linux-fbdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [syzbot] [fbdev?] general protection fault in soft_cursor
@ 2023-05-27  4:07 syzbot
  2023-05-27  6:49 ` Helge Deller
  0 siblings, 1 reply; 3+ messages in thread
From: syzbot @ 2023-05-27  4:07 UTC (permalink / raw)
  To: daniel, deller, dri-devel, linux-fbdev, linux-kernel, syzkaller-bugs

Hello,

syzbot found the following issue on:

HEAD commit:    eb0f1697d729 Merge branch 'for-next/core', remote-tracking..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=10e08bde280000
kernel config:  https://syzkaller.appspot.com/x/.config?x=8860074b9a9d6c45
dashboard link: https://syzkaller.appspot.com/bug?extid=d910bd780e6efac35869
compiler:       Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=103d17a9280000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1151bb19280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/034232da7cff/disk-eb0f1697.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b11411bec33e/vmlinux-eb0f1697.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a53c52e170dd/Image-eb0f1697.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d910bd780e6efac35869@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: null-ptr-deref in soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70
Read of size 16 at addr 0000000000000200 by task kworker/u4:1/12

CPU: 0 PID: 12 Comm: kworker/u4:1 Not tainted 6.4.0-rc3-syzkaller-geb0f1697d729 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Workqueue: events_power_efficient fb_flashcursor
Call trace:
 dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233
 show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
 print_report+0xe4/0x514 mm/kasan/report.c:465
 kasan_report+0xd4/0x130 mm/kasan/report.c:572
 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187
 __asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105
 soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70
 bit_cursor+0x113c/0x1a64 drivers/video/fbdev/core/bitblit.c:377
 fb_flashcursor+0x35c/0x54c drivers/video/fbdev/core/fbcon.c:380
 process_one_work+0x788/0x12d4 kernel/workqueue.c:2405
 worker_thread+0x8e0/0xfe8 kernel/workqueue.c:2552
 kthread+0x288/0x310 kernel/kthread.c:379
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:853
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [syzbot] [fbdev?] general protection fault in soft_cursor
  2023-05-27  4:07 [syzbot] [fbdev?] general protection fault in soft_cursor syzbot
@ 2023-05-27  6:49 ` Helge Deller
  2023-05-27  7:12   ` syzbot
  0 siblings, 1 reply; 3+ messages in thread
From: Helge Deller @ 2023-05-27  6:49 UTC (permalink / raw)
  To: syzbot, daniel, dri-devel, linux-fbdev, syzkaller-bugs

On 5/27/23 06:07, syzbot wrote:
> syzbot found the following issue on:
>
> HEAD commit:    eb0f1697d729 Merge branch 'for-next/core', remote-tracking..
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> console output: https://syzkaller.appspot.com/x/log.txt?x=10e08bde280000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=8860074b9a9d6c45
> dashboard link: https://syzkaller.appspot.com/bug?extid=d910bd780e6efac35869
> compiler:       Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> userspace arch: arm64
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=103d17a9280000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1151bb19280000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/034232da7cff/disk-eb0f1697.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/b11411bec33e/vmlinux-eb0f1697.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/a53c52e170dd/Image-eb0f1697.gz.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+d910bd780e6efac35869@syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KASAN: null-ptr-deref in soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70
> Read of size 16 at addr 0000000000000200 by task kworker/u4:1/12
>
> CPU: 0 PID: 12 Comm: kworker/u4:1 Not tainted 6.4.0-rc3-syzkaller-geb0f1697d729 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
> Workqueue: events_power_efficient fb_flashcursor
> Call trace:
>   dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233
>   show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240
>   __dump_stack lib/dump_stack.c:88 [inline]
>   dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
>   print_report+0xe4/0x514 mm/kasan/report.c:465
>   kasan_report+0xd4/0x130 mm/kasan/report.c:572
>   kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187
>   __asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105
>   soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70
>   bit_cursor+0x113c/0x1a64 drivers/video/fbdev/core/bitblit.c:377
>   fb_flashcursor+0x35c/0x54c drivers/video/fbdev/core/fbcon.c:380
>   process_one_work+0x788/0x12d4 kernel/workqueue.c:2405
>   worker_thread+0x8e0/0xfe8 kernel/workqueue.c:2552
>   kthread+0x288/0x310 kernel/kthread.c:379
>   ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:853
> ==================================================================

#syz test: https://github.com/hdeller/linux.git  9ee79acc491c58252a91df942cb704aa06853734


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [syzbot] [fbdev?] general protection fault in soft_cursor
  2023-05-27  6:49 ` Helge Deller
@ 2023-05-27  7:12   ` syzbot
  0 siblings, 0 replies; 3+ messages in thread
From: syzbot @ 2023-05-27  7:12 UTC (permalink / raw)
  To: daniel, deller, dri-devel, linux-fbdev, syzkaller-bugs

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+d910bd780e6efac35869@syzkaller.appspotmail.com

Tested on:

commit:         9ee79acc fbcon: Prevent softcursor if no font set
git tree:       https://github.com/hdeller/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=136dee6d280000
kernel config:  https://syzkaller.appspot.com/x/.config?x=8860074b9a9d6c45
dashboard link: https://syzkaller.appspot.com/bug?extid=d910bd780e6efac35869
compiler:       Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
userspace arch: arm64

Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2023-05-27  7:12 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-05-27  4:07 [syzbot] [fbdev?] general protection fault in soft_cursor syzbot
2023-05-27  6:49 ` Helge Deller
2023-05-27  7:12   ` syzbot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).