This bug is found by syzkaller
FAULT_INJECTION: forcing a failure.
[ 3495.302071][T275065] show_stack+0x34/0x4c
[ 3495.310070][T275065] dump_stack+0x158/0x1e4
[ 3495.318006][T275065] should_fail+0x334/0x380
[ 3495.326077][T275065] __should_failslab+0x90/0xf0
[ 3495.334183][T275065] should_failslab+0x18/0x30
[ 3495.342284][T275065] kmem_cache_alloc_trace+0x7c/0x6c4
[ 3495.350492][T275065] drm_prime_pages_to_sg+0x50/0x110
[ 3495.358599][T275065] drm_gem_shmem_get_sg_table+0x6c/0x90
[ 3495.366568][T275065] virtio_gpu_object_shmem_init+0x78/0x3d0 [virtio_gpu]
[ 3495.374684][T275065] virtio_gpu_object_create+0x1cc/0x340 [virtio_gpu]
[ 3495.382618][T275065] virtio_gpu_gem_create.constprop.0+0xb0/0x1f0 [virtio_gpu]
[ 3495.390580][T275065] virtio_gpu_mode_dumb_create+0x160/0x1e0 [virtio_gpu]
[ 3495.398381][T275065] drm_mode_create_dumb+0x120/0x190
[ 3495.405851][T275065] drm_mode_create_dumb_ioctl+0x3c/0x50
[ 3495.413197][T275065] drm_ioctl_kernel+0x17c/0x1d0
[ 3495.911669][T275065] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[ 3499.250121][T275065] Call trace:
[ 3499.261543][T275065] machine_kexec+0x6c/0x46c
[ 3499.272934][T275065] __crash_kexec+0xf0/0x1c0
[ 3499.284179][T275065] panic+0x50c/0x788
[ 3499.295285][T275065] die+0x388/0x390
[ 3499.306282][T275065] die_kernel_fault+0x70/0x8c
[ 3499.317299][T275065] __do_kernel_fault+0xf0/0x1d0
[ 3499.328290][T275065] do_page_fault+0x300/0x7ac
[ 3499.339207][T275065] do_translation_fault+0x164/0x1c0
[ 3499.350202][T275065] do_mem_abort+0x6c/0x110
[ 3499.361048][T275065] el1_abort+0xa0/0x120
[ 3499.371921][T275065] el1_sync_handler+0x104/0x140
[ 3499.382683][T275065] el1_sync+0x74/0x100
[ 3499.393051][T275065] virtio_gpu_object_shmem_init+0x98/0x3d0 [virtio_gpu]
[ 3499.403641][T275065] virtio_gpu_object_create+0x1cc/0x340 [virtio_gpu]
[ 3499.413874][T275065] virtio_gpu_gem_create.constprop.0+0xb0/0x1f0 [virtio_gpu]
[ 3499.424063][T275065] virtio_gpu_mode_dumb_create+0x160/0x1e0 [virtio_gpu]
[ 3499.433817][T275065] drm_mode_create_dumb+0x120/0x190
[ 3499.443035][T275065] drm_mode_create_dumb_ioctl+0x3c/0x50
[ 3499.451951][T275065] drm_ioctl_kernel+0x17c/0x1d0
[ 3499.460309][T275065] drm_ioctl+0x450/0x7a4
[ 3499.468274][T275065] __arm64_sys_ioctl+0x100/0x150
[ 3499.476173][T275065] invoke_syscall+0x64/0x100
[ 3499.483709][T275065] el0_svc_common.constprop.0+0x220/0x230
[ 3499.491157][T275065] do_el0_svc+0xb4/0xd4
[ 3499.498149][T275065] el0_svc+0x24/0x3c
[ 3499.504624][T275065] el0_sync_handler+0x160/0x164
[ 3499.511079][T275065] el0_sync+0x160/0x180
Signed-off-by: chenhaixiang <chenhaixiang3@xxxxxxxxxx>
Signed-off-by: Liu Zixian <liuzixian4@xxxxxxxxxx>
---
drivers/gpu/drm/virtio/virtgpu_object.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c
index f293e6ad5..a3681b5c8 100644
--- a/drivers/gpu/drm/virtio/virtgpu_object.c
+++ b/drivers/gpu/drm/virtio/virtgpu_object.c
@@ -168,7 +168,8 @@ static int virtio_gpu_object_shmem_init(struct virtio_gpu_device *vgdev,
* since virtio_gpu doesn't support dma-buf import from other devices.
*/
shmem->pages = drm_gem_shmem_get_sg_table(&bo->base);
- if (!shmem->pages) {
+ if (IS_ERR(shmem->pages)) {
+ shmem->pages = NULL;
drm_gem_shmem_unpin(&bo->base);
return -EINVAL;
}
--
2.33.0
