BUG: drm, nouveau: slab-out-of-bounds read access in nv50_fbcon_imageblit()

Jerome Marchand jmarchan at redhat.com
Tue May 24 14:35:18 UTC 2016


While testing a kernel with KASan enabled I've encountered several
out-of-bounds read warning in the nouveau driver. It seems to be
caused by inconsistent alignment requirements.

The function soft_cursor() (which I assume draw the cursor on the
console) calls fb_get_buffer_offset() which make sure there is still
room in the pixmap buffer (allocated in do_register_framebuffer()) to
copy the data (I assume a pixmap of the cursor). After the copy,
soft_cursor() sets image.data to point to the copied data in the
buffer (buf + offset) and calls nouveau_fbcon_imageblit(), which in
turn call nv50_fbcon_imageblit(). However in soft_cursor(), the data
is only aligned on 8 bits, while in nv50_fbcon_imageblit() the
alignment requirement is 32 bits. For a 8x16 cursor, the data copied
to the buffer in soft_cursor() is only 16 bytes, while
nv50_fbcon_imageblit() tries to read 64 bytes.

Someone has already reported the same issue on nvc0_fbcon_imageblit():
https://lists.freedesktop.org/archives/dri-devel/2015-November/095100.html
nv04_fbcon_imageblit() is probably affected too.

Here is the KASan report. It's from a modified RHEL7 kernel, but the
relevant code is the same as upstream.

[   38.367524] ================================================================== 
[   38.367538] BUG: KASAN: slab-out-of-bounds in memcpy+0x1d/0x40 at addr ffff8800957f6230 
[   38.367542] Read of size 64 by task kworker/0:2/68 
[   38.367545] ============================================================================= 
[   38.367549] BUG kmalloc-8192 (Tainted: G          I    ------------  ): kasan: bad access detected 
[   38.367551] ----------------------------------------------------------------------------- 
[   38.367551]  
[   38.367552] Disabling lock debugging due to kernel taint 
[   38.367562] INFO: Allocated in register_framebuffer+0x4b9/0x5a0 age=25205 cpu=0 pid=267 
[   38.367566] 	__slab_alloc+0x248/0x5f0 
[   38.367571] 	kmem_cache_alloc_trace+0x278/0x390 
[   38.367575] 	register_framebuffer+0x4b9/0x5a0 
[   38.367597] 	drm_fb_helper_initial_config+0x54c/0x810 [drm_kms_helper] 
[   38.367725] 	nouveau_fbcon_init+0x154/0x190 [nouveau] 
[   38.367841] 	nouveau_drm_load+0x6bf/0x9f0 [nouveau] 
[   38.367883] 	drm_dev_register+0xc9/0x160 [drm] 
[   38.367923] 	drm_get_pci_dev+0xcc/0x3a0 [drm] 
[   38.368039] 	nouveau_drm_probe+0x3bb/0x4f0 [nouveau] 
[   38.368043] 	local_pci_probe+0x7a/0xd0 
[   38.368047] 	pci_device_probe+0x1b9/0x210 
[   38.368054] 	driver_probe_device+0xc6/0x530 
[   38.368059] 	__driver_attach+0xcb/0xd0 
[   38.368063] 	bus_for_each_dev+0xfc/0x180 
[   38.368068] 	driver_attach+0x2b/0x30 
[   38.368072] 	bus_add_driver+0x348/0x440 
[   38.368077] INFO: Slab 0xffffea000255fc00 objects=3 used=3 fp=0x          (null) flags=0x1fffff00004080 
[   38.368080] INFO: Object 0xffff8800957f4260 @offset=16992 fp=0x          (null) 
[   38.368080]  
[   38.368086] Bytes b4 ffff8800957f4250: 02 00 00 00 a6 01 00 00 cd a8 fb ff 00 00 00 00  ................ 
[   38.368091] Object ffff8800957f4260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368095] Object ffff8800957f4270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368100] Object ffff8800957f4280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368104] Object ffff8800957f4290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368109] Object ffff8800957f42a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368113] Object ffff8800957f42b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368117] Object ffff8800957f42c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368122] Object ffff8800957f42d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368126] Object ffff8800957f42e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368131] Object ffff8800957f42f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368135] Object ffff8800957f4300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368139] Object ffff8800957f4310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368144] Object ffff8800957f4320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368148] Object ffff8800957f4330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368153] Object ffff8800957f4340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368157] Object ffff8800957f4350: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368162] Object ffff8800957f4360: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368166] Object ffff8800957f4370: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368170] Object ffff8800957f4380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368175] Object ffff8800957f4390: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368179] Object ffff8800957f43a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368184] Object ffff8800957f43b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368188] Object ffff8800957f43c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368193] Object ffff8800957f43d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368197] Object ffff8800957f43e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368201] Object ffff8800957f43f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368206] Object ffff8800957f4400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368210] Object ffff8800957f4410: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368215] Object ffff8800957f4420: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368219] Object ffff8800957f4430: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368224] Object ffff8800957f4440: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368228] Object ffff8800957f4450: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368232] Object ffff8800957f4460: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368237] Object ffff8800957f4470: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368241] Object ffff8800957f4480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368246] Object ffff8800957f4490: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368250] Object ffff8800957f44a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368255] Object ffff8800957f44b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368259] Object ffff8800957f44c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368263] Object ffff8800957f44d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368268] Object ffff8800957f44e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368272] Object ffff8800957f44f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368277] Object ffff8800957f4500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368281] Object ffff8800957f4510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368285] Object ffff8800957f4520: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368290] Object ffff8800957f4530: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368294] Object ffff8800957f4540: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368299] Object ffff8800957f4550: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368303] Object ffff8800957f4560: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368308] Object ffff8800957f4570: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368312] Object ffff8800957f4580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368316] Object ffff8800957f4590: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368321] Object ffff8800957f45a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368325] Object ffff8800957f45b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368330] Object ffff8800957f45c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368334] Object ffff8800957f45d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368339] Object ffff8800957f45e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368343] Object ffff8800957f45f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368347] Object ffff8800957f4600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368352] Object ffff8800957f4610: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368356] Object ffff8800957f4620: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368361] Object ffff8800957f4630: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368365] Object ffff8800957f4640: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368370] Object ffff8800957f4650: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368374] Object ffff8800957f4660: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368378] Object ffff8800957f4670: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368383] Object ffff8800957f4680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368387] Object ffff8800957f4690: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368392] Object ffff8800957f46a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368396] Object ffff8800957f46b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368401] Object ffff8800957f46c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368405] Object ffff8800957f46d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368409] Object ffff8800957f46e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368414] Object ffff8800957f46f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368418] Object ffff8800957f4700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368423] Object ffff8800957f4710: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368427] Object ffff8800957f4720: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368432] Object ffff8800957f4730: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368436] Object ffff8800957f4740: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368440] Object ffff8800957f4750: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368445] Object ffff8800957f4760: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368449] Object ffff8800957f4770: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368454] Object ffff8800957f4780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368458] Object ffff8800957f4790: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368463] Object ffff8800957f47a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368467] Object ffff8800957f47b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368471] Object ffff8800957f47c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368476] Object ffff8800957f47d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368480] Object ffff8800957f47e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368485] Object ffff8800957f47f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368489] Object ffff8800957f4800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368493] Object ffff8800957f4810: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368498] Object ffff8800957f4820: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368502] Object ffff8800957f4830: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368507] Object ffff8800957f4840: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368511] Object ffff8800957f4850: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368516] Object ffff8800957f4860: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368520] Object ffff8800957f4870: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368524] Object ffff8800957f4880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368529] Object ffff8800957f4890: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368533] Object ffff8800957f48a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368538] Object ffff8800957f48b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368542] Object ffff8800957f48c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368547] Object ffff8800957f48d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368551] Object ffff8800957f48e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368555] Object ffff8800957f48f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368560] Object ffff8800957f4900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368564] Object ffff8800957f4910: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368569] Object ffff8800957f4920: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368573] Object ffff8800957f4930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368578] Object ffff8800957f4940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368582] Object ffff8800957f4950: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368586] Object ffff8800957f4960: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368591] Object ffff8800957f4970: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368595] Object ffff8800957f4980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368600] Object ffff8800957f4990: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368604] Object ffff8800957f49a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368609] Object ffff8800957f49b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368613] Object ffff8800957f49c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368617] Object ffff8800957f49d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368622] Object ffff8800957f49e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368626] Object ffff8800957f49f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368631] Object ffff8800957f4a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368635] Object ffff8800957f4a10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368639] Object ffff8800957f4a20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368644] Object ffff8800957f4a30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368648] Object ffff8800957f4a40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368653] Object ffff8800957f4a50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368657] Object ffff8800957f4a60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368662] Object ffff8800957f4a70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368666] Object ffff8800957f4a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368671] Object ffff8800957f4a90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368675] Object ffff8800957f4aa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368679] Object ffff8800957f4ab0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368684] Object ffff8800957f4ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368688] Object ffff8800957f4ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368693] Object ffff8800957f4ae0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368697] Object ffff8800957f4af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368701] Object ffff8800957f4b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368706] Object ffff8800957f4b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368710] Object ffff8800957f4b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368715] Object ffff8800957f4b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368719] Object ffff8800957f4b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368724] Object ffff8800957f4b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368728] Object ffff8800957f4b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368732] Object ffff8800957f4b70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368737] Object ffff8800957f4b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368741] Object ffff8800957f4b90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368746] Object ffff8800957f4ba0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368750] Object ffff8800957f4bb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368755] Object ffff8800957f4bc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368759] Object ffff8800957f4bd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368763] Object ffff8800957f4be0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368768] Object ffff8800957f4bf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368772] Object ffff8800957f4c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368777] Object ffff8800957f4c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368781] Object ffff8800957f4c20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368786] Object ffff8800957f4c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368790] Object ffff8800957f4c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368794] Object ffff8800957f4c50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368799] Object ffff8800957f4c60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368803] Object ffff8800957f4c70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368808] Object ffff8800957f4c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368812] Object ffff8800957f4c90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368817] Object ffff8800957f4ca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368821] Object ffff8800957f4cb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368825] Object ffff8800957f4cc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368830] Object ffff8800957f4cd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368834] Object ffff8800957f4ce0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368839] Object ffff8800957f4cf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368843] Object ffff8800957f4d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368847] Object ffff8800957f4d10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368852] Object ffff8800957f4d20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368856] Object ffff8800957f4d30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368861] Object ffff8800957f4d40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368865] Object ffff8800957f4d50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368870] Object ffff8800957f4d60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368874] Object ffff8800957f4d70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368878] Object ffff8800957f4d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368883] Object ffff8800957f4d90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368887] Object ffff8800957f4da0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368892] Object ffff8800957f4db0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368896] Object ffff8800957f4dc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368901] Object ffff8800957f4dd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368905] Object ffff8800957f4de0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368909] Object ffff8800957f4df0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368914] Object ffff8800957f4e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368918] Object ffff8800957f4e10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368923] Object ffff8800957f4e20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368927] Object ffff8800957f4e30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368932] Object ffff8800957f4e40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368936] Object ffff8800957f4e50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368940] Object ffff8800957f4e60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368945] Object ffff8800957f4e70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368949] Object ffff8800957f4e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368954] Object ffff8800957f4e90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368958] Object ffff8800957f4ea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368963] Object ffff8800957f4eb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368967] Object ffff8800957f4ec0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368971] Object ffff8800957f4ed0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368976] Object ffff8800957f4ee0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368980] Object ffff8800957f4ef0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368985] Object ffff8800957f4f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368989] Object ffff8800957f4f10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368994] Object ffff8800957f4f20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.368998] Object ffff8800957f4f30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369002] Object ffff8800957f4f40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369007] Object ffff8800957f4f50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369011] Object ffff8800957f4f60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369016] Object ffff8800957f4f70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369020] Object ffff8800957f4f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369024] Object ffff8800957f4f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369029] Object ffff8800957f4fa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369033] Object ffff8800957f4fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369038] Object ffff8800957f4fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369042] Object ffff8800957f4fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369047] Object ffff8800957f4fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369051] Object ffff8800957f4ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369056] Object ffff8800957f5000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369060] Object ffff8800957f5010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369064] Object ffff8800957f5020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369069] Object ffff8800957f5030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369073] Object ffff8800957f5040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369078] Object ffff8800957f5050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369082] Object ffff8800957f5060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369087] Object ffff8800957f5070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369091] Object ffff8800957f5080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369095] Object ffff8800957f5090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369100] Object ffff8800957f50a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369104] Object ffff8800957f50b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369109] Object ffff8800957f50c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369113] Object ffff8800957f50d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369117] Object ffff8800957f50e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369122] Object ffff8800957f50f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369126] Object ffff8800957f5100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369131] Object ffff8800957f5110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369135] Object ffff8800957f5120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369140] Object ffff8800957f5130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369144] Object ffff8800957f5140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369148] Object ffff8800957f5150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369153] Object ffff8800957f5160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369157] Object ffff8800957f5170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369162] Object ffff8800957f5180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369166] Object ffff8800957f5190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369171] Object ffff8800957f51a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369175] Object ffff8800957f51b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369179] Object ffff8800957f51c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369184] Object ffff8800957f51d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369188] Object ffff8800957f51e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369193] Object ffff8800957f51f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369197] Object ffff8800957f5200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369202] Object ffff8800957f5210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369206] Object ffff8800957f5220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369210] Object ffff8800957f5230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369215] Object ffff8800957f5240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369219] Object ffff8800957f5250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................ 
[   38.369226] CPU: 0 PID: 68 Comm: kworker/0:2 Tainted: G    B     I    ------------   3.10.0-402.el7.test.kasanfixcifs3.x86_64 #1 
[   38.369230] Hardware name: Hewlett-Packard HP Z600 Workstation/0AE8h, BIOS 786G4 v03.13 10/13/2010 
[   38.369236] Workqueue: events fb_flashcursor 
[   38.369243]  ffff8800957f0000 00000000a59ee273 ffff880096fb7810 ffffffff81ae4495 
[   38.369249]  ffff880096fb7840 ffffffff8130eb7d ffff88009f804e00 ffffea000255fc00 
[   38.369255]  ffff8800957f4260 ffff8800957f6230 ffff880096fb7868 ffffffff81316206 
[   38.369256] Call Trace: 
[   38.369264]  [<ffffffff81ae4495>] dump_stack+0x19/0x1b 
[   38.369270]  [<ffffffff8130eb7d>] print_trailer+0xfd/0x170 
[   38.369276]  [<ffffffff81316206>] object_err+0x36/0x40 
[   38.369282]  [<ffffffff813186aa>] kasan_report_error+0x22a/0x580 
[   38.369287]  [<ffffffff8118f8bf>] ? mark_lock+0x6f/0xa20 
[   38.369294]  [<ffffffff81318f98>] kasan_report+0x58/0x60 
[   38.369300]  [<ffffffff81317fcd>] ? memcpy+0x1d/0x40 
[   38.369306]  [<ffffffff81317a51>] __asan_loadN+0x141/0x1a0 
[   38.369311]  [<ffffffff81317fcd>] memcpy+0x1d/0x40 
[   38.369436]  [<ffffffffa0404e25>] OUT_RINGp+0x75/0x90 [nouveau] 
[   38.369560]  [<ffffffffa03fe02d>] nv50_fbcon_imageblit+0x45d/0x6d0 [nouveau] 
[   38.369684]  [<ffffffffa03fa71c>] nouveau_fbcon_imageblit+0xec/0x150 [nouveau] 
[   38.369691]  [<ffffffff815d46be>] soft_cursor+0x2fe/0x420 
[   38.369696]  [<ffffffff8118f8bf>] ? mark_lock+0x6f/0xa20 
[   38.369701]  [<ffffffff815d336f>] bit_cursor+0xb9f/0xbf0 
[   38.369707]  [<ffffffff815d27d0>] ? update_attr.isra.3+0xd0/0xd0 
[   38.369713]  [<ffffffff815b9aab>] ? fb_get_color_depth+0x8b/0xc0 
[   38.369718]  [<ffffffff815c8075>] ? get_color+0xe5/0x1e0 
[   38.369723]  [<ffffffff815d27d0>] ? update_attr.isra.3+0xd0/0xd0 
[   38.369728]  [<ffffffff815c8317>] fb_flashcursor+0x1a7/0x1c0 
[   38.369735]  [<ffffffff81108bf3>] process_one_work+0x423/0xb90 
[   38.369740]  [<ffffffff81108b4c>] ? process_one_work+0x37c/0xb90 
[   38.369746]  [<ffffffff811087d0>] ? flush_delayed_work+0x80/0x80 
[   38.369752]  [<ffffffff81109566>] worker_thread+0x206/0x560 
[   38.369757]  [<ffffffff81109360>] ? process_one_work+0xb90/0xb90 
[   38.369764]  [<ffffffff81116d85>] kthread+0x175/0x180 
[   38.369771]  [<ffffffff81116c10>] ? flush_kthread_work+0x280/0x280 
[   38.369778]  [<ffffffff8104d3f9>] ? sched_clock+0x9/0x10 
[   38.369786]  [<ffffffff8112c3c9>] ? finish_task_switch+0x59/0x1d0 
[   38.369793]  [<ffffffff81116c10>] ? flush_kthread_work+0x280/0x280 
[   38.369800]  [<ffffffff81b00dd8>] ret_from_fork+0x58/0x90 
[   38.369807]  [<ffffffff81116c10>] ? flush_kthread_work+0x280/0x280 
[   38.369809] Memory state around the buggy address: 
[   38.369813]  ffff8800957f6100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
[   38.369817]  ffff8800957f6180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
[   38.369822] >ffff8800957f6200: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc 
[   38.369823]                                                        ^ 
[   38.369827]  ffff8800957f6280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc 
[   38.369831]  ffff8800957f6300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc 
[   38.369833] ================================================================== 

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: OpenPGP digital signature
URL: <https://lists.freedesktop.org/archives/dri-devel/attachments/20160524/787b5189/attachment-0001.sig>


More information about the dri-devel mailing list