Greeting,
FYI, we noticed the following commit (built with gcc-9):
commit: dc13cac4862cc68ec74348a80b6942532b7735fa ("video: hgafb: fix potential NULL pointer dereference")
https://git.kernel.org/cgit/linux/kernel/git/gregkh/char-misc.git char-misc-linus
in testcase: trinity
version: trinity-static-x86_64-x86_64-f93256fb_2019-08-28
with following parameters:
number: 99999
group: group-02
test-description: Trinity is a linux system call fuzz tester.
test-url: http://codemonkey.org.uk/projects/trinity/
on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
+---------------------------------------------+------------+------------+
| | 58c0cc2d90 | dc13cac486 |
+---------------------------------------------+------------+------------+
| boot_successes | 42 | 14 |
| boot_failures | 0 | 34 |
| BUG:KASAN:stack-out-of-bounds_in_hgafb_open | 0 | 34 |
+---------------------------------------------+------------+------------+
If you fix the issue, kindly add following tag
Reported-by: kernel test robot <[email protected]>
[ 419.568887] BUG: KASAN: stack-out-of-bounds in hgafb_open (kbuild/src/consumer/drivers/video/fbdev/hgafb.c:375)
[ 419.569766] Write of size 32768 at addr ffffc90000890000 by task plymouthd/237
[ 419.570595]
[ 419.570829] CPU: 0 PID: 237 Comm: plymouthd Not tainted 5.13.0-rc1-00044-gdc13cac4862c #1
[ 419.571610] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
[ 419.572304] Call Trace:
[ 419.572526] print_address_description.cold+0x5/0x2f8
[ 419.573247] ? hgafb_open (kbuild/src/consumer/drivers/video/fbdev/hgafb.c:375)
[ 419.573728] ? hgafb_open (kbuild/src/consumer/drivers/video/fbdev/hgafb.c:375)
[ 419.574200] kasan_report.cold (kbuild/src/consumer/mm/kasan/report.c:420 kbuild/src/consumer/mm/kasan/report.c:436)
[ 419.574607] ? hgafb_open (kbuild/src/consumer/drivers/video/fbdev/hgafb.c:375)
[ 419.574921] kasan_check_range (kbuild/src/consumer/mm/kasan/generic.c:187)
[ 419.575271] memset (kbuild/src/consumer/mm/kasan/shadow.c:44)
[ 419.575529] hgafb_open (kbuild/src/consumer/drivers/video/fbdev/hgafb.c:375)
[ 419.575827] fb_open (kbuild/src/consumer/include/linux/fb.h:641 kbuild/src/consumer/drivers/video/fbdev/core/fbmem.c:1419)
[ 419.576120] chrdev_open (kbuild/src/consumer/fs/char_dev.c:415)
[ 419.576444] ? exact_lock (kbuild/src/consumer/fs/char_dev.c:374)
[ 419.576745] do_dentry_open (kbuild/src/consumer/fs/open.c:827)
[ 419.577074] ? exact_lock (kbuild/src/consumer/fs/char_dev.c:374)
[ 419.577373] ? may_open (kbuild/src/consumer/fs/namei.c:2983)
[ 419.577669] path_openat (kbuild/src/consumer/fs/namei.c:3362 kbuild/src/consumer/fs/namei.c:3494)
[ 419.578014] ? path_lookupat+0x400/0x400
[ 419.578399] ? lockdep_hardirqs_on_prepare (kbuild/src/consumer/kernel/locking/lockdep.c:4760)
[ 419.578842] ? lock_is_held_type (kbuild/src/consumer/kernel/locking/lockdep.c:5255 kbuild/src/consumer/kernel/locking/lockdep.c:5555)
[ 419.605410] do_filp_open (kbuild/src/consumer/fs/namei.c:3521)
[ 419.605904] ? may_open_dev (kbuild/src/consumer/fs/namei.c:3515)
[ 419.606421] ? _raw_spin_unlock (kbuild/src/consumer/arch/x86/include/asm/preempt.h:95 kbuild/src/consumer/include/linux/spinlock_api_smp.h:152 kbuild/src/consumer/kernel/locking/spinlock.c:183)
[ 419.606962] ? alloc_fd (kbuild/src/consumer/fs/file.c:526 (discriminator 13))
[ 419.607437] ? getname_flags (kbuild/src/consumer/fs/namei.c:149)
[ 419.607941] do_sys_openat2 (kbuild/src/consumer/fs/open.c:1187)
[ 419.608453] ? lock_release (kbuild/src/consumer/arch/x86/include/asm/bitops.h:214 kbuild/src/consumer/include/asm-generic/bitops/instrumented-non-atomic.h:135 kbuild/src/consumer/kernel/locking/lockdep.c:199 kbuild/src/consumer/kernel/locking/lockdep.c:323 kbuild/src/consumer/kernel/locking/lockdep.c:5196 kbuild/src/consumer/kernel/locking/lockdep.c:5532)
[ 419.608959] ? file_open_root (kbuild/src/consumer/fs/open.c:1173)
[ 419.609487] ? lock_release (kbuild/src/consumer/arch/x86/include/asm/bitops.h:214 kbuild/src/consumer/include/asm-generic/bitops/instrumented-non-atomic.h:135 kbuild/src/consumer/kernel/locking/lockdep.c:199 kbuild/src/consumer/kernel/locking/lockdep.c:323 kbuild/src/consumer/kernel/locking/lockdep.c:5196 kbuild/src/consumer/kernel/locking/lockdep.c:5532)
[ 419.610011] do_sys_open (kbuild/src/consumer/fs/open.c:1201)
[ 419.610470] ? filp_open (kbuild/src/consumer/fs/open.c:1201)
[ 419.610928] ? syscall_enter_from_user_mode (kbuild/src/consumer/arch/x86/include/asm/irqflags.h:45 kbuild/src/consumer/arch/x86/include/asm/irqflags.h:80 kbuild/src/consumer/kernel/entry/common.c:106)
[ 419.611584] ? trace_hardirqs_on (kbuild/src/consumer/kernel/trace/trace_preemptirq.c:50 (discriminator 22))
[ 419.612155] ? syscall_enter_from_user_mode (kbuild/src/consumer/arch/x86/include/asm/irqflags.h:45 kbuild/src/consumer/arch/x86/include/asm/irqflags.h:80 kbuild/src/consumer/kernel/entry/common.c:106)
[ 419.612852] do_syscall_64 (kbuild/src/consumer/arch/x86/entry/common.c:47)
[ 419.613329] entry_SYSCALL_64_after_hwframe (kbuild/src/consumer/arch/x86/entry/entry_64.S:112)
[ 419.614045] RIP: 0033:0x7fbb1c448eb0
[ 419.614629] Code: 48 8b 15 93 0f 2d 00 f7 d8 64 89 02 48 83 c8 ff c3 90 90 90 90 90 90 90 90 90 83 3d 2d 73 2d 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 2e b3 01 00 48 89 04 24
All code
========
0: 48 8b 15 93 0f 2d 00 mov 0x2d0f93(%rip),%rdx # 0x2d0f9a
7: f7 d8 neg %eax
9: 64 89 02 mov %eax,%fs:(%rdx)
c: 48 83 c8 ff or $0xffffffffffffffff,%rax
10: c3 retq
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 90 nop
16: 90 nop
17: 90 nop
18: 90 nop
19: 90 nop
1a: 83 3d 2d 73 2d 00 00 cmpl $0x0,0x2d732d(%rip) # 0x2d734e
21: 75 10 jne 0x33
23: b8 02 00 00 00 mov $0x2,%eax
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 31 jae 0x63
32: c3 retq
33: 48 83 ec 08 sub $0x8,%rsp
37: e8 2e b3 01 00 callq 0x1b36a
3c: 48 89 04 24 mov %rax,(%rsp)
Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 31 jae 0x39
8: c3 retq
9: 48 83 ec 08 sub $0x8,%rsp
d: e8 2e b3 01 00 callq 0x1b340
12: 48 89 04 24 mov %rax,(%rsp)
[ 419.616969] RSP: 002b:00007fff20a76ee8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002
[ 419.617971] RAX: ffffffffffffffda RBX: 00000000017c1070 RCX: 00007fbb1c448eb0
[ 419.618883] RDX: 00007fbb1a19b1e0 RSI: 0000000000000002 RDI: 00000000017c0a00
[ 419.619798] RBP: 00007fbb1cd666a0 R08: 0000000000000008 R09: 0000000001000000
[ 419.620709] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbb1c72f778
[ 419.621659] R13: 0000000000000002 R14: 00007fbb1cd666a0 R15: 00000000017bc2e0
[ 419.622599]
[ 419.622819]
[ 419.623031] Memory state around the buggy address:
[ 419.623661] ffffc90000897c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 419.624571] ffffc90000897c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 419.625476] >ffffc90000897d00: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 f3 f3 00 00
[ 419.626420] ^
[ 419.627043] ffffc90000897d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 419.627970] ffffc90000897e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 419.628897] ==================================================================
[ 419.629823] Disabling lock debugging due to kernel taint
[ 420.487934] _warn_unseeded_randomness: 282 callbacks suppressed
[ 420.487946] random: get_random_u64 called from arch_rnd+0x48/0x80 with crng_init=0
[ 420.487961] random: get_random_u64 called from randomize_stack_top+0x5c/0x80 with crng_init=0
[ 420.488000] random: get_random_u64 called from arch_rnd+0x48/0x80 with crng_init=0
[ 420.498675] random: fast init done
[ 421.493166] _warn_unseeded_randomness: 225 callbacks suppressed
[ 421.493175] random: get_random_u64 called from arch_rnd+0x48/0x80 with crng_init=1
[ 421.493187] random: get_random_u64 called from randomize_stack_top+0x5c/0x80 with crng_init=1
[ 421.493309] random: get_random_u32 called from arch_setup_additional_pages+0x11f/0x180 with crng_init=1
[ 421.516720] init: failsafe main process (528) killed by TERM signal
[ 421.519905] init: networking main process (548) terminated with status 1
[ 421.576147] Seeding trinity based on x86_64-randconfig-a015-20210513
[ 421.576165]
[ 421.664568] random: dd: uninitialized urandom read (4096 bytes read)
[ 421.809592] random: trinity: uninitialized urandom read (4 bytes read)
[ 422.496319] _warn_unseeded_randomness: 654 callbacks suppressed
[ 422.496329] random: get_random_u64 called from arch_rnd+0x48/0x80 with crng_init=1
[ 422.496340] random: get_random_u64 called from randomize_stack_top+0x5c/0x80 with crng_init=1
[ 422.496466] random: get_random_u32 called from arch_setup_additional_pages+0x11f/0x180 with crng_init=1
[ 423.501918] _warn_unseeded_randomness: 553 callbacks suppressed
[ 423.501932] random: get_random_u64 called from arch_rnd+0x48/0x80 with crng_init=1
[ 423.501971] random: get_random_u64 called from randomize_stack_top+0x5c/0x80 with crng_init=1
[ 423.508779] random: get_random_u32 called from arch_setup_additional_pages+0x11f/0x180 with crng_init=1
[ 424.505237] _warn_unseeded_randomness: 472 callbacks suppressed
[ 424.505278] random: get_random_u64 called from dup_task_struct+0x298/0x8e0 with crng_init=1
[ 424.516542] random: get_random_u64 called from arch_rnd+0x48/0x80 with crng_init=1
[ 424.516597] random: get_random_u64 called from randomize_stack_top+0x5c/0x80 with crng_init=1
[ 425.513898] _warn_unseeded_randomness: 488 callbacks suppressed
[ 425.513913] random: get_random_u64 called from dup_task_struct+0x298/0x8e0 with crng_init=1
[ 425.524730] random: get_random_u64 called from arch_rnd+0x48/0x80 with crng_init=1
[ 425.524755] random: get_random_u64 called from randomize_stack_top+0x5c/0x80 with crng_init=1
[ 426.451592] 2021-05-14 20:15:06 chroot --userspec nobody:nogroup / trinity -q -q -l off -s 3463942183 -N 99999
[ 426.451639]
[ 426.544444] Trinity 2019.06 Dave Jones <[email protected]>
[ 426.544475]
[ 426.552070] shm:0x7f13f7a52000-0x7f140464ed00 (4 pages)
[ 426.552099]
[ 426.563116] [main] Couldn't chmod tmp/ to 0777.
[ 426.563144]
[ 426.569843] [main] Using user passed random seed: 3463942183.
[ 426.569868]
[ 426.579139] _warn_unseeded_randomness: 451 callbacks suppressed
[ 426.579152] random: get_random_u32 called from htab_map_alloc+0xa4d/0xda0 with crng_init=1
[ 426.586604] [main] Kernel was tainted on startup. Will ignore flags that are already set.
[ 426.586630]
[ 426.589859] Marking all syscalls as enabled.
[ 426.589880]
[ 426.600218] [main] 32-bit syscalls: 429 enabled. 64-bit syscalls: 347 enabled, 89 disabled.
[ 426.600251]
[ 426.610199] [main] Using pid_max = 4096
[ 426.610230]
[ 426.612222] [main] futex: 0 owner:0
[ 426.612243]
[ 426.614161] [main] futex: 0 owner:0
[ 426.623585]
[ 426.625630] [main] futex: 0 owner:0
[ 426.625650]
To reproduce:
# build kernel
cd linux
cp config-5.13.0-rc1-00044-gdc13cac4862c .config
make HOSTCC=gcc-9 CC=gcc-9 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage
git clone https://github.com/intel/lkp-tests.git
cd lkp-tests
bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email
---
0DAY/LKP+ Test Infrastructure Open Source Technology Center
https://lists.01.org/hyperkitty/list/[email protected] Intel Corporation
Thanks,
Oliver Sang
On Sun, May 16, 2021 at 11:00:19PM +0800, kernel test robot wrote:
>
>
> Greeting,
>
> FYI, we noticed the following commit (built with gcc-9):
>
> commit: dc13cac4862cc68ec74348a80b6942532b7735fa ("video: hgafb: fix potential NULL pointer dereference")
> https://git.kernel.org/cgit/linux/kernel/git/gregkh/char-misc.git char-misc-linus
>
>
> in testcase: trinity
> version: trinity-static-x86_64-x86_64-f93256fb_2019-08-28
> with following parameters:
>
> number: 99999
> group: group-02
>
> test-description: Trinity is a linux system call fuzz tester.
> test-url: http://codemonkey.org.uk/projects/trinity/
>
>
> on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
>
> caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
>
>
> +---------------------------------------------+------------+------------+
> | | 58c0cc2d90 | dc13cac486 |
> +---------------------------------------------+------------+------------+
> | boot_successes | 42 | 14 |
> | boot_failures | 0 | 34 |
> | BUG:KASAN:stack-out-of-bounds_in_hgafb_open | 0 | 34 |
> +---------------------------------------------+------------+------------+
>
>
> If you fix the issue, kindly add following tag
> Reported-by: kernel test robot <[email protected]>
>
>
> [ 419.568887] BUG: KASAN: stack-out-of-bounds in hgafb_open (kbuild/src/consumer/drivers/video/fbdev/hgafb.c:375)
Looks like the return value of hga_card_detect() is not properly
handled causing the probe function to succeed even though
hga_card_detect() has failed. Since probe has succeeded, hgafb_open()
can be called which will end up operating on an unmapped hga_vram.
Patch on the way.
Thanks!
- Anirudh.