https://bugzilla.kernel.org/show_bug.cgi?id=198985 --- Comment #4 from Fredrik (fredrik@xxxxxxxxxxxxxxxxx) --- I've applied the patch you mentioned above. Is this related or should I open a new bug?: [56091.713961] ================================================================== [56091.714058] BUG: KASAN: use-after-free in dc_create_stream_for_sink+0x73/0x440 [amdgpu] [56091.714062] Read of size 8 at addr ffff88092d66fc68 by task X/490 [56091.714066] CPU: 11 PID: 490 Comm: X Not tainted 4.15.9 #21 [56091.714068] Hardware name: System manufacturer System Product Name/PRIME X370-PRO, BIOS 3803 01/22/2018 [56091.714069] Call Trace: [56091.714075] dump_stack+0x46/0x5a [56091.714080] print_address_description+0x82/0x2c0 [56091.714084] kasan_report+0x289/0x380 [56091.714175] ? dc_create_stream_for_sink+0x73/0x440 [amdgpu] [56091.714265] dc_create_stream_for_sink+0x73/0x440 [amdgpu] [56091.714357] create_stream_for_sink+0xe5/0x7c0 [amdgpu] [56091.714451] ? fill_stream_properties_from_drm_display_mode+0x400/0x400 [amdgpu] [56091.714454] ? kasan_kmalloc+0xb0/0xf0 [56091.714458] ? drm_legacy_ioremapfree+0xd0/0xd0 [56091.714461] ? drm_atomic_commit+0x2d/0xb0 [56091.714465] ? drm_atomic_helper_legacy_gamma_set+0x190/0x1e0 [56091.714469] ? drm_mode_gamma_set_ioctl+0x28a/0x320 [56091.714473] ? drm_atomic_get_connector_state+0xaa/0x2a0 [56091.714565] dm_update_crtcs_state+0x1d2/0x5e0 [amdgpu] [56091.714569] ? drm_atomic_get_crtc_state+0x76/0x1d0 [56091.714660] ? dc_resource_state_copy_construct+0x199/0x1d0 [amdgpu] [56091.714759] amdgpu_dm_atomic_check+0x24b/0x6d0 [amdgpu] [56091.714764] ? __radix_tree_replace+0x95/0x150 [56091.714766] ? node_tag_clear+0x66/0xb0 [56091.714859] ? dm_update_planes_state.part.28+0x1150/0x1150 [amdgpu] [56091.714862] ? __mutex_lock_interruptible_slowpath+0x1/0x10 [56091.714865] ? __fprop_inc_percpu_max+0x180/0x180 [56091.714869] drm_atomic_check_only+0x6b8/0x940 [56091.714872] ? drm_legacy_ioremapfree+0xd0/0xd0 [56091.714876] ? drm_atomic_set_crtc_for_connector+0x1d0/0x1d0 [56091.714878] ? drm_mode_object_get+0x51/0x70 [56091.714882] drm_atomic_commit+0x2d/0xb0 [56091.714886] drm_atomic_helper_legacy_gamma_set+0x190/0x1e0 [56091.714889] ? drm_atomic_helper_update_plane+0x1a0/0x1a0 [56091.714892] drm_mode_gamma_set_ioctl+0x28a/0x320 [56091.714896] ? drm_crtc_enable_color_mgmt+0x140/0x140 [56091.714899] ? drm_legacy_ioremapfree+0xd0/0xd0 [56091.714902] ? drm_lease_owner+0x15/0x30 [56091.714905] ? drm_crtc_enable_color_mgmt+0x140/0x140 [56091.714908] drm_ioctl_kernel+0xaf/0x120 [56091.714911] drm_ioctl+0x4bf/0x570 [56091.714915] ? drm_crtc_enable_color_mgmt+0x140/0x140 [56091.714917] ? drm_ioctl_kernel+0x120/0x120 [56091.714922] ? set_current_blocked+0x20/0x20 [56091.714924] ? get_signal+0x5c8/0x760 [56091.714927] ? memset+0x2d/0x50 [56091.714930] ? fpstate_init+0x6c/0x80 [56091.714933] ? fpu__initialize+0x1c/0x50 [56091.714936] ? __fpu__restore_sig+0x327/0x510 [56091.714940] do_vfs_ioctl+0x155/0x920 [56091.714943] ? ioctl_preallocate+0x140/0x140 [56091.714945] ? recalc_sigpending_tsk+0x95/0xa0 [56091.714948] ? recalc_sigpending+0x12/0x20 [56091.714950] ? do_sigaltstack+0x1d0/0x270 [56091.714955] ? SyS_futex+0x1be/0x250 [56091.714959] ? __rcu_read_unlock+0x76/0xa0 [56091.714961] ? __fget+0xc2/0x100 [56091.714964] SyS_ioctl+0x47/0x90 [56091.714967] ? do_vfs_ioctl+0x920/0x920 [56091.714970] do_syscall_64+0xf3/0x2b0 [56091.714974] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [56091.714976] RIP: 0033:0x7f3385a95397 [56091.714978] RSP: 002b:00007ffe5b715608 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [56091.714982] RAX: ffffffffffffffda RBX: 000055cc1d92d2a0 RCX: 00007f3385a95397 [56091.714984] RDX: 00007ffe5b715640 RSI: 00000000c02064a5 RDI: 000000000000000c [56091.714985] RBP: 00007ffe5b715640 R08: 000055cc1d92d960 R09: 000055cc1d92db60 [56091.714987] R10: 0000000000000001 R11: 0000000000000246 R12: 00000000c02064a5 [56091.714989] R13: 000000000000000c R14: 000055cc1d92b130 R15: 000055cc1d92d760 [56091.714992] Allocated by task 490: [56091.714996] kasan_kmalloc+0xb0/0xf0 [56091.715086] dc_sink_create+0x41/0x140 [amdgpu] [56091.715178] create_stream_for_sink+0x6a7/0x7c0 [amdgpu] [56091.715270] dm_update_crtcs_state+0x1d2/0x5e0 [amdgpu] [56091.715362] amdgpu_dm_atomic_check+0x24b/0x6d0 [amdgpu] [56091.715365] drm_atomic_check_only+0x6b8/0x940 [56091.715367] drm_atomic_commit+0x2d/0xb0 [56091.715370] drm_atomic_connector_commit_dpms+0x1ea/0x210 [56091.715373] drm_mode_obj_set_property_ioctl+0x2fb/0x410 [56091.715376] drm_mode_connector_property_set_ioctl+0xb5/0xf0 [56091.715378] drm_ioctl_kernel+0xaf/0x120 [56091.715381] drm_ioctl+0x4bf/0x570 [56091.715383] do_vfs_ioctl+0x155/0x920 [56091.715385] SyS_ioctl+0x47/0x90 [56091.715387] do_syscall_64+0xf3/0x2b0 [56091.715390] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [56091.715392] Freed by task 112: [56091.715395] kasan_slab_free+0x7c/0xe0 [56091.715397] kfree+0x91/0x1a0 [56091.715487] dc_link_detect+0x21a/0x1030 [amdgpu] [56091.715579] handle_hpd_irq+0x65/0xd0 [amdgpu] [56091.715671] dm_irq_work_func+0x86/0xa0 [amdgpu] [56091.715674] process_one_work+0x3cd/0x660 [56091.715676] worker_thread+0x81/0x7b0 [56091.715678] kthread+0x1ae/0x1d0 [56091.715680] ret_from_fork+0x22/0x40 [56091.715683] The buggy address belongs to the object at ffff88092d66f980 which belongs to the cache kmalloc-1024 of size 1024 [56091.715687] The buggy address is located 744 bytes inside of 1024-byte region [ffff88092d66f980, ffff88092d66fd80) [56091.715688] The buggy address belongs to the page: [56091.715691] page:ffffea0024b59a00 count:1 mapcount:0 mapping:0000000000000000 index:0x0 compound_mapcount: 0 [56091.715696] flags: 0x8000000000008100(slab|head) [56091.715701] raw: 8000000000008100 0000000000000000 0000000000000000 00000001001c001c [56091.715704] raw: dead000000000100 dead000000000200 ffff880f98c03180 0000000000000000 [56091.715707] page dumped because: kasan: bad access detected [56091.715709] Memory state around the buggy address: [56091.715714] ffff88092d66fb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [56091.715717] ffff88092d66fb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [56091.715720] >ffff88092d66fc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [56091.715721] ^ [56091.715724] ffff88092d66fc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [56091.715727] ffff88092d66fd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [56091.715729] ================================================================== [56091.715730] Disabling lock debugging due to kernel taint [56091.715777] ================================================================== [56091.715780] BUG: KASAN: double-free or invalid-free in (null) [56091.715792] CPU: 11 PID: 490 Comm: X Tainted: G B 4.15.9 #21 [56091.715795] Hardware name: System manufacturer System Product Name/PRIME X370-PRO, BIOS 3803 01/22/2018 [56091.715800] Call Trace: [56091.715806] dump_stack+0x46/0x5a [56091.715812] print_address_description+0x82/0x2c0 [56091.715818] kasan_report_double_free+0x60/0xa0 [56091.715824] kasan_slab_free+0xb5/0xe0 [56091.715919] ? dc_stream_release+0x3c/0x90 [amdgpu] [56091.715925] kfree+0x91/0x1a0 [56091.716021] dc_stream_release+0x3c/0x90 [amdgpu] [56091.716119] dm_update_crtcs_state+0x23d/0x5e0 [amdgpu] [56091.716126] ? drm_atomic_get_crtc_state+0x76/0x1d0 [56091.716221] ? dc_resource_state_copy_construct+0x199/0x1d0 [amdgpu] [56091.716318] amdgpu_dm_atomic_check+0x24b/0x6d0 [amdgpu] [56091.716325] ? __radix_tree_replace+0x95/0x150 [56091.716330] ? node_tag_clear+0x66/0xb0 [56091.716427] ? dm_update_planes_state.part.28+0x1150/0x1150 [amdgpu] [56091.716433] ? __mutex_lock_interruptible_slowpath+0x1/0x10 [56091.716438] ? __fprop_inc_percpu_max+0x180/0x180 [56091.716444] drm_atomic_check_only+0x6b8/0x940 [56091.716450] ? drm_legacy_ioremapfree+0xd0/0xd0 [56091.716457] ? drm_atomic_set_crtc_for_connector+0x1d0/0x1d0 [56091.716463] ? drm_mode_object_get+0x51/0x70 [56091.716469] drm_atomic_commit+0x2d/0xb0 [56091.716476] drm_atomic_helper_legacy_gamma_set+0x190/0x1e0 [56091.716482] ? drm_atomic_helper_update_plane+0x1a0/0x1a0 [56091.716488] drm_mode_gamma_set_ioctl+0x28a/0x320 [56091.716495] ? drm_crtc_enable_color_mgmt+0x140/0x140 [56091.716501] ? drm_legacy_ioremapfree+0xd0/0xd0 [56091.716507] ? drm_lease_owner+0x15/0x30 [56091.716513] ? drm_crtc_enable_color_mgmt+0x140/0x140 [56091.716518] drm_ioctl_kernel+0xaf/0x120 [56091.716525] drm_ioctl+0x4bf/0x570 [56091.716529] ? drm_crtc_enable_color_mgmt+0x140/0x140 [56091.716532] ? drm_ioctl_kernel+0x120/0x120 [56091.716535] ? set_current_blocked+0x20/0x20 [56091.716538] ? get_signal+0x5c8/0x760 [56091.716541] ? memset+0x2d/0x50 [56091.716544] ? fpstate_init+0x6c/0x80 [56091.716547] ? fpu__initialize+0x1c/0x50 [56091.716550] ? __fpu__restore_sig+0x327/0x510 [56091.716553] do_vfs_ioctl+0x155/0x920 [56091.716556] ? ioctl_preallocate+0x140/0x140 [56091.716559] ? recalc_sigpending_tsk+0x95/0xa0 [56091.716561] ? recalc_sigpending+0x12/0x20 [56091.716564] ? do_sigaltstack+0x1d0/0x270 [56091.716568] ? SyS_futex+0x1be/0x250 [56091.716571] ? __rcu_read_unlock+0x76/0xa0 [56091.716573] ? __fget+0xc2/0x100 [56091.716576] SyS_ioctl+0x47/0x90 [56091.716579] ? do_vfs_ioctl+0x920/0x920 [56091.716581] do_syscall_64+0xf3/0x2b0 [56091.716585] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [56091.716587] RIP: 0033:0x7f3385a95397 [56091.716589] RSP: 002b:00007ffe5b715608 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [56091.716592] RAX: ffffffffffffffda RBX: 000055cc1d92d2a0 RCX: 00007f3385a95397 [56091.716594] RDX: 00007ffe5b715640 RSI: 00000000c02064a5 RDI: 000000000000000c [56091.716596] RBP: 00007ffe5b715640 R08: 000055cc1d92d960 R09: 000055cc1d92db60 [56091.716598] R10: 0000000000000001 R11: 0000000000000246 R12: 00000000c02064a5 [56091.716599] R13: 000000000000000c R14: 000055cc1d92b130 R15: 000055cc1d92d760 [56091.716602] Allocated by task 490: [56091.716606] kasan_kmalloc+0xb0/0xf0 [56091.716698] dc_sink_create+0x41/0x140 [amdgpu] [56091.716794] create_stream_for_sink+0x6a7/0x7c0 [amdgpu] [56091.716891] dm_update_crtcs_state+0x1d2/0x5e0 [amdgpu] [56091.716986] amdgpu_dm_atomic_check+0x24b/0x6d0 [amdgpu] [56091.716990] drm_atomic_check_only+0x6b8/0x940 [56091.716993] drm_atomic_commit+0x2d/0xb0 [56091.716996] drm_atomic_connector_commit_dpms+0x1ea/0x210 [56091.716999] drm_mode_obj_set_property_ioctl+0x2fb/0x410 [56091.717001] drm_mode_connector_property_set_ioctl+0xb5/0xf0 [56091.717004] drm_ioctl_kernel+0xaf/0x120 [56091.717007] drm_ioctl+0x4bf/0x570 [56091.717009] do_vfs_ioctl+0x155/0x920 [56091.717011] SyS_ioctl+0x47/0x90 [56091.717013] do_syscall_64+0xf3/0x2b0 [56091.717016] entry_SYSCALL_64_after_hwframe+0x3d/0xa2 [56091.717018] Freed by task 112: [56091.717021] kasan_slab_free+0x7c/0xe0 [56091.717023] kfree+0x91/0x1a0 [56091.717118] dc_link_detect+0x21a/0x1030 [amdgpu] [56091.717209] handle_hpd_irq+0x65/0xd0 [amdgpu] [56091.717297] dm_irq_work_func+0x86/0xa0 [amdgpu] [56091.717299] process_one_work+0x3cd/0x660 [56091.717302] worker_thread+0x81/0x7b0 [56091.717303] kthread+0x1ae/0x1d0 [56091.717306] ret_from_fork+0x22/0x40 [56091.717308] The buggy address belongs to the object at ffff88092d66f980 which belongs to the cache kmalloc-1024 of size 1024 [56091.717312] The buggy address is located 0 bytes inside of 1024-byte region [ffff88092d66f980, ffff88092d66fd80) [56091.717313] The buggy address belongs to the page: [56091.717315] page:ffffea0024b59a00 count:1 mapcount:0 mapping:0000000000000000 index:0x0 compound_mapcount: 0 [56091.717319] flags: 0x8000000000008100(slab|head) [56091.717323] raw: 8000000000008100 0000000000000000 0000000000000000 00000001001c001c [56091.717327] raw: dead000000000100 dead000000000200 ffff880f98c03180 0000000000000000 [56091.717328] page dumped because: kasan: bad access detected [56091.717330] Memory state around the buggy address: [56091.717332] ffff88092d66f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [56091.717335] ffff88092d66f900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [56091.717337] >ffff88092d66f980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [56091.717338] ^ [56091.717341] ffff88092d66fa00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [56091.717343] ffff88092d66fa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [56091.717344] ================================================================== -- You are receiving this mail because: You are watching the assignee of the bug. _______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/dri-devel
