci_probe+0x75/0xd0
[   20.000311]  pci_device_probe+0x2a4/0x300
[   20.000311]  driver_probe_device+0x3e2/0x660
[   20.000311]  __driver_attach+0x11c/0x120
[   20.000311]  bus_for_each_dev+0xea/0x150
[   20.000311]  driver_attach+0x26/0x30
[   20.000311]  bus_add_driver+0x26b/0x3b0
[   20.000311]  driver_register+0xce/0x190
[   20.000311]  __pci_register_driver+0xaf/0xc0
[   20.000311]  vmwgfx_init+0x28/0x48
[   20.000311]  do_one_initcall+0x9a/0x204
[   20.000311]  kernel_init_freeable+0x35f/0x41c
[   20.000311]  kernel_init+0xe/0x113
[   20.000311]  ret_from_fork+0x2a/0x40
[   20.000311] 
[   20.000311] Freed by task 1:
[   20.000311]  save_stack_trace+0x16/0x20
[   20.000311]  save_stack+0x46/0xd0
[   20.000311]  kasan_slab_free+0x72/0xc0
[   20.000311]  kfree+0xc1/0x1c0
[   20.000311]  acpi_ds_call_control_method+0x175/0x259
[   20.000311]  acpi_ps_parse_aml+0x115/0x445
[   20.000311]  acpi_ps_execute_method+0x251/0x298
[   20.000311]  acpi_ns_evaluate+0x34f/0x42f
[   20.000311]  acpi_evaluate_object+0x247/0x401
[   20.000311]  acpi_evaluate_integer+0xb8/0x130
[   20.000311]  acpi_bus_get_status+0xc4/0x100
[   20.000311]  acpi_bus_attach+0xa7/0x430
[   20.000311]  acpi_bus_attach+0x154/0x430
[   20.000311]  acpi_bus_attach+0x154/0x430
[   20.000311]  acpi_bus_attach+0x154/0x430
[   20.000311]  acpi_bus_attach+0x154/0x430
[   20.000311]  acpi_bus_scan+0x7e/0xe0
[   20.000311]  acpi_scan_init+0x18b/0x386
[   20.000311]  acpi_init+0x424/0x4b2
[   20.000311]  do_one_initcall+0x9a/0x204
[   20.000311]  kernel_init_freeable+0x35f/0x41c
[   20.000311]  kernel_init+0xe/0x113
[   20.000311]  ret_from_fork+0x2a/0x40
[   20.000311] 
[   20.000311] The buggy address belongs to the object at ffff880118a69f88
[   20.000311]  which belongs to the cache kmalloc-96 of size 96
[   20.000311] The buggy address is located 0 bytes to the right of
[   20.000311]  96-byte region [ffff880118a69f88, ffff880118a69fe8)
[   20.000311] The buggy address belongs to the page:
[   20.000311] page:ffffea0004629a00 count:1 mapcount:0 mapping:          (null) index:0xffff880118a68fc8 compound_mapcount: 0
[   20.000311] flags: 0x2fffff80008100(slab|head)
[   20.000311] raw: 002fffff80008100 0000000000000000 ffff880118a68fc8 0000000100240019
[   20.000311] raw: ffffea0004627820 ffff8801194077c0 ffff880119410a00 0000000000000000
[   20.000311] page dumped because: kasan: bad access detected
[   20.000311] 
[   20.000311] Memory state around the buggy address:
[   20.000311]  ffff880118a69e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.000311]  ffff880118a69f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.000311] >ffff880118a69f80: fc 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc
[   20.000311]                                                           ^
[   20.000311]  ffff880118a6a000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.000311]  ffff880118a6a080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   20.000311] ==================================================================
[   20.000311] Disabling lock debugging due to kernel taint
[   20.580502] clocksource: Switched to clocksource tsc
[   20.582360] [drm] Initialized vmwgfx 2.13.0 20170607 for 0000:00:0f.0 on minor 0
----------
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/dri-devel




[Index of Archives]     [Linux DRI Users]     [Linux Intel Graphics]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [XFree86]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux