[Bug 102333] New: BUG: KASAN: use-after-free in verify_connector_state.isra.70+0xbc8/0xbe0 [i915]
bugzilla-daemon at freedesktop.org
bugzilla-daemon at freedesktop.org
Mon Aug 21 11:23:16 UTC 2017
https://bugs.freedesktop.org/show_bug.cgi?id=102333
Bug ID: 102333
Summary: BUG: KASAN: use-after-free in
verify_connector_state.isra.70+0xbc8/0xbe0 [i915]
Product: DRI
Version: XOrg git
Hardware: Other
OS: All
Status: NEW
Severity: normal
Priority: medium
Component: DRM/Intel
Assignee: intel-gfx-bugs at lists.freedesktop.org
Reporter: chris at chris-wilson.co.uk
QA Contact: intel-gfx-bugs at lists.freedesktop.org
CC: intel-gfx-bugs at lists.freedesktop.org
[ 157.923595]
==================================================================
[ 157.923840] BUG: KASAN: use-after-free in
verify_connector_state.isra.70+0xbc8/0xbe0 [i915]
[ 157.923864] Read of size 8 at addr ffff88022a6623d0 by task
kworker/u8:25/1390
[ 157.923896] CPU: 1 PID: 1390 Comm: kworker/u8:25 Tainted: G U
4.13.0-rc5-CI-Custom_3146+ #1
[ 157.923905] Hardware name: /NUC7i5BNB, BIOS
BNKBL357.86A.0048.2017.0704.1415 07/04/2017
[ 157.924069] [drm:intel_dump_pipe_config [i915]] ips: 0, double wide: 0
[ 157.924236] Workqueue: events_unbound intel_atomic_commit_work [i915]
[ 157.924403] [drm:skl_dump_hw_state [i915]] dpll_hw_state: ctrl1: 0x5,
cfgcr1: 0x0, cfgcr2: 0x0
[ 157.924422] Call Trace:
[ 157.924457] dump_stack+0x68/0xa0
[ 157.924493] print_address_description+0x73/0x290
[ 157.924705] ? verify_connector_state.isra.70+0xbc8/0xbe0 [i915]
[ 157.924740] kasan_report+0x238/0x350
[ 157.924795] __asan_report_load8_noabort+0x14/0x20
[ 157.924977] verify_connector_state.isra.70+0xbc8/0xbe0 [i915]
[ 157.925149] ? intel_display_power_put+0x21f/0x3a0 [i915]
[ 157.925354] intel_atomic_commit_tail+0x1184/0x3ca0 [i915]
[ 157.925394] ? cpuacct_charge+0x1e6/0x380
[ 157.925669] ? skl_update_crtcs+0xca0/0xca0 [i915]
[ 157.925713] ? debug_check_no_locks_freed+0x280/0x280
[ 157.925743] ? _raw_spin_unlock_irqrestore+0x33/0x60
[ 157.925779] ? __this_cpu_preempt_check+0x13/0x20
[ 157.925806] ? trace_hardirqs_off_caller+0x1fb/0x2c0
[ 157.925845] ? _raw_spin_unlock_irqrestore+0x3d/0x60
[ 157.925900] ? lock_acquire+0x13e/0x380
[ 157.926185] intel_atomic_commit_work+0xd/0x10 [i915]
[ 157.926218] process_one_work+0x6f4/0x14f0
[ 157.926276] ? pwq_dec_nr_in_flight+0x2b0/0x2b0
[ 157.926339] worker_thread+0xe1/0xe90
[ 157.926423] kthread+0x304/0x410
[ 157.926450] ? process_one_work+0x14f0/0x14f0
[ 157.926474] ? kthread_create_on_node+0xa0/0xa0
[ 157.926512] ret_from_fork+0x27/0x40
[ 157.926612] Allocated by task 1619:
[ 157.926647] save_stack_trace+0x16/0x20
[ 157.926672] kasan_kmalloc+0xee/0x190
[ 157.926696] kasan_slab_alloc+0x12/0x20
[ 157.926720] __kmalloc_track_caller+0xe9/0x330
[ 157.926743] kmemdup+0x1b/0x40
[ 157.926936] intel_digital_connector_duplicate_state+0x3f/0x70 [i915]
[ 157.926956] drm_atomic_get_connector_state+0x286/0x5f0
[ 157.927123] [drm:intel_dump_pipe_config [i915]] planes on this crtc
[ 157.927146] drm_atomic_set_property+0x46f/0x1440
[ 157.927160] drm_mode_atomic_ioctl+0x4ec/0x1f40
[ 157.927324] [drm:intel_dump_pipe_config [i915]] [PLANE:27:plane 1A]
disabled, scaler_id = -1
[ 157.927341] drm_ioctl_kernel+0x13a/0x1c0
[ 157.927354] drm_ioctl+0x6ca/0x970
[ 157.927540] [drm:intel_dump_pipe_config [i915]] [PLANE:30:plane 2A]
disabled, scaler_id = -1
[ 157.927574] do_vfs_ioctl+0x17f/0xf30
[ 157.927600] SyS_ioctl+0x3c/0x70
[ 157.927626] entry_SYSCALL_64_fastpath+0x1c/0xb1
[ 157.927674] Freed by task 1619:
[ 157.927707] save_stack_trace+0x16/0x20
[ 157.927729] kasan_slab_free+0xaf/0x190
[ 157.927751] kfree+0xea/0x300
[ 157.927781] drm_atomic_helper_connector_destroy_state+0x55/0x70
[ 157.927810] drm_atomic_state_default_clear+0x156/0xb90
[ 157.927982] intel_atomic_state_clear+0xd/0x80 [i915]
[ 157.928016] drm_atomic_state_clear+0x7b/0xa0
[ 157.928044] __drm_atomic_state_free+0x35/0xe0
[ 157.928077] set_property_atomic+0x22a/0x290
[ 157.928103] drm_mode_obj_set_property_ioctl+0x346/0x6b0
[ 157.928130] drm_mode_connector_property_set_ioctl+0xe4/0x170
[ 157.928160] drm_ioctl_kernel+0x13a/0x1c0
[ 157.928186] drm_ioctl+0x6ca/0x970
[ 157.928213] do_vfs_ioctl+0x17f/0xf30
[ 157.928241] SyS_ioctl+0x3c/0x70
[ 157.928269] entry_SYSCALL_64_fastpath+0x1c/0xb1
[ 157.928332] The buggy address belongs to the object at ffff88022a6623c8
which belongs to the cache kmalloc-128 of size 128
[ 157.928372] The buggy address is located 8 bytes inside of
128-byte region [ffff88022a6623c8, ffff88022a662448)
[ 157.928408] The buggy address belongs to the page:
[ 157.928444] page:ffffea0008a99880 count:1 mapcount:0 mapping:
(null) index:0x0 compound_mapcount: 0
[ 157.928522] flags: 0x8000000000008100(slab|head)
[ 157.928568] raw: 8000000000008100 0000000000000000 0000000000000000
0000000100110011
[ 157.928610] raw: ffffea0008b461a0 ffff8802358009a0 ffff88023580f100
0000000000000000
[ 157.928645] page dumped because: kasan: bad access detected
[ 157.928717] Memory state around the buggy address:
[ 157.928761] ffff88022a662280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
fc
[ 157.928799] ffff88022a662300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
fc
[ 157.928828] >ffff88022a662380: fc fc fc fc fc fc fc fc fc fb fb fb fb fb fb
fb
[ 157.928856] ^
[ 157.928887] ffff88022a662400: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc
fc
[ 157.928921] ffff88022a662480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
fc
[ 157.928948]
==================================================================
--
You are receiving this mail because:
You are the QA Contact for the bug.
You are on the CC list for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/intel-gfx-bugs/attachments/20170821/89c14b09/attachment.html>
More information about the intel-gfx-bugs
mailing list