[syzbot] [fbdev?] general protection fault in soft_cursor

[Helge Deller]

On 5/27/23 06:07, syzbot wrote:
> syzbot found the following issue on:
>
> HEAD commit:    eb0f1697d729 Merge branch 'for-next/core', remote-tracking..
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> console output: https://syzkaller.appspot.com/x/log.txt?x=10e08bde280000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=8860074b9a9d6c45
> dashboard link: https://syzkaller.appspot.com/bug?extid=d910bd780e6efac35869
> compiler:       Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> userspace arch: arm64
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=103d17a9280000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1151bb19280000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/034232da7cff/disk-eb0f1697.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/b11411bec33e/vmlinux-eb0f1697.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/a53c52e170dd/Image-eb0f1697.gz.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+d910bd780e6efac35869 at syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KASAN: null-ptr-deref in soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70
> Read of size 16 at addr 0000000000000200 by task kworker/u4:1/12
>
> CPU: 0 PID: 12 Comm: kworker/u4:1 Not tainted 6.4.0-rc3-syzkaller-geb0f1697d729 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
> Workqueue: events_power_efficient fb_flashcursor
> Call trace:
>   dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233
>   show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240
>   __dump_stack lib/dump_stack.c:88 [inline]
>   dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
>   print_report+0xe4/0x514 mm/kasan/report.c:465
>   kasan_report+0xd4/0x130 mm/kasan/report.c:572
>   kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187
>   __asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105
>   soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70
>   bit_cursor+0x113c/0x1a64 drivers/video/fbdev/core/bitblit.c:377
>   fb_flashcursor+0x35c/0x54c drivers/video/fbdev/core/fbcon.c:380
>   process_one_work+0x788/0x12d4 kernel/workqueue.c:2405
>   worker_thread+0x8e0/0xfe8 kernel/workqueue.c:2552
>   kthread+0x288/0x310 kernel/kthread.c:379
>   ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:853
> ==================================================================

#syz test: https://github.com/hdeller/linux.git  9ee79acc491c58252a91df942cb704aa06853734