bisecting fixing commit since d09b80172c22df7a5e2ec58aa1a0fbe8914752e7 building syzkaller on 2d5ea0cb6edb828803beea8af38dbc04dc80f028 testing commit d09b80172c22df7a5e2ec58aa1a0fbe8914752e7 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 42277e3fa82574fc9d77faf22dc711464893d9963eea7c0690e9256a23a417c8 all runs: crashed: BUG: unable to handle kernel paging request in cfb_imageblit testing current HEAD 2950c9c5e0df6bd34af45a5168bbee345e95eae2 testing commit 2950c9c5e0df6bd34af45a5168bbee345e95eae2 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: b9b138e7909c720a4fd5d8ca4264c68dbbf58d11a8bfb64ff421d848284beb64 all runs: OK # git bisect start 2950c9c5e0df6bd34af45a5168bbee345e95eae2 d09b80172c22df7a5e2ec58aa1a0fbe8914752e7 Bisecting: 2429 revisions left to test after this (roughly 11 steps) [4de0881b989066a2842baef072125a00723d1c77] ASoC: Intel: bytcr_rt5640: Add quirk for ARCHOS Cesium 140 testing commit 4de0881b989066a2842baef072125a00723d1c77 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 12e2750aaf732010dc881e60fecab7a32626d6c1369c3e64bc14c2ec8849fda4 all runs: crashed: BUG: unable to handle kernel paging request in cfb_imageblit # git bisect good 4de0881b989066a2842baef072125a00723d1c77 Bisecting: 1214 revisions left to test after this (roughly 10 steps) [9ccbe18eb48a9b27b646931e01d84dfe0bc8a10d] nvme-loop: check for NVME_LOOP_Q_LIVE in nvme_loop_destroy_admin_queue() testing commit 9ccbe18eb48a9b27b646931e01d84dfe0bc8a10d compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: c91d58faa3a206b307c5cc8756b25aa7e00ff27c478fd3db9d84c0ebbab1a1de all runs: crashed: BUG: unable to handle kernel paging request in cfb_imageblit # git bisect good 9ccbe18eb48a9b27b646931e01d84dfe0bc8a10d Bisecting: 607 revisions left to test after this (roughly 9 steps) [46cc1391606454dddd25042e760abc8781cc37c6] e1000e: Fix an error handling path in 'e1000_probe()' testing commit 46cc1391606454dddd25042e760abc8781cc37c6 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: d19f1ca9a950eaae371eb328637d5ecb9f3978626729395257d66b651d471a51 all runs: crashed: BUG: unable to handle kernel paging request in cfb_imageblit # git bisect good 46cc1391606454dddd25042e760abc8781cc37c6 Bisecting: 303 revisions left to test after this (roughly 8 steps) [e7f5aefd15d9d020065f6f076e2b6e054198317a] qed: Fix null-pointer dereference in qed_rdma_create_qp() testing commit e7f5aefd15d9d020065f6f076e2b6e054198317a compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 9b37c26022892fc2cd52e58a1365306eb17758f32ffeb0d8799c08156d032f8e run #0: OK run #1: crashed: BUG: unable to handle kernel paging request in cfb_imageblit run #2: crashed: BUG: unable to handle kernel paging request in cfb_imageblit run #3: crashed: BUG: unable to handle kernel paging request in cfb_imageblit run #4: crashed: BUG: unable to handle kernel paging request in cfb_imageblit run #5: crashed: BUG: unable to handle kernel paging request in cfb_imageblit run #6: crashed: BUG: unable to handle kernel paging request in cfb_imageblit run #7: crashed: BUG: unable to handle kernel paging request in cfb_imageblit run #8: crashed: BUG: unable to handle kernel paging request in cfb_imageblit run #9: crashed: BUG: unable to handle kernel paging request in cfb_imageblit # git bisect good e7f5aefd15d9d020065f6f076e2b6e054198317a Bisecting: 151 revisions left to test after this (roughly 7 steps) [aab312696d37de80502ca633b40184de24f22917] crypto: public_key: fix overflow during implicit conversion testing commit aab312696d37de80502ca633b40184de24f22917 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 1edd070e878b186fa23dd850170a7c38db6d19158af221118e7ec7e42d9cf21e all runs: OK # git bisect bad aab312696d37de80502ca633b40184de24f22917 Bisecting: 75 revisions left to test after this (roughly 6 steps) [ba0a4e09a438871b9ce7052dfcc156e9df1c71b2] Bluetooth: sco: prevent information leak in sco_conn_defer_accept() testing commit ba0a4e09a438871b9ce7052dfcc156e9df1c71b2 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 3517a61b498f319079ccdf5d7fea47030d09ff20afc94d9828754def3b4d3bea all runs: OK # git bisect bad ba0a4e09a438871b9ce7052dfcc156e9df1c71b2 Bisecting: 37 revisions left to test after this (roughly 5 steps) [5339240fb9e5aedd97a43d04bd9847000fc3f955] usb: mtu3: fix the wrong HS mult value testing commit 5339240fb9e5aedd97a43d04bd9847000fc3f955 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: f9e469fe2aa71f8bc4d1d0384ed00ecd698e537f687d7d728cda8680ec735d21 all runs: OK # git bisect bad 5339240fb9e5aedd97a43d04bd9847000fc3f955 Bisecting: 18 revisions left to test after this (roughly 4 steps) [9c62e4ae337ad450659fff72a627e3c2738c7bbe] ARM: 8918/2: only build return_address() if needed testing commit 9c62e4ae337ad450659fff72a627e3c2738c7bbe compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 221aef67cfe34c968111563f8d0c2bf5a19149a4af2b2af373305bdfdab75ff6 all runs: OK # git bisect bad 9c62e4ae337ad450659fff72a627e3c2738c7bbe Bisecting: 9 revisions left to test after this (roughly 3 steps) [b172b44fcb1771e083aad806fa96f3f60e2ddfac] Linux 4.19.206 testing commit b172b44fcb1771e083aad806fa96f3f60e2ddfac compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: ff2f5b52d9c7cb66a22a759c5ef848ec85e8669aabdfcec4fc929c27ecca7782 all runs: OK # git bisect bad b172b44fcb1771e083aad806fa96f3f60e2ddfac Bisecting: 4 revisions left to test after this (roughly 2 steps) [0776c1a20babb4ad0b7ce7f2f4e0806a97663187] vt_kdsetmode: extend console locking testing commit 0776c1a20babb4ad0b7ce7f2f4e0806a97663187 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 7f795414570fa38ddc6e63b40fc1c402754897780834bbdd359d869a49993419 all runs: crashed: BUG: unable to handle kernel paging request in cfb_imageblit # git bisect good 0776c1a20babb4ad0b7ce7f2f4e0806a97663187 Bisecting: 2 revisions left to test after this (roughly 1 step) [3db3ec8f3b414fa76d3a9ae864781ebbb1709a36] KVM: x86/mmu: Treat NX as used (not reserved) for all !TDP shadow MMUs testing commit 3db3ec8f3b414fa76d3a9ae864781ebbb1709a36 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 735c8478d87ed8ded33b1c9873f0ea64eb3fe1493a3e363af920f2ecbb9604e0 all runs: OK # git bisect bad 3db3ec8f3b414fa76d3a9ae864781ebbb1709a36 Bisecting: 0 revisions left to test after this (roughly 0 steps) [6be10fb6c143608a7c7ab3901a096e272233bf64] fbmem: add margin check to fb_check_caps() testing commit 6be10fb6c143608a7c7ab3901a096e272233bf64 compiler: gcc version 8.4.1 20210217 (GCC) kernel signature: 70248da47c759552fbca38cd87c9f328189d5733e0cde4f289d8643e6dc0537f all runs: OK # git bisect bad 6be10fb6c143608a7c7ab3901a096e272233bf64 6be10fb6c143608a7c7ab3901a096e272233bf64 is the first bad commit commit 6be10fb6c143608a7c7ab3901a096e272233bf64 Author: George Kennedy Date: Tue Jul 7 15:26:03 2020 -0400 fbmem: add margin check to fb_check_caps() commit a49145acfb975d921464b84fe00279f99827d816 upstream. A fb_ioctl() FBIOPUT_VSCREENINFO call with invalid xres setting or yres setting in struct fb_var_screeninfo will result in a KASAN: vmalloc-out-of-bounds failure in bitfill_aligned() as the margins are being cleared. The margins are cleared in chunks and if the xres setting or yres setting is a value of zero upto the chunk size, the failure will occur. Add a margin check to validate xres and yres settings. Signed-off-by: George Kennedy Reported-by: syzbot+e5fd3e65515b48c02a30@syzkaller.appspotmail.com Reviewed-by: Dan Carpenter Cc: Dhaval Giani Signed-off-by: Bartlomiej Zolnierkiewicz Link: https://patchwork.freedesktop.org/patch/msgid/1594149963-13801-1-git-send-email-george.kennedy@oracle.com Signed-off-by: Greg Kroah-Hartman drivers/video/fbdev/core/fbmem.c | 4 ++++ 1 file changed, 4 insertions(+) culprit signature: 70248da47c759552fbca38cd87c9f328189d5733e0cde4f289d8643e6dc0537f parent signature: 7f795414570fa38ddc6e63b40fc1c402754897780834bbdd359d869a49993419 revisions tested: 14, total time: 4h8m38.366922384s (build: 2h34m11.62399347s, test: 1h32m39.24242036s) first good commit: 6be10fb6c143608a7c7ab3901a096e272233bf64 fbmem: add margin check to fb_check_caps() recipients (to): ["b.zolnierkie@samsung.com" "dan.carpenter@oracle.com" "george.kennedy@oracle.com" "gregkh@linuxfoundation.org"] recipients (cc): []