On Sat, Dec 4, 2021 at 5:53 PM syzbot
<syzbot+e9072e90624a31dfa...@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: d58071a8a76d Linux 5.16-rc3
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11f773f6b00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=171728a464c05f2b
> dashboard link: https://syzkaller.appspot.com/bug?extid=e9072e90624a31dfa85f
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils
> for Debian) 2.35.2
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+e9072e90624a31dfa...@syzkaller.appspotmail.com
>
> </TASK>
> general protection fault, probably for non-canonical address
> 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN
> KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077]
> CPU: 0 PID: 20114 Comm: syz-executor.3 Not tainted 5.16.0-rc3-syzkaller #0
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
> RIP: 0010:virtio_gpu_array_put_free+0x2f/0x190
> drivers/gpu/drm/virtio/virtgpu_gem.c:251
>From the description of stack trace, the bug resides in the missing
allocation of objs variable.
If fense is NULL, it will bypass the assignment of objs. And then in
the error handling of virtio_gpu_object_shmem_init, objs will be used
to dereference, leading to Null Pointer Dereference.
if (fence) {
ret = -ENOMEM;
objs = virtio_gpu_array_alloc(1); // if fence is NULL, this
assignment will be bypassed.
if (!objs)
goto err_put_id;
virtio_gpu_array_add_obj(objs, &bo->base.base);
ret = virtio_gpu_array_lock_resv(objs);
if (ret != 0)
goto err_put_objs;
}
ret = virtio_gpu_object_shmem_init(vgdev, bo, &ents, &nents);
if (ret != 0) {
virtio_gpu_array_put_free(objs);
virtio_gpu_free_object(&shmem_obj->base);
return ret;
}
> Code: 55 49 89 fd 41 54 55 53 48 83 ec 08 e8 5a dd 09 fd 49 8d 45 70 48 89 c2
> 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74
> 08 3c 03 0f 8e 21 01 00 00 41 8b 5d 70 31 ff
> RSP: 0018:ffffc90005a9fa90 EFLAGS: 00010202
> RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc900262ce000
> RDX: 000000000000000e RSI: ffffffff846cf6e6 RDI: 0000000000000000
> RBP: ffff88801882b800 R08: 0000000000000000 R09: ffffc90005a9f9ef
> R10: ffffffff846dcc29 R11: 0000000000000000 R12: ffffc90005a9fbd0
> R13: 0000000000000000 R14: ffff888045f60000 R15: 00000000fffffff4
> FS: 00007f4ad9393700(0000) GS:ffff88802ca00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f561e680558 CR3: 0000000050bde000 CR4: 0000000000150ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
> Call Trace:
> <TASK>
> virtio_gpu_object_create+0x5c7/0xd90
> drivers/gpu/drm/virtio/virtgpu_object.c:251
> virtio_gpu_gem_create drivers/gpu/drm/virtio/virtgpu_gem.c:42 [inline]
> virtio_gpu_mode_dumb_create+0x319/0x5c0
> drivers/gpu/drm/virtio/virtgpu_gem.c:90
> drm_mode_create_dumb+0x26c/0x2f0 drivers/gpu/drm/drm_dumb_buffers.c:96
> drm_ioctl_kernel+0x27d/0x4e0 drivers/gpu/drm/drm_ioctl.c:782
> drm_ioctl+0x51e/0x9d0 drivers/gpu/drm/drm_ioctl.c:885
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:874 [inline]
> __se_sys_ioctl fs/ioctl.c:860 [inline]
> __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:860
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x44/0xae
> RIP: 0033:0x7f4adbe1dae9
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48
> 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73
> 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007f4ad9393188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007f4adbf30f60 RCX: 00007f4adbe1dae9
> RDX: 0000000020000040 RSI: 00000000c02064b2 RDI: 0000000000000003
> RBP: 00007f4ad93931d0 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
> R13: 00007ffccb96db4f R14: 00007f4ad9393300 R15: 0000000000022000
> </TASK>
> Modules linked in:
> ---[ end trace 8191b5e5ff4f69ef ]---
> RIP: 0010:virtio_gpu_array_put_free+0x2f/0x190
> drivers/gpu/drm/virtio/virtgpu_gem.c:251
> Code: 55 49 89 fd 41 54 55 53 48 83 ec 08 e8 5a dd 09 fd 49 8d 45 70 48 89 c2
> 48 89 04 24 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84 c0 74
> 08 3c 03 0f 8e 21 01 00 00 41 8b 5d 70 31 ff
> RSP: 0018:ffffc90005a9fa90 EFLAGS: 00010202
> RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffc900262ce000
> RDX: 000000000000000e RSI: ffffffff846cf6e6 RDI: 0000000000000000
> RBP: ffff88801882b800 R08: 0000000000000000 R09: ffffc90005a9f9ef
> R10: ffffffff846dcc29 R11: 0000000000000000 R12: ffffc90005a9fbd0
> R13: 0000000000000000 R14: ffff888045f60000 R15: 00000000fffffff4
> FS: 00007f4ad9393700(0000) GS:ffff88802cb00000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 000000000065f4d7 CR3: 0000000050bde000 CR4: 0000000000150ee0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> ----------------
> Code disassembly (best guess):
> 0: 55 push %rbp
> 1: 49 89 fd mov %rdi,%r13
> 4: 41 54 push %r12
> 6: 55 push %rbp
> 7: 53 push %rbx
> 8: 48 83 ec 08 sub $0x8,%rsp
> c: e8 5a dd 09 fd callq 0xfd09dd6b
> 11: 49 8d 45 70 lea 0x70(%r13),%rax
> 15: 48 89 c2 mov %rax,%rdx
> 18: 48 89 04 24 mov %rax,(%rsp)
> 1c: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
> 23: fc ff df
> 26: 48 c1 ea 03 shr $0x3,%rdx
> * 2a: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax <-- trapping
> instruction
> 2e: 84 c0 test %al,%al
> 30: 74 08 je 0x3a
> 32: 3c 03 cmp $0x3,%al
> 34: 0f 8e 21 01 00 00 jle 0x15b
> 3a: 41 8b 5d 70 mov 0x70(%r13),%ebx
> 3e: 31 ff xor %edi,%edi
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkal...@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> --
> You received this message because you are subscribed to the Google Groups
> "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller-bugs+unsubscr...@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/syzkaller-bugs/000000000000372da005d24efed8%40google.com.
