https://bugzilla.kernel.org/show_bug.cgi?id=207665
Bug ID: 207665
Summary: virtio GPU driver dereferences null pointer while
using some Wayland applications
Product: Drivers
Version: 2.5
Kernel Version: 5.6.11
Hardware: x86-64
OS: Linux
Tree: Mainline
Status: NEW
Severity: normal
Priority: P1
Component: Video(DRI - non Intel)
Assignee: drivers_video-...@kernel-bugs.osdl.org
Reporter: c3bac...@protonmail.com
Regression: No
Created attachment 289029
--> https://bugzilla.kernel.org/attachment.cgi?id=289029&action=edit
The full kernel log
Relevant part of the kernel log:
[ 179.722024] BUG: kernel NULL pointer dereference, address: 0000000000000008
[ 179.723955] #PF: supervisor read access in kernel mode
[ 179.724503] #PF: error_code(0x0000) - not-present page
[ 179.725027] PGD 0 P4D 0
[ 179.725294] Oops: 0000 [#1] PREEMPT SMP PTI
[ 179.725738] CPU: 0 PID: 28 Comm: kworker/u2:1 Not tainted 5.6.11 #22
[ 179.726384] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
[ 179.727551] Workqueue: events_unbound commit_work
[ 179.728046] RIP: 0010:dma_fence_wait_timeout+0x21/0x120
[ 179.728581] Code: 84 00 00 00 00 00 0f 1f 00 0f 1f 44 00 00 41 55 41 54 55
53 48 85 d2 0f 88 fd 00 00 00 48 89 fb 89 f5 49 89 d5 0f 1f 44 00 00 <48> 8b 43
08 40 0f b6 f5 4c 89 ea 48 89 df 48 8b 40 28 48 85 c0 0f
[ 179.730636] RSP: 0018:ffffa8d4400ebda0 EFLAGS: 00010206
[ 179.731194] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
0000000000000000
[ 179.731947] RDX: 7fffffffffffffff RSI: 0000000000000001 RDI:
0000000000000000
[ 179.737139] RBP: 0000000000000001 R08: 0000000000000001 R09:
ffff8f7d37b3bf00
[ 179.737975] R10: 00000000000006c8 R11: 0000000000000018 R12:
ffff8f7dbab46c00
[ 179.738726] R13: 7fffffffffffffff R14: ffff8f7dbab50000 R15:
000000000000000c
[ 179.739479] FS: 0000000000000000(0000) GS:ffff8f7dbbc00000(0000)
knlGS:0000000000000000
[ 179.740329] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 179.740938] CR2: 0000000000000008 CR3: 0000000131c42004 CR4:
0000000000360ef0
[ 179.741695] Call Trace:
[ 179.741988] virtio_gpu_cursor_plane_update+0x1bb/0x290
[ 179.742379] drm_atomic_helper_commit_planes+0xb8/0x220
[ 179.742753] vgdev_atomic_commit_tail+0x32/0x60
[ 179.743079] commit_tail+0x94/0x130
[ 179.743332] process_one_work+0x1da/0x3d0
[ 179.743621] worker_thread+0x4a/0x3d0
[ 179.743885] kthread+0xfb/0x130
[ 179.744115] ? process_one_work+0x3d0/0x3d0
[ 179.744532] ? kthread_park+0x90/0x90
[ 179.744891] ret_from_fork+0x35/0x40
[ 179.745378] Modules linked in:
[ 179.745600] CR2: 0000000000000008
[ 179.745946] ---[ end trace 8cef036ef4df2477 ]---
[ 179.746256] RIP: 0010:dma_fence_wait_timeout+0x21/0x120
[ 179.746604] Code: 84 00 00 00 00 00 0f 1f 00 0f 1f 44 00 00 41 55 41 54 55
53 48 85 d2 0f 88 fd 00 00 00 48 89 fb 89 f5 49 89 d5 0f 1f 44 00 00 <48> 8b 43
08 40 0f b6 f5 4c 89 ea 48 89 df 48 8b 40 28 48 85 c0 0f
[ 179.747892] RSP: 0018:ffffa8d4400ebda0 EFLAGS: 00010206
[ 179.748373] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
0000000000000000
[ 179.753551] RDX: 7fffffffffffffff RSI: 0000000000000001 RDI:
0000000000000000
[ 179.754141] RBP: 0000000000000001 R08: 0000000000000001 R09:
ffff8f7d37b3bf00
[ 179.754679] R10: 00000000000006c8 R11: 0000000000000018 R12:
ffff8f7dbab46c00
[ 179.755203] R13: 7fffffffffffffff R14: ffff8f7dbab50000 R15:
000000000000000c
[ 179.755727] FS: 0000000000000000(0000) GS:ffff8f7dbbc00000(0000)
knlGS:0000000000000000
[ 179.756318] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 179.756742] CR2: 0000000000000008 CR3: 0000000131c42004 CR4:
0000000000360ef0
This is on a QEMU machine started with the following command:
exec qemu-system-x86_64 -enable-kvm -display gtk -vga virtio -cpu host -m 4G
-netdev tap,ifname=vmtap0,id=vn0,script=no,downscript=no -device
virtio-net-pci,netdev=vn0 -kernel kernel.img -drive
file=file.img,format=raw,if=virtio -virtfs
local,path=mnt,mount_tag=host0,security_model=passthrough,id=host0 -append
"console=ttyS0 root=/dev/vda rw"
On QEMU 5.0.50 with one patch related to 9p virtfs applied(don't think it's
relevant)
The guest and host are both Arch Linux, with the host kernel version 5.5.7. I'm
using the proprietary NVIDIA drivers on the host, but I don't think it matters
since it's not passthrough.
To reproduce, install firefox, Xwayland and sway from the Arch Linux
repositories. Then just open firefox in sway, open a few new tabs, then attempt
to exit firefox. It seems the "Are you sure you want to close x tabs?" dialog
triggers it.
--
You are receiving this mail because:
You are watching the assignee of the bug.
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
