BUG: KASAN: slab-use-after-free in drm_sched_get_cleanup_job+0x47b/0x5c0 [gpu_sched]

[Mikhail Gavrilov]

On Fri, Mar 24, 2023 at 7:37 PM Christian König
<ckoenig.leichtzumerken at gmail.com> wrote:
>
> Yeah, that one
>
> Thanks for the info, looks like this isn't fixed.
>
> Christian.
>

Hi,
glad to see that "BUG: KASAN: slab-use-after-free in
drm_sched_get_cleanup_job+0x47b/0x5c0" was fixed in 6.3-rc5.
For history it would be good to know the commit which fixes this issue.
I waited for this moment because I know other one issue which was also
found by KASAN santiniser.

BUG: KASAN: null-ptr-deref in drm_sched_job_cleanup+0x96/0x290 [gpu_sched]
Read of size 4 at addr 0000000000000078 by task GameThread/23915

CPU: 10 PID: 23915 Comm: GameThread Tainted: G        W    L
-------  ---  6.3.0-0.rc5.42.fc39.x86_64+debug #1
Hardware name: System manufacturer System Product Name/ROG STRIX
X570-I GAMING, BIOS 4601 02/02/2023
Call Trace:
 <TASK>
 dump_stack_lvl+0x72/0xc0
 kasan_report+0xa4/0xe0
 ? drm_sched_job_cleanup+0x96/0x290 [gpu_sched]
 kasan_check_range+0x104/0x1b0
 drm_sched_job_cleanup+0x96/0x290 [gpu_sched]
 ? __pfx_drm_sched_job_cleanup+0x10/0x10 [gpu_sched]
 ? slab_free_freelist_hook+0x11e/0x1d0
 ? amdgpu_cs_parser_fini+0x363/0x5a0 [amdgpu]
 amdgpu_job_free+0x40/0x1b0 [amdgpu]
 amdgpu_cs_parser_fini+0x3c9/0x5a0 [amdgpu]
 ? __pfx_amdgpu_cs_parser_fini+0x10/0x10 [amdgpu]
 amdgpu_cs_ioctl+0x3d9/0x5630 [amdgpu]
 ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu]
 ? mark_lock+0x101/0x16e0
 ? __lock_acquire+0xe54/0x59f0
 ? __pfx_lock_release+0x10/0x10
 ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu]
 drm_ioctl_kernel+0x1f8/0x3d0
 ? __pfx_drm_ioctl_kernel+0x10/0x10
 drm_ioctl+0x4c1/0xaa0
 ? __pfx_amdgpu_cs_ioctl+0x10/0x10 [amdgpu]
 ? __pfx_drm_ioctl+0x10/0x10
 ? _raw_spin_unlock_irqrestore+0x62/0x80
 ? lockdep_hardirqs_on+0x7d/0x100
 ? _raw_spin_unlock_irqrestore+0x4b/0x80
 amdgpu_drm_ioctl+0xce/0x1b0 [amdgpu]
 __x64_sys_ioctl+0x12d/0x1a0
 do_syscall_64+0x5c/0x90
 ? do_syscall_64+0x68/0x90
 ? lockdep_hardirqs_on+0x7d/0x100
 ? do_syscall_64+0x68/0x90
 ? do_syscall_64+0x68/0x90
 ? lockdep_hardirqs_on+0x7d/0x100
 ? do_syscall_64+0x68/0x90
 ? do_syscall_64+0x68/0x90
 ? lockdep_hardirqs_on+0x7d/0x100
 entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7fe97a50881d
Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d 45 10 c7 45 b0 10 00
00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10 00 00 00 0f 05 <89> c2
3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25 28 00 00 00
RSP: 002b:000000007c35d3f0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000007c35d6e8 RCX: 00007fe97a50881d
RDX: 000000007c35d4d0 RSI: 00000000c0186444 RDI: 00000000000000ae
RBP: 000000007c35d440 R08: 00007fe8fc0f0970 R09: 000000007c35d490
R10: 000000007fb79000 R11: 0000000000000246 R12: 000000007c35d4d0
R13: 00000000c0186444 R14: 00000000000000ae R15: 00007fe8fc0f0900
 </TASK>

I know at least 3 games which 100% triggering this bug:
- Cyberpunk 2077
- Forza Horizon 4
- Forza Horizon 5

We would continue to discuss it here or better create a new thread
(for someone who is also faced with this issue could easily find a
solution on the internet)?

A full kernel log as usual attached here.

-- 
Best Regards,
Mike Gavrilov.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: dmesg.tar.xz
Type: application/x-xz
Size: 40976 bytes
Desc: not available
URL: <https://lists.freedesktop.org/archives/dri-devel/attachments/20230404/91d8851d/attachment-0001.xz>