From mboxrd@z Thu Jan 1 00:00:00 1970 From: bugzilla-daemon@freedesktop.org Subject: [Bug 102322] System crashes after "[drm] IP block:gmc_v8_0 is hung!" / [drm] IP block:sdma_v3_0 is hung! Date: Mon, 16 Jul 2018 14:06:32 +0000 Message-ID: References: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2119969694==" Return-path: Received: from culpepper.freedesktop.org (culpepper.freedesktop.org [IPv6:2610:10:20:722:a800:ff:fe98:4b55]) by gabe.freedesktop.org (Postfix) with ESMTP id D02AF6E19F for ; Mon, 16 Jul 2018 14:06:31 +0000 (UTC) In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: dri-devel@lists.freedesktop.org List-Id: dri-devel@lists.freedesktop.org --===============2119969694== Content-Type: multipart/alternative; boundary="15317499911.Ed11eBB7e.5818" Content-Transfer-Encoding: 7bit --15317499911.Ed11eBB7e.5818 Date: Mon, 16 Jul 2018 14:06:31 +0000 MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated https://bugs.freedesktop.org/show_bug.cgi?id=3D102322 --- Comment #35 from Andrey Grodzovsky --- (In reply to dwagner from comment #30) > (In reply to Andrey Grodzovsky from comment #29) > > > (If that is a Mesa issue, no more than user processes / X11 should ha= ve > > > crashed - but not the kernel amdgpu driver... right?) > >=20 > > Not exactly, MESA could create a bad request (faulty GPU address) which > > would lead to this. It can even be triggered on purpose using a debug f= lag > > from MESA. >=20 > My understanding is that all parts of MESA run as user processes, outside= of > the kernel space. If such code is allowed to pass parameters into kernel > functions that make the kernel crash, that would be a veritable security > hole which attackers could exploit to stage at least denial-of-service > attacks, if not worse. There is no impact on the kernlel, please note that this is a GPU page faul= t, not CPU page fault so the kernel keeps working normal, doesn't hang and workable. You might get black screen out of this and have to reboot the gra= phic card or maybe the entire system to recover but I don't see any system secur= ity and stability compromise here. --=20 You are receiving this mail because: You are the assignee for the bug.= --15317499911.Ed11eBB7e.5818 Date: Mon, 16 Jul 2018 14:06:31 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.freedesktop.org/ Auto-Submitted: auto-generated

Comme= nt # 35 on bug 10232= 2 from Andrey Grodzovsky 
(In reply to dwagner from comment #30)
> (In reply to Andrey Grodzovsky from comment #29)
> > > (If that is a Mesa issue, no more than user processes / X11 =
should have
> > > crashed - but not the kernel amdgpu driver... right?)
> >=20
> > Not exactly, MESA could create a bad request (faulty GPU address)=
 which
> > would lead to this. It can even be triggered on purpose using a d=
ebug flag
> > from MESA.
>=20
> My understanding is that all parts of MESA run as user processes, outs=
ide of
> the kernel space. If such code is allowed to pass parameters into kern=
el
> functions that make the kernel crash, that would be a veritable securi=
ty
> hole which attackers could exploit to stage at least denial-of-service
> attacks, if not worse.

There is no impact on the kernlel, please note that this is a GPU page faul=
t,
not CPU page fault so the kernel keeps working normal, doesn't hang and
workable. You might get black screen out of this and have to reboot the gra=
phic
card or maybe the entire system to recover but I don't see any system secur=
ity
and stability compromise here.

You are receiving this mail because:
  • You are the assignee for the bug.
= --15317499911.Ed11eBB7e.5818-- --===============2119969694== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Content-Disposition: inline X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KZHJpLWRldmVs IG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3JnCmh0dHBzOi8vbGlz dHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vZHJpLWRldmVsCg== --===============2119969694==--