syzbot


KASAN: vmalloc-out-of-bounds Write in drm_fb_helper_dirty_work

Status: auto-closed as invalid on 2020/05/04 00:35
Subsystems: dri
[Documentation on labels]
Reported-by: syzbot+fd418471717e1e1aa783@syzkaller.appspotmail.com
First crash: 1586d, last: 1572d
Discussions (1)
Title Replies (including bot) Last reply
KASAN: vmalloc-out-of-bounds Write in drm_fb_helper_dirty_work 0 (1) 2019/12/23 17:31
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: vmalloc-out-of-bounds Write in drm_fb_helper_dirty_work (3) dri 1 1275d 1271d 0/26 auto-closed as invalid on 2021/02/24 10:39
upstream KASAN: vmalloc-out-of-bounds Write in drm_fb_helper_dirty_work (2) dri 1 1445d 1444d 0/26 auto-closed as invalid on 2020/09/07 16:23

Sample crash report:
==================================================================
BUG: KASAN: vmalloc-out-of-bounds in memcpy include/linux/string.h:380 [inline]
BUG: KASAN: vmalloc-out-of-bounds in drm_fb_helper_dirty_blit_real drivers/gpu/drm/drm_fb_helper.c:399 [inline]
BUG: KASAN: vmalloc-out-of-bounds in drm_fb_helper_dirty_work+0x44c/0x780 drivers/gpu/drm/drm_fb_helper.c:428
Write of size 32 at addr ffffc9000ac97fe0 by task kworker/1:1/89

CPU: 1 PID: 89 Comm: kworker/1:1 Not tainted 5.5.0-rc4-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Workqueue: events drm_fb_helper_dirty_work
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x197/0x210 lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0x5/0x30b mm/kasan/report.c:374
 __kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
 kasan_report+0x12/0x20 mm/kasan/common.c:639
 check_memory_region_inline mm/kasan/generic.c:185 [inline]
 check_memory_region+0x134/0x1a0 mm/kasan/generic.c:192
 memcpy+0x38/0x50 mm/kasan/common.c:126
 memcpy include/linux/string.h:380 [inline]
 drm_fb_helper_dirty_blit_real drivers/gpu/drm/drm_fb_helper.c:399 [inline]
 drm_fb_helper_dirty_work+0x44c/0x780 drivers/gpu/drm/drm_fb_helper.c:428
 process_one_work+0x9af/0x1740 kernel/workqueue.c:2264
 worker_thread+0x98/0xe40 kernel/workqueue.c:2410
 kthread+0x361/0x430 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352


Memory state around the buggy address:
 ffffc9000ac97e80: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
 ffffc9000ac97f00: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
>ffffc9000ac97f80: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
                                                       ^
 ffffc9000ac98000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc9000ac98080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/01/05 00:34 upstream 5613970af3f5 68256974 .config console log report ci-qemu-upstream-386
2019/12/21 17:34 upstream 6210469417fd bc586918 .config console log report ci-qemu-upstream-386
* Struck through repros no longer work on HEAD.