[Bug 94385] New: [BAT ILK] Null ptr deref with red zone overwrite on drv_module_reload_basic (ext4)

bugzilla-daemon at freedesktop.org bugzilla-daemon at freedesktop.org
Thu Mar 3 11:03:19 UTC 2016


https://bugs.freedesktop.org/show_bug.cgi?id=94385

            Bug ID: 94385
           Summary: [BAT ILK] Null ptr deref with red zone overwrite on
                    drv_module_reload_basic (ext4)
           Product: DRI
           Version: DRI git
          Hardware: Other
                OS: All
            Status: NEW
          Severity: normal
          Priority: medium
         Component: DRM/Intel
          Assignee: intel-gfx-bugs at lists.freedesktop.org
          Reporter: mika.kuoppala at intel.com
        QA Contact: intel-gfx-bugs at lists.freedesktop.org
                CC: intel-gfx-bugs at lists.freedesktop.org

Similar trace can be found from nightly run of 1066


[  424.021566] BUG: unable to handle kernel paging request at 00000000fffff02f
[  424.021578] IP: [<ffffffff811b523a>] deactivate_slab+0x19a/0x740
[  424.021589] PGD 0 
[  424.021593] Oops: 0000 [#1] PREEMPT SMP 
[  424.021598] Modules linked in: i915(+) ax88179_178a usbnet mii
snd_hda_codec_hdmi intel_powerclamp snd_hda_codec_generic coretemp
crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_codec snd_hwdep
snd_hda_core mei_me snd_pcm lpc_ich mei sdhci_pci sdhci e1000e mmc_core ptp
pps_core [last unloaded: i915]
[  424.021629] CPU: 3 PID: 5287 Comm: systemd Tainted: G     U         
4.5.0-rc6-gfxbench+ #1
[  424.021635] Hardware name: Hewlett-Packard HP EliteBook 8440p/172A, BIOS
68CCU Ver. F.24 09/13/2013
[  424.021640] task: ffff8801314fa580 ti: ffff8800b3d04000 task.ti:
ffff8800b3d04000
[  424.021647] RIP: 0010:[<ffffffff811b523a>]  [<ffffffff811b523a>]
deactivate_slab+0x19a/0x740
[  424.021655] RSP: 0018:ffff8800b3d07710  EFLAGS: 00010082
[  424.021660] RAX: 00000000ffffefff RBX: ffff8800b3a8efd0 RCX:
0000000000000002
[  424.021666] RDX: 0000000000000030 RSI: ffffea0002cea380 RDI:
00000000ffffffff
[  424.021673] RBP: ffff8800b3d07810 R08: ffff8800b3a8f870 R09:
ffff8800b3a8f898
[  424.021679] R10: 0000000000000000 R11: 0000000000000000 R12:
0000000180160011
[  424.021688] R13: 0000000000008016 R14: ffffea0002cea380 R15:
ffff8800b6688fc0
[  424.021698] FS:  00007f41261fe8c0(0000) GS:ffff880137cc0000(0000)
knlGS:0000000000000000
[  424.021711] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  424.021719] CR2: 00000000fffff02f CR3: 00000000b4924000 CR4:
00000000000006e0
[  424.021728] Stack:
[  424.021735]  ffff8800b3d07790 ffffffff81007254 ffff8800b3d0775c
0000000002cea3a0
[  424.021752]  ffff880137cc3fc0 ffff8801314fa580 0000000f00000003
ffff8800b6670fc0
[  424.021767]  00000000ffffefff ffff8800b3a8f140 ffff8800b3d077a8
ffff8800b3d077b8
[  424.021781] Call Trace:
[  424.021793]  [<ffffffff81007254>] ? dump_trace+0x134/0x320
[  424.021807]  [<ffffffff812a23d9>] ? __es_insert_extent+0xa9/0x370
[  424.021818]  [<ffffffff812a23d9>] ? __es_insert_extent+0xa9/0x370
[  424.021829]  [<ffffffff812a23d9>] ? __es_insert_extent+0xa9/0x370
[  424.021841]  [<ffffffff814175f7>] ? debug_smp_processor_id+0x17/0x20
[  424.021851]  [<ffffffff811b1df8>] ? set_track+0x88/0x120
[  424.021860]  [<ffffffff811b31a9>] ? init_object+0x39/0x70
[  424.021868]  [<ffffffff811b6b82>] ___slab_alloc.constprop.58+0x212/0x3b0
[  424.021879]  [<ffffffff812a23d9>] ? __es_insert_extent+0xa9/0x370
[  424.021888]  [<ffffffff810cb007>] ? __lock_acquire+0x977/0x20f0
[  424.021899]  [<ffffffff817c256d>] ? _raw_spin_unlock_irqrestore+0x3d/0x60
[  424.021910]  [<ffffffff8141884c>] ? debug_check_no_obj_freed+0x10c/0x1f0
[  424.021920]  [<ffffffff812a23d9>] ? __es_insert_extent+0xa9/0x370
[  424.021930]  [<ffffffff811b6d63>]
__slab_alloc.isra.55.constprop.57+0x43/0x80
[  424.021939]  [<ffffffff811b700c>] kmem_cache_alloc+0x26c/0x2d0
[  424.021947]  [<ffffffff812a23d9>] ? __es_insert_extent+0xa9/0x370
[  424.021956]  [<ffffffff812a23d9>] __es_insert_extent+0xa9/0x370
[  424.021968]  [<ffffffff812a34c1>] ext4_es_insert_extent+0x101/0x270
[  424.021980]  [<ffffffff8125fe36>] ext4_map_blocks+0x266/0x4e0
[  424.021990]  [<ffffffff81260743>] ext4_getblk+0x43/0x180
[  424.022001]  [<ffffffff8126bd0c>] ext4_find_entry+0x32c/0x6a0
[  424.022015]  [<ffffffff811ec9ee>] ? d_alloc+0x5e/0x70
[  424.022026]  [<ffffffff8126c0b3>] ext4_lookup+0x33/0x130
[  424.022035]  [<ffffffff811dcff8>] lookup_real+0x18/0x60
[  424.022041]  [<ffffffff811dd7ae>] __lookup_hash+0x2e/0x40
[  424.022048]  [<ffffffff811e0e0f>] walk_component+0x18f/0x270
[  424.022054]  [<ffffffff811ddf86>] ? __inode_permission+0x26/0xb0
[  424.022061]  [<ffffffff811e104a>] link_path_walk+0x15a/0x4f0
[  424.022067]  [<ffffffff811dec41>] ? path_init+0x4b1/0x700
[  424.022073]  [<ffffffff811ded8e>] ? path_init+0x5fe/0x700
[  424.022079]  [<ffffffff811e187b>] path_openat+0x7b/0xfa0
[  424.022086]  [<ffffffff811b6b82>] ? ___slab_alloc.constprop.58+0x212/0x3b0
[  424.022092]  [<ffffffff811e2912>] ? getname_flags+0x32/0x190
[  424.022099]  [<ffffffff811e3619>] do_filp_open+0x79/0xd0
[  424.022106]  [<ffffffff817c24cc>] ? _raw_spin_unlock+0x2c/0x50
[  424.022113]  [<ffffffff811f21d4>] ? __alloc_fd+0xf4/0x200
[  424.022120]  [<ffffffff811d2145>] do_sys_open+0x115/0x1e0
[  424.022127]  [<ffffffff811d2229>] SyS_open+0x19/0x20
[  424.022133]  [<ffffffff817c2e9b>] entry_SYSCALL_64_fastpath+0x16/0x73
[  424.022139] Code: 01 74 44 41 0f ba 36 00 bf 01 00 00 00 e8 af d8 ee ff 65
8b 05 30 5d e5 7e 85 c0 75 05 e8 f5 bd e4 ff 49 63 57 20 48 8b 44 24 40 <48> 8b
0c 10 48 85 c9 74 1f 48 8b 5c 24 40 49 8b 46 10 48 89 4c 
[  424.022187] RIP  [<ffffffff811b523a>] deactivate_slab+0x19a/0x740
[  424.022194]  RSP <ffff8800b3d07710>
[  424.022199] CR2: 00000000fffff02f
[  424.022205] ---[ end trace f0ef412fa5d49500 ]---
[  424.022211] BUG: sleeping function called from invalid context at
include/linux/sched.h:2795
[  424.022220] in_atomic(): 1, irqs_disabled(): 1, pid: 5287, name: systemd
[  424.022226] INFO: lockdep is turned off.
[  424.022231] irq event stamp: 53926
[  424.022235] hardirqs last  enabled at (53925): [<ffffffff811b5ca9>]
__slab_free+0x369/0x4a0
[  424.022245] hardirqs last disabled at (53926): [<ffffffff811b6d3f>]
__slab_alloc.isra.55.constprop.57+0x1f/0x80
[  424.022256] softirqs last  enabled at (53872): [<ffffffff816eaa43>]
netlink_poll+0x133/0x1c0
[  424.022268] softirqs last disabled at (53870): [<ffffffff816eaa02>]
netlink_poll+0xf2/0x1c0
[  424.022278] Preemption disabled at:[<ffffffff812a3474>]
ext4_es_insert_extent+0xb4/0x270

[  424.022293] CPU: 3 PID: 5287 Comm: systemd Tainted: G     UD        
4.5.0-rc6-gfxbench+ #1
[  424.022306] Hardware name: Hewlett-Packard HP EliteBook 8440p/172A, BIOS
68CCU Ver. F.24 09/13/2013
[  424.022315]  0000000000000000 ffff8800b3d07440 ffffffff813fba95
0000000000000000
[  424.022326]  ffff8801314fa580 ffff8800b3d07468 ffffffff810a1c2d
ffffffff81a6229b
[  424.022337]  0000000000000aeb 0000000000000000 ffff8800b3d07490
ffffffff810a1d54
[  424.022347] Call Trace:
[  424.022354]  [<ffffffff813fba95>] dump_stack+0x67/0x92
[  424.022364]  [<ffffffff810a1c2d>] ___might_sleep+0x15d/0x240
[  424.022371]  [<ffffffff810a1d54>] __might_sleep+0x44/0x80
[  424.022379]  [<ffffffff810891ff>] exit_signals+0x1f/0x130
[  424.022387]  [<ffffffff8107bbba>] do_exit+0xaa/0xc30
[  424.022395]  [<ffffffff810d7dfe>] ? kmsg_dump+0x10e/0x190
[  424.022402]  [<ffffffff81007cd8>] oops_end+0x68/0x90
[  424.022410]  [<ffffffff81047b37>] no_context+0x137/0x390
[  424.022417]  [<ffffffff81047e99>] __bad_area_nosemaphore+0x109/0x220
[  424.022424]  [<ffffffff810cb047>] ? __lock_acquire+0x9b7/0x20f0
[  424.022431]  [<ffffffff81047fbe>] bad_area_nosemaphore+0xe/0x10
[  424.022438]  [<ffffffff81048205>] __do_page_fault+0x85/0x480
[  424.022445]  [<ffffffff81001010>] ? trace_hardirqs_off_thunk+0x17/0x19
[  424.022453]  [<ffffffff8104860c>] do_page_fault+0xc/0x10
[  424.022460]  [<ffffffff817c4bf2>] page_fault+0x22/0x30
[  424.022466]  [<ffffffff811b523a>] ? deactivate_slab+0x19a/0x740
[  424.022473]  [<ffffffff81007254>] ? dump_trace+0x134/0x320
[  424.022480]  [<ffffffff812a23d9>] ? __es_insert_extent+0xa9/0x370
[  424.022487]  [<ffffffff812a23d9>] ? __es_insert_extent+0xa9/0x370
[  424.022494]  [<ffffffff812a23d9>] ? __es_insert_extent+0xa9/0x370
[  424.022501]  [<ffffffff814175f7>] ? debug_smp_processor_id+0x17/0x20
[  424.022507]  [<ffffffff811b1df8>] ? set_track+0x88/0x120
[  424.022514]  [<ffffffff811b31a9>] ? init_object+0x39/0x70
[  424.022521]  [<ffffffff811b6b82>] ___slab_alloc.constprop.58+0x212/0x3b0
[  424.022528]  [<ffffffff812a23d9>] ? __es_insert_extent+0xa9/0x370
[  424.022535]  [<ffffffff810cb007>] ? __lock_acquire+0x977/0x20f0
[  424.022542]  [<ffffffff817c256d>] ? _raw_spin_unlock_irqrestore+0x3d/0x60
[  424.022549]  [<ffffffff8141884c>] ? debug_check_no_obj_freed+0x10c/0x1f0
[  424.022558]  [<ffffffff812a23d9>] ? __es_insert_extent+0xa9/0x370
[  424.022567]  [<ffffffff811b6d63>]
__slab_alloc.isra.55.constprop.57+0x43/0x80
[  424.022574]  [<ffffffff811b700c>] kmem_cache_alloc+0x26c/0x2d0
[  424.022581]  [<ffffffff812a23d9>] ? __es_insert_extent+0xa9/0x370
[  424.022588]  [<ffffffff812a23d9>] __es_insert_extent+0xa9/0x370
[  424.022595]  [<ffffffff812a34c1>] ext4_es_insert_extent+0x101/0x270
[  424.022602]  [<ffffffff8125fe36>] ext4_map_blocks+0x266/0x4e0
[  424.022609]  [<ffffffff81260743>] ext4_getblk+0x43/0x180
[  424.022615]  [<ffffffff8126bd0c>] ext4_find_entry+0x32c/0x6a0
[  424.022623]  [<ffffffff811ec9ee>] ? d_alloc+0x5e/0x70
[  424.022629]  [<ffffffff8126c0b3>] ext4_lookup+0x33/0x130
[  424.022635]  [<ffffffff811dcff8>] lookup_real+0x18/0x60
[  424.022642]  [<ffffffff811dd7ae>] __lookup_hash+0x2e/0x40
[  424.022648]  [<ffffffff811e0e0f>] walk_component+0x18f/0x270
[  424.022655]  [<ffffffff811ddf86>] ? __inode_permission+0x26/0xb0
[  424.022661]  [<ffffffff811e104a>] link_path_walk+0x15a/0x4f0
[  424.022668]  [<ffffffff811dec41>] ? path_init+0x4b1/0x700
[  424.022674]  [<ffffffff811ded8e>] ? path_init+0x5fe/0x700
[  424.022681]  [<ffffffff811e187b>] path_openat+0x7b/0xfa0
[  424.022688]  [<ffffffff811b6b82>] ? ___slab_alloc.constprop.58+0x212/0x3b0
[  424.022695]  [<ffffffff811e2912>] ? getname_flags+0x32/0x190
[  424.022701]  [<ffffffff811e3619>] do_filp_open+0x79/0xd0
[  424.022708]  [<ffffffff817c24cc>] ? _raw_spin_unlock+0x2c/0x50
[  424.022715]  [<ffffffff811f21d4>] ? __alloc_fd+0xf4/0x200
[  424.022721]  [<ffffffff811d2145>] do_sys_open+0x115/0x1e0
[  424.022728]  [<ffffffff811d2229>] SyS_open+0x19/0x20
[  424.022734]  [<ffffffff817c2e9b>] entry_SYSCALL_64_fastpath+0x16/0x73
[  425.453351]
=============================================================================
[  425.454474] BUG ext4_extent_status (Tainted: G     UD        ): Redzone
overwritten
[  425.455591]
-----------------------------------------------------------------------------

[  425.457828] INFO: 0xffff8800b3a8f728-0xffff8800b3a8f72f. First byte 0xbb
instead of 0xcc
[  425.458975] INFO: Slab 0xffffea0002cea380 objects=22 used=22 fp=0x         
(null) flags=0x4000000000004081
[  425.460144] INFO: Object 0xffff8800b3a8f700 @offset=5888 fp=0x         
(null)

[  425.462467] Bytes b4 ffff8800b3a8f6f0: 00 00 00 00 00 00 00 00 5a 5a 5a 5a
5a 5a 5a 5a  ........ZZZZZZZZ

-- 
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/intel-gfx-bugs/attachments/20160303/cb5f4123/attachment.html>


More information about the intel-gfx-bugs mailing list