radeon UBSAN warning from user syscall

Tue Nov 26 14:45:35 UTC 2019

On Tue, Nov 26, 2019 at 3:39 AM Meelis Roos <mroos at linux.ee> wrote:
>
> I tried latest (5.4) custom kernel (with UBSAN) on my Dell D600 laptop and found that it exhibits a
> UBSAN warning triggered by userspace ioctl. Here is dmesg with anything radeon-related + the warning, and config:
>
> [   17.659534] [drm] radeon kernel modesetting enabled.
> [   17.659607] radeon 0000:01:00.0: remove_conflicting_pci_framebuffers: bar 0: 0xe8000000 -> 0xefffffff
> [   17.659609] radeon 0000:01:00.0: remove_conflicting_pci_framebuffers: bar 2: 0xfcff0000 -> 0xfcffffff
> [   17.659613] radeon 0000:01:00.0: vgaarb: deactivate vga console
> [   17.661629] Console: switching to colour dummy device 80x25
> [   17.667764] [drm] initializing kernel modesetting (RV250 0x1002:0x4C66 0x1028:0x011D 0x01).
> [   17.667822] resource sanity check: requesting [mem 0x000c0000-0x000dffff], which spans more than PCI Bus 0000:00 [mem 0x000d0000-0x000dffff window]
> [   17.667832] caller pci_map_rom+0x6d/0x19a mapping multiple BARs
> [   17.668236] agpgart-intel 0000:00:00.0: AGP 2.0 bridge
> [   17.668246] agpgart-intel 0000:00:00.0: putting AGP V2 device into 4x mode
> [   17.668269] radeon 0000:01:00.0: putting AGP V2 device into 4x mode
> [   17.668291] radeon 0000:01:00.0: GTT: 128M 0xE0000000 - 0xE7FFFFFF
> [   17.668299] radeon 0000:01:00.0: VRAM: 128M 0x00000000E8000000 - 0x00000000EFFFFFFF (32M used)
> [   17.668336] [drm] Detected VRAM RAM=128M, BAR=128M
> [   17.668337] [drm] RAM width 64bits DDR
> [   17.681858] [TTM] Zone  kernel: Available graphics memory: 412324 KiB
> [   17.681861] [TTM] Initializing pool allocator
> [   17.681868] [TTM] Initializing DMA pool allocator
> [   17.681905] [drm] radeon: 32M of VRAM memory ready
> [   17.681907] [drm] radeon: 128M of GTT memory ready.
> [   17.681918] [drm] radeon: power management initialized
> [   17.685726] radeon 0000:01:00.0: WB disabled
> [   17.685735] radeon 0000:01:00.0: fence driver on ring 0 use gpu addr 0x00000000e0000000 and cpu addr 0x116c2780
> [   17.685738] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
> [   17.685739] [drm] Driver supports precise vblank timestamp query.
> [   17.685755] [drm] radeon: irq initialized.
> [   17.685758] [drm] Loading R200 Microcode
> [   17.788181] [drm] radeon: ring at 0x00000000E0001000
> [   17.788207] [drm] ring test succeeded in 1 usecs
> [   17.788379] [drm] ib test succeeded in 0 usecs
> [   17.788845] [drm] Panel ID String: 2K077 141X13
>
> [   17.788846] [drm] Panel Size 1024x768
> [   17.788880] [drm] No TV DAC info found in BIOS
> [   17.788912] [drm] Radeon Display Connectors
> [   17.788913] [drm] Connector 0:
> [   17.788914] [drm]   VGA-1
> [   17.788916] [drm]   DDC: 0x60 0x60 0x60 0x60 0x60 0x60 0x60 0x60
> [   17.788917] [drm]   Encoders:
> [   17.788918] [drm]     CRT1: INTERNAL_DAC1
> [   17.788920] [drm] Connector 1:
> [   17.788920] [drm]   DVI-D-1
> [   17.788921] [drm]   HPD1
> [   17.788923] [drm]   DDC: 0x64 0x64 0x64 0x64 0x64 0x64 0x64 0x64
> [   17.788923] [drm]   Encoders:
> [   17.788924] [drm]     DFP1: INTERNAL_TMDS1
> [   17.788925] [drm] Connector 2:
> [   17.788925] [drm]   LVDS-1
> [   17.788926] [drm]   Encoders:
> [   17.788927] [drm]     LCD1: INTERNAL_LVDS
> [   17.788927] [drm] Connector 3:
> [   17.788928] [drm]   SVIDEO-1
> [   17.788929] [drm]   Encoders:
> [   17.788929] [drm]     TV1: INTERNAL_DAC2
> [   17.957500] [drm] fb mappable at 0xE8040000
> [   17.957503] [drm] vram apper at 0xE8000000
> [   17.957504] [drm] size 1572864
> [   17.957505] [drm] fb depth is 16
> [   17.957505] [drm]    pitch is 2048
> [   18.013861] fbcon: radeondrmfb (fb0) is primary device
> [   18.566984] Console: switching to colour frame buffer device 128x48
> [   18.576250] radeon 0000:01:00.0: fb0: radeondrmfb frame buffer device
> [   18.577844] [drm] Initialized radeon 2.50.0 20080528 for 0000:01:00.0 on minor 0
> [   64.194226] ================================================================================
> [   64.194238] UBSAN: Undefined behaviour in drivers/gpu/drm/radeon/r200.c:480:34
> [   64.194244] shift exponent 4096 is too large for 32-bit type 'int'
> [   64.194248] CPU: 0 PID: 447 Comm: Xorg Not tainted 5.4.0 #16
> [   64.194249] Hardware name: Dell Computer Corporation Latitude D600                   /0X2034, BIOS A16 06/29/2005
> [   64.194251] Call Trace:
> [   64.194266]  dump_stack+0x16/0x19
> [   64.194272]  ubsan_epilogue+0xb/0x29
> [   64.194274]  __ubsan_handle_shift_out_of_bounds.cold+0x26/0x78
> [   64.194368]  ? radeon_cs_packet_next_reloc+0x3c/0x170 [radeon]
> [   64.194403]  ? r100_reloc_pitch_offset+0x27/0x140 [radeon]
> [   64.194433]  r200_packet0_check.cold+0x5e/0x63 [radeon]
> [   64.194473]  ? r200_copy_dma+0x430/0x430 [radeon]
> [   64.194508]  r100_cs_parse_packet0+0x53/0xe0 [radeon]
> [   64.194543]  r100_cs_parse+0x2de/0x4b0 [radeon]
> [   64.194583]  ? r200_copy_dma+0x430/0x430 [radeon]
> [   64.194617]  radeon_cs_ioctl+0x305/0x890 [radeon]
> [   64.194626]  ? ttm_bo_init_reserved+0x2f0/0x390 [ttm]
> [   64.194662]  ? radeon_cs_parser_init+0x550/0x550 [radeon]
> [   64.194689]  drm_ioctl_kernel+0x8b/0xd0 [drm]
> [   64.194724]  ? radeon_cs_parser_init+0x550/0x550 [radeon]
> [   64.194735]  drm_ioctl+0x249/0x4f0 [drm]
> [   64.194740]  ? ttm_bo_vm_fault+0xce/0x5a0 [ttm]
> [   64.194774]  ? radeon_cs_parser_init+0x550/0x550 [radeon]
> [   64.194780]  ? ktime_get_mono_fast_ns+0xbe/0x200
> [   64.194805]  radeon_drm_ioctl+0x40/0x80 [radeon]
> [   64.194829]  ? radeon_pmops_resume+0x60/0x60 [radeon]
> [   64.194833]  do_vfs_ioctl+0x3fc/0x6b0
> [   64.194838]  ? vm_mmap_pgoff+0x86/0xd0
> [   64.194845]  ? add_sysfs_fw_map_entry+0x8c/0x8c
> [   64.194847]  ksys_ioctl+0x37/0x70
> [   64.194849]  sys_ioctl+0x11/0x13
> [   64.194852]  do_fast_syscall_32+0x95/0x240
> [   64.194857]  entry_SYSENTER_32+0xa9/0xfb
> [   64.194859] EIP: 0xb7ef29a9
> [   64.194862] Code: 5d c3 8d b4 26 00 00 00 00 b8 00 09 3d 00 eb b4 8b 04 24 c3 8b 14 24 c3 8b 1c 24 c3 8b 34 24 c3 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d 76 00 58 b8 77 00 00 00 cd 80 90 8d 76
> [   64.194864] EAX: ffffffda EBX: 0000000e ECX: c0206466 EDX: 0145cb10
> [   64.194866] ESI: 0145c8d0 EDI: c0206466 EBP: 0000000e ESP: bff7a708
> [   64.194867] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b EFLAGS: 00203292
> [   64.194869] ================================================================================

Looks like the shift and mask are reversed.  Does this patch fix it?

Alex
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-drm-radeon-fix-r1xx-r2xx-register-checker-for-POT-te.patch
Type: text/x-patch
Size: 2293 bytes
Desc: not available
URL: <https://lists.freedesktop.org/archives/amd-gfx/attachments/20191126/aadc0459/attachment-0001.bin>