KASAN: vmalloc-out-of-bounds Write in drm_fb_helper_dirty

Title	Replies (including bot)	Last reply
KASAN: vmalloc-out-of-bounds Write in drm_fb_helper_dirty_work (2)	0 (1)	2020/05/11 06:28

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KASAN: vmalloc-out-of-bounds Write in drm_fb_helper_dirty_work dri				2	1813d	1825d	0/28	auto-closed as invalid on 2020/05/04 00:35
upstream	KASAN: vmalloc-out-of-bounds Write in drm_fb_helper_dirty_work (3) dri				1	1517d	1513d	0/28	auto-closed as invalid on 2021/02/24 10:39

==================================================================
BUG: KASAN: vmalloc-out-of-bounds in memcpy include/linux/string.h:381 [inline]
BUG: KASAN: vmalloc-out-of-bounds in drm_fb_helper_dirty_blit_real drivers/gpu/drm/drm_fb_helper.c:386 [inline]
BUG: KASAN: vmalloc-out-of-bounds in drm_fb_helper_dirty_work+0x3f5/0x6b0 drivers/gpu/drm/drm_fb_helper.c:415
Write of size 32 at addr ffffc900290e5fe0 by task kworker/3:3/10902

CPU: 3 PID: 10902 Comm: kworker/3:3 Not tainted 5.7.0-rc4-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Workqueue: events drm_fb_helper_dirty_work
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0x5/0x315 mm/kasan/report.c:382
 __kasan_report.cold+0x35/0x4d mm/kasan/report.c:511
 kasan_report+0x33/0x50 mm/kasan/common.c:625
 check_memory_region_inline mm/kasan/generic.c:187 [inline]
 check_memory_region+0x141/0x190 mm/kasan/generic.c:193
 memcpy+0x39/0x60 mm/kasan/common.c:107
 memcpy include/linux/string.h:381 [inline]
 drm_fb_helper_dirty_blit_real drivers/gpu/drm/drm_fb_helper.c:386 [inline]
 drm_fb_helper_dirty_work+0x3f5/0x6b0 drivers/gpu/drm/drm_fb_helper.c:415
 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268
 worker_thread+0x96/0xe20 kernel/workqueue.c:2414
 kthread+0x388/0x470 kernel/kthread.c:268
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352


Memory state around the buggy address:
 ffffc900290e5e80: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
 ffffc900290e5f00: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
>ffffc900290e5f80: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
                                                       ^
 ffffc900290e6000: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
 ffffc900290e6080: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
==================================================================