[Bug 207665] New: virtio GPU driver dereferences null pointer while using some Wayland applications

Sat May 9 19:53:55 UTC 2020

https://bugzilla.kernel.org/show_bug.cgi?id=207665

            Bug ID: 207665
           Summary: virtio GPU driver dereferences null pointer while
                    using some Wayland applications
           Product: Drivers
           Version: 2.5
    Kernel Version: 5.6.11
          Hardware: x86-64
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: Video(DRI - non Intel)
          Assignee: drivers_video-dri at kernel-bugs.osdl.org
          Reporter: c3bacd17 at protonmail.com
        Regression: No

Created attachment 289029
  --> https://bugzilla.kernel.org/attachment.cgi?id=289029&action=edit
The full kernel log

Relevant part of the kernel log:

[  179.722024] BUG: kernel NULL pointer dereference, address: 0000000000000008
[  179.723955] #PF: supervisor read access in kernel mode
[  179.724503] #PF: error_code(0x0000) - not-present page
[  179.725027] PGD 0 P4D 0 
[  179.725294] Oops: 0000 [#1] PREEMPT SMP PTI
[  179.725738] CPU: 0 PID: 28 Comm: kworker/u2:1 Not tainted 5.6.11 #22
[  179.726384] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
[  179.727551] Workqueue: events_unbound commit_work
[  179.728046] RIP: 0010:dma_fence_wait_timeout+0x21/0x120
[  179.728581] Code: 84 00 00 00 00 00 0f 1f 00 0f 1f 44 00 00 41 55 41 54 55
53 48 85 d2 0f 88 fd 00 00 00 48 89 fb 89 f5 49 89 d5 0f 1f 44 00 00 <48> 8b 43
08 40 0f b6 f5 4c 89 ea 48 89 df 48 8b 40 28 48 85 c0 0f
[  179.730636] RSP: 0018:ffffa8d4400ebda0 EFLAGS: 00010206
[  179.731194] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
0000000000000000
[  179.731947] RDX: 7fffffffffffffff RSI: 0000000000000001 RDI:
0000000000000000
[  179.737139] RBP: 0000000000000001 R08: 0000000000000001 R09:
ffff8f7d37b3bf00
[  179.737975] R10: 00000000000006c8 R11: 0000000000000018 R12:
ffff8f7dbab46c00
[  179.738726] R13: 7fffffffffffffff R14: ffff8f7dbab50000 R15:
000000000000000c
[  179.739479] FS:  0000000000000000(0000) GS:ffff8f7dbbc00000(0000)
knlGS:0000000000000000
[  179.740329] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  179.740938] CR2: 0000000000000008 CR3: 0000000131c42004 CR4:
0000000000360ef0
[  179.741695] Call Trace:
[  179.741988]  virtio_gpu_cursor_plane_update+0x1bb/0x290
[  179.742379]  drm_atomic_helper_commit_planes+0xb8/0x220
[  179.742753]  vgdev_atomic_commit_tail+0x32/0x60
[  179.743079]  commit_tail+0x94/0x130
[  179.743332]  process_one_work+0x1da/0x3d0
[  179.743621]  worker_thread+0x4a/0x3d0
[  179.743885]  kthread+0xfb/0x130
[  179.744115]  ? process_one_work+0x3d0/0x3d0
[  179.744532]  ? kthread_park+0x90/0x90
[  179.744891]  ret_from_fork+0x35/0x40
[  179.745378] Modules linked in:
[  179.745600] CR2: 0000000000000008
[  179.745946] ---[ end trace 8cef036ef4df2477 ]---
[  179.746256] RIP: 0010:dma_fence_wait_timeout+0x21/0x120
[  179.746604] Code: 84 00 00 00 00 00 0f 1f 00 0f 1f 44 00 00 41 55 41 54 55
53 48 85 d2 0f 88 fd 00 00 00 48 89 fb 89 f5 49 89 d5 0f 1f 44 00 00 <48> 8b 43
08 40 0f b6 f5 4c 89 ea 48 89 df 48 8b 40 28 48 85 c0 0f
[  179.747892] RSP: 0018:ffffa8d4400ebda0 EFLAGS: 00010206
[  179.748373] RAX: 0000000000000000 RBX: 0000000000000000 RCX:
0000000000000000
[  179.753551] RDX: 7fffffffffffffff RSI: 0000000000000001 RDI:
0000000000000000
[  179.754141] RBP: 0000000000000001 R08: 0000000000000001 R09:
ffff8f7d37b3bf00
[  179.754679] R10: 00000000000006c8 R11: 0000000000000018 R12:
ffff8f7dbab46c00
[  179.755203] R13: 7fffffffffffffff R14: ffff8f7dbab50000 R15:
000000000000000c
[  179.755727] FS:  0000000000000000(0000) GS:ffff8f7dbbc00000(0000)
knlGS:0000000000000000
[  179.756318] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  179.756742] CR2: 0000000000000008 CR3: 0000000131c42004 CR4:
0000000000360ef0

This is on a QEMU machine started with the following command:

exec qemu-system-x86_64 -enable-kvm -display gtk -vga virtio -cpu host -m 4G
-netdev tap,ifname=vmtap0,id=vn0,script=no,downscript=no -device
virtio-net-pci,netdev=vn0 -kernel kernel.img -drive
file=file.img,format=raw,if=virtio -virtfs
local,path=mnt,mount_tag=host0,security_model=passthrough,id=host0 -append
"console=ttyS0 root=/dev/vda rw"

On QEMU 5.0.50 with one patch related to 9p virtfs applied(don't think it's
relevant)

The guest and host are both Arch Linux, with the host kernel version 5.5.7. I'm
using the proprietary NVIDIA drivers on the host, but I don't think it matters
since it's not passthrough.

To reproduce, install firefox, Xwayland and sway from the Arch Linux
repositories. Then just open firefox in sway, open a few new tabs, then attempt
to exit firefox. It seems the "Are you sure you want to close x tabs?" dialog
triggers it.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.