From mboxrd@z Thu Jan 1 00:00:00 1970 From: yezengruan Subject: [BUG REPORT] Panic with sys_imageblit on arm64 Date: Tue, 27 Nov 2018 07:14:33 +0000 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1858970923==" Return-path: Received: from huawei.com (szxga01-in.huawei.com [45.249.212.187]) by gabe.freedesktop.org (Postfix) with ESMTPS id A382289D40 for ; Tue, 27 Nov 2018 07:30:16 +0000 (UTC) Content-Language: zh-CN List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: "linux-kernel@vger.kernel.org" , "dri-devel@lists.freedesktop.org" , "linux-fbdev@vger.kernel.org" , "b.zolnierkie@samsung.com" , "hdegoede@redhat.com" , "daniel.vetter@ffwll.ch" , "gustavo@padovan.org" , "maarten.lankhorst@linux.intel.com" , "sean@poorly.run" , "airlied@linux.ie" , "gregkh@linuxfoundation.org" , "nicolas.pitre@linaro.org" , "kilobyte@angband.pl" Cc: "Wanghaibin (D)" List-Id: dri-devel@lists.freedesktop.org --===============1858970923== Content-Language: zh-CN Content-Type: multipart/alternative; boundary="_000_EA71F1939A4E2F4996635D61949EB5BB01BAF8B4DGGEMI530MBXchi_" --_000_EA71F1939A4E2F4996635D61949EB5BB01BAF8B4DGGEMI530MBXchi_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi all, When I run linux-4.19.2 on arm64, I got panic in sys_imageblit. My test ste= ps are as fllows: 1) Remote login using BMC; 2) Enter a bunch of 'Enter' keys; 3) Execute the 'top' command and continuously press shift + page up several= times. This gives the following panic on the serial console: [47229.923256] Unable to handle kernel paging request at virtual address ff= ff00002f0bc010 [47229.923258] Mem abort info: [47229.923259] ESR =3D 0x96000047 [47229.923261] Exception class =3D DABT (current EL), IL =3D 32 bits [47229.923262] SET =3D 0, FnV =3D 0 [47229.923263] EA =3D 0, S1PTW =3D 0 [47229.923263] Data abort info: [47229.923265] ISV =3D 0, ISS =3D 0x00000047 [47229.923265] CM =3D 0, WnR =3D 1 [47229.923269] swapper pgtable: 4k pages, 48-bit VAs, pgdp =3D 00000000ea9a= 862f [47229.923270] [ffff00002f0bc010] pgd=3D000000dffbffe803, pud=3D000000dffbf= fd803, pmd=3D000000bf758ee003, pte=3D0000000000000000 [47229.923279] Internal error: Oops: 96000047 [#1] SMP [47229.923285] CPU: 45 PID: 16061 Comm: top Kdump: loaded Tainted: G = OE 4.19.2-1.1.23.aarch64 #1 [47229.923286] Hardware name: Huawei Taishan 2280 /BC11SPCD, BIOS 1.46 03/2= 9/2018 [47229.923288] pstate: 80000005 (Nzcv daif -PAN -UAO) [47229.923295] pc : sys_imageblit+0x414/0x1000 [sysimgblt] [47229.923317] lr : drm_fb_helper_sys_imageblit+0x28/0x50 [drm_kms_helper] [47229.923318] sp : ffff00002f6d3820 [47229.923319] x29: ffff00002f6d3820 x28: 00000000000000ff [47229.923322] x27: 0000000000000010 x26: 0000000000000001 [47229.923325] x25: 0000000000000118 x24: 0000000000000008 [47229.923327] x23: ffff805f771db800 x22: 0000000000000000 [47229.923330] x21: ffff00002f6d3958 x20: ffff00002f0bc010 [47229.923332] x19: 0000000000000000 x18: 0000000000000000 [47229.923335] x17: 0000000000000000 x16: 0000000000000000 [47229.923337] x15: 0000000000000000 x14: 2020202020202020 [47229.923339] x13: 2020202064686374 x12: ffff805f77927360 [47229.923342] x11: ffff000000f54078 x10: 0000000000000023 [47229.923344] x9 : 000000000000000f x8 : 0000000000000003 [47229.923346] x7 : 000000000000008c x6 : 0000000000000002 [47229.923349] x5 : 0000000000000000 x4 : 00000000ad55ad55 [47229.923352] x3 : ffff805f77927360 x2 : 0000000000000000 [47229.923354] x1 : 0000000000000006 x0 : 0000000000000000 [47229.923357] Process top (pid: 16061, stack limit =3D 0x00000000d490d156) [47229.923359] Call trace: [47229.923363] sys_imageblit+0x414/0x1000 [sysimgblt] [47229.923373] drm_fb_helper_sys_imageblit+0x28/0x50 [drm_kms_helper] [47229.923387] bit_putcs+0x29c/0x4a0 [47229.923391] fbcon_putcs+0x110/0x148 [47229.923397] do_update_region+0x138/0x1d8 [47229.923399] do_con_trol+0xb44/0x13e0 [47229.923400] do_con_write.part.29+0x1d0/0x8f0 [47229.923402] con_write+0x70/0x78 [47229.923405] n_tty_write+0x1a8/0x428 [47229.923407] tty_write+0x1bc/0x2f0 [47229.923412] __vfs_write+0x60/0x1a8 [47229.923414] vfs_write+0xb0/0x1a8 [47229.923416] ksys_write+0x6c/0xd8 [47229.923418] __arm64_sys_write+0x28/0x38 [47229.923424] el0_svc_common+0xb8/0x118 [47229.923426] el0_svc_handler+0x38/0x88 [47229.923429] el0_svc+0x8/0xc [47229.923431] Code: 0a080000 b8605960 0a000080 4a050000 (b8227a80) [47229.923436] [kbox] die event detected I followed the same test steps and found the same problem in the linux-4.20= .0-rc3. In the test I found that if the variable bitstart in function sys_imageblit= is greater than variable p->screen_size - 1, the kernel will panic. The following patch seems to work fine in my test: diff --git a/drivers/video/fbdev/core/sysimgblt.c b/drivers/video/fbdev/cor= e/sysimgblt.c index a4d05b1..b316404 100644 --- a/drivers/video/fbdev/core/sysimgblt.c +++ b/drivers/video/fbdev/core/sysimgblt.c @@ -254,6 +254,9 @@ void sys_imageblit(struct fb_info *p, const struct fb_i= mage *image) bitstart /=3D 8; bitstart &=3D ~(bpl - 1); + if (p->screen_size - 1 < bitstart) + return; + dst1 =3D (void __force *)p->screen_base + bitstart; if (p->fbops->fb_sync) So please CC me directly on any reply. Many thanks, Zengruan. --_000_EA71F1939A4E2F4996635D61949EB5BB01BAF8B4DGGEMI530MBXchi_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi all,<= /o:p>

 

When I run li= nux-4.19.2 on arm64, I got panic in sys_imageblit. My test steps are as fll= ows:

1) Remote log= in using BMC;

2) Enter a bu= nch of 'Enter' keys;

3) Execute th= e 'top' command and continuously press shift + page up several times.

 

This gives th= e following panic on the serial console:

 

[47229.923256] Unable to handle kernel pagin= g request at virtual address ffff00002f0bc010

[47229.923258] Mem abort info:

[47229.923259]   ESR =3D 0x9600004= 7

[47229.923261]   Exception class = =3D DABT (current EL), IL =3D 32 bits

[47229.923262]   SET =3D 0, FnV = =3D 0

[47229.923263]   EA =3D 0, S1PTW = =3D 0

[47229.923263] Data abort info:

[47229.923265]   ISV =3D 0, ISS = =3D 0x00000047

[47229.923265]   CM =3D 0, WnR =3D= 1

[47229.923269] swapper pgtable: 4k pages, 48= -bit VAs, pgdp =3D 00000000ea9a862f

[47229.923270] [ffff00002f0bc010] pgd=3D0000= 00dffbffe803, pud=3D000000dffbffd803, pmd=3D000000bf758ee003, pte=3D0000000= 000000000

[47229.923279] Internal error: Oops: 9600004= 7 [#1] SMP

[47229.923285] CPU: 45 PID: 16061 Comm: top = Kdump: loaded Tainted: G        &nb= sp;  OE     4.19.2-1.1.23.aarch64 #1

[47229.923286] Hardware name: Huawei Taishan= 2280 /BC11SPCD, BIOS 1.46 03/29/2018

[47229.923288] pstate: 80000005 (Nzcv daif -= PAN -UAO)

[47229.923295] pc : sys_imageblit+0x414/= 0x1000 [sysimgblt]

[47229.923317] lr : drm_fb_helper_sys_imageb= lit+0x28/0x50 [drm_kms_helper]

[47229.923318] sp : ffff00002f6d3820

[47229.923319] x29: ffff00002f6d3820 x28: 00= 000000000000ff

[47229.923322] x27: 0000000000000010 x26: 00= 00000000000001

[47229.923325] x25: 0000000000000118 x24: 00= 00000000000008

[47229.923327] x23: ffff805f771db800 x22: 00= 00000000000000

[47229.923330] x21: ffff00002f6d3958 x20: ff= ff00002f0bc010

[47229.923332] x19: 0000000000000000 x18: 00= 00000000000000

[47229.923335] x17: 0000000000000000 x16: 00= 00000000000000

[47229.923337] x15: 0000000000000000 x14: 20= 20202020202020

[47229.923339] x13: 2020202064686374 x12: ff= ff805f77927360

[47229.923342] x11: ffff000000f54078 x10: 00= 00000000000023

[47229.923344] x9 : 000000000000000f x8 : 00= 00000000000003

[47229.923346] x7 : 000000000000008c x6 : 00= 00000000000002

[47229.923349] x5 : 0000000000000000 x4 : 00= 000000ad55ad55

[47229.923352] x3 : ffff805f77927360 x2 : 00= 00000000000000

[47229.923354] x1 : 0000000000000006 x0 : 00= 00000000000000

[47229.923357] Process top (pid: 16061, stac= k limit =3D 0x00000000d490d156)

[47229.923359] Call trace:=

[47229.923363]  sys_imageblit+0x414= /0x1000 [sysimgblt]

[47229.923373]  drm_fb_helper_sys_image= blit+0x28/0x50 [drm_kms_helper]

[47229.923387]  bit_putcs+0x29c/0x4= a0

[47229.923391]  fbcon_putcs+0x110/0= x148

[47229.923397]  do_update_region+0x= 138/0x1d8

[47229.923399]  do_con_trol+0xb44/0= x13e0

[47229.923400]  do_con_write.part.29= 3;0x1d0/0x8f0

[47229.923402]  con_write+0x70/0x78=

[47229.923405]  n_tty_write+0x1a8/0= x428

[47229.923407]  tty_write+0x1bc/0x2= f0

[47229.923412]  __vfs_write+0x60/0x= 1a8

[47229.923414]  vfs_write+0xb0/0x1a= 8

[47229.923416]  ksys_write+0x6c/0xd= 8

[47229.923418]  __arm64_sys_write+0= x28/0x38

[47229.923424]  el0_svc_common+0xb8= /0x118

[47229.923426]  el0_svc_handler+0x3= 8/0x88

[47229.923429]  el0_svc+0x8/0xc

[47229.923431] Code: 0a080000 b8605960 0a000= 080 4a050000 (b8227a80)

[47229.923436] [kbox] die event detected

 

I followed th= e same test steps and found the same problem in the linux-4.20.0-rc3.<= /o:p>

In the test I= found that if the variable bitstart in function sys_imageblit is greater t= han variable p->screen_size - 1, the kernel will panic.

The following= patch seems to work fine in my test:

 

diff --git a/drivers/video/fbdev/core/sysimg= blt.c b/drivers/video/fbdev/core/sysimgblt.c

index a4d05b1..b316404 100644

--- a/drivers/video/fbdev/core/sysimgblt.c

+++ b/drivers/video/fbdev/core/s= ysimgblt.c

@@ -254,6 +254,9 @@ void sys_imageblit(s= truct fb_info *p, const struct fb_image *image)

       &n= bsp;bitstart /=3D 8;

        b= itstart &=3D ~(bpl - 1);

+ if (p->screen_size - 1 < bitstar= t)

+      &nb= sp;  return;

+

        d= st1 =3D (void __force *)p->screen_base + bitstart;=

       &n= bsp;if (p->fbops->fb_sync)

 

So please CC = me directly on any reply.

 

Many thanks,<= o:p>

 

Zengruan.

 

--_000_EA71F1939A4E2F4996635D61949EB5BB01BAF8B4DGGEMI530MBXchi_-- --===============1858970923== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVs IG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlz dHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vZHJpLWRldmVsCg== --===============1858970923==--