Greeting,

FYI, we noticed the following commit (built with gcc-9):

commit: dc13cac4862cc68ec74348a80b6942532b7735fa ("video: hgafb: fix potential NULL pointer dereference") https://git.kernel.org/cgit/linux/kernel/git/gregkh/char-misc.git char-misc-linus

in testcase: trinity version: trinity-static-x86_64-x86_64-f93256fb_2019-08-28 with following parameters:

number: 99999 group: group-02

test-description: Trinity is a linux system call fuzz tester. test-url: http://codemonkey.org.uk/projects/trinity/

on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G

caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):

+---------------------------------------------+------------+------------+ | | 58c0cc2d90 | dc13cac486 | +---------------------------------------------+------------+------------+ | boot_successes | 42 | 14 | | boot_failures | 0 | 34 | | BUG:KASAN:stack-out-of-bounds_in_hgafb_open | 0 | 34 | +---------------------------------------------+------------+------------+

If you fix the issue, kindly add following tag Reported-by: kernel test robot oliver.sang@intel.com

[ 419.568887] BUG: KASAN: stack-out-of-bounds in hgafb_open (kbuild/src/consumer/drivers/video/fbdev/hgafb.c:375) [ 419.569766] Write of size 32768 at addr ffffc90000890000 by task plymouthd/237 [ 419.570595] [ 419.570829] CPU: 0 PID: 237 Comm: plymouthd Not tainted 5.13.0-rc1-00044-gdc13cac4862c #1 [ 419.571610] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 419.572304] Call Trace: [ 419.572526] print_address_description.cold+0x5/0x2f8 [ 419.573247] ? hgafb_open (kbuild/src/consumer/drivers/video/fbdev/hgafb.c:375) [ 419.573728] ? hgafb_open (kbuild/src/consumer/drivers/video/fbdev/hgafb.c:375) [ 419.574200] kasan_report.cold (kbuild/src/consumer/mm/kasan/report.c:420 kbuild/src/consumer/mm/kasan/report.c:436) [ 419.574607] ? hgafb_open (kbuild/src/consumer/drivers/video/fbdev/hgafb.c:375) [ 419.574921] kasan_check_range (kbuild/src/consumer/mm/kasan/generic.c:187) [ 419.575271] memset (kbuild/src/consumer/mm/kasan/shadow.c:44) [ 419.575529] hgafb_open (kbuild/src/consumer/drivers/video/fbdev/hgafb.c:375) [ 419.575827] fb_open (kbuild/src/consumer/include/linux/fb.h:641 kbuild/src/consumer/drivers/video/fbdev/core/fbmem.c:1419) [ 419.576120] chrdev_open (kbuild/src/consumer/fs/char_dev.c:415) [ 419.576444] ? exact_lock (kbuild/src/consumer/fs/char_dev.c:374) [ 419.576745] do_dentry_open (kbuild/src/consumer/fs/open.c:827) [ 419.577074] ? exact_lock (kbuild/src/consumer/fs/char_dev.c:374) [ 419.577373] ? may_open (kbuild/src/consumer/fs/namei.c:2983) [ 419.577669] path_openat (kbuild/src/consumer/fs/namei.c:3362 kbuild/src/consumer/fs/namei.c:3494) [ 419.578014] ? path_lookupat+0x400/0x400 [ 419.578399] ? lockdep_hardirqs_on_prepare (kbuild/src/consumer/kernel/locking/lockdep.c:4760) [ 419.578842] ? lock_is_held_type (kbuild/src/consumer/kernel/locking/lockdep.c:5255 kbuild/src/consumer/kernel/locking/lockdep.c:5555) [ 419.605410] do_filp_open (kbuild/src/consumer/fs/namei.c:3521) [ 419.605904] ? may_open_dev (kbuild/src/consumer/fs/namei.c:3515) [ 419.606421] ? _raw_spin_unlock (kbuild/src/consumer/arch/x86/include/asm/preempt.h:95 kbuild/src/consumer/include/linux/spinlock_api_smp.h:152 kbuild/src/consumer/kernel/locking/spinlock.c:183) [ 419.606962] ? alloc_fd (kbuild/src/consumer/fs/file.c:526 (discriminator 13)) [ 419.607437] ? getname_flags (kbuild/src/consumer/fs/namei.c:149) [ 419.607941] do_sys_openat2 (kbuild/src/consumer/fs/open.c:1187) [ 419.608453] ? lock_release (kbuild/src/consumer/arch/x86/include/asm/bitops.h:214 kbuild/src/consumer/include/asm-generic/bitops/instrumented-non-atomic.h:135 kbuild/src/consumer/kernel/locking/lockdep.c:199 kbuild/src/consumer/kernel/locking/lockdep.c:323 kbuild/src/consumer/kernel/locking/lockdep.c:5196 kbuild/src/consumer/kernel/locking/lockdep.c:5532) [ 419.608959] ? file_open_root (kbuild/src/consumer/fs/open.c:1173) [ 419.609487] ? lock_release (kbuild/src/consumer/arch/x86/include/asm/bitops.h:214 kbuild/src/consumer/include/asm-generic/bitops/instrumented-non-atomic.h:135 kbuild/src/consumer/kernel/locking/lockdep.c:199 kbuild/src/consumer/kernel/locking/lockdep.c:323 kbuild/src/consumer/kernel/locking/lockdep.c:5196 kbuild/src/consumer/kernel/locking/lockdep.c:5532) [ 419.610011] do_sys_open (kbuild/src/consumer/fs/open.c:1201) [ 419.610470] ? filp_open (kbuild/src/consumer/fs/open.c:1201) [ 419.610928] ? syscall_enter_from_user_mode (kbuild/src/consumer/arch/x86/include/asm/irqflags.h:45 kbuild/src/consumer/arch/x86/include/asm/irqflags.h:80 kbuild/src/consumer/kernel/entry/common.c:106) [ 419.611584] ? trace_hardirqs_on (kbuild/src/consumer/kernel/trace/trace_preemptirq.c:50 (discriminator 22)) [ 419.612155] ? syscall_enter_from_user_mode (kbuild/src/consumer/arch/x86/include/asm/irqflags.h:45 kbuild/src/consumer/arch/x86/include/asm/irqflags.h:80 kbuild/src/consumer/kernel/entry/common.c:106) [ 419.612852] do_syscall_64 (kbuild/src/consumer/arch/x86/entry/common.c:47) [ 419.613329] entry_SYSCALL_64_after_hwframe (kbuild/src/consumer/arch/x86/entry/entry_64.S:112) [ 419.614045] RIP: 0033:0x7fbb1c448eb0 [ 419.614629] Code: 48 8b 15 93 0f 2d 00 f7 d8 64 89 02 48 83 c8 ff c3 90 90 90 90 90 90 90 90 90 83 3d 2d 73 2d 00 00 75 10 b8 02 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 2e b3 01 00 48 89 04 24 All code ======== 0: 48 8b 15 93 0f 2d 00 mov 0x2d0f93(%rip),%rdx # 0x2d0f9a 7: f7 d8 neg %eax 9: 64 89 02 mov %eax,%fs:(%rdx) c: 48 83 c8 ff or $0xffffffffffffffff,%rax 10: c3 retq 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 90 nop 16: 90 nop 17: 90 nop 18: 90 nop 19: 90 nop 1a: 83 3d 2d 73 2d 00 00 cmpl $0x0,0x2d732d(%rip) # 0x2d734e 21: 75 10 jne 0x33 23: b8 02 00 00 00 mov $0x2,%eax 28: 0f 05 syscall 2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction 30: 73 31 jae 0x63 32: c3 retq 33: 48 83 ec 08 sub $0x8,%rsp 37: e8 2e b3 01 00 callq 0x1b36a 3c: 48 89 04 24 mov %rax,(%rsp)

Code starting with the faulting instruction =========================================== 0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax 6: 73 31 jae 0x39 8: c3 retq 9: 48 83 ec 08 sub $0x8,%rsp d: e8 2e b3 01 00 callq 0x1b340 12: 48 89 04 24 mov %rax,(%rsp) [ 419.616969] RSP: 002b:00007fff20a76ee8 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 [ 419.617971] RAX: ffffffffffffffda RBX: 00000000017c1070 RCX: 00007fbb1c448eb0 [ 419.618883] RDX: 00007fbb1a19b1e0 RSI: 0000000000000002 RDI: 00000000017c0a00 [ 419.619798] RBP: 00007fbb1cd666a0 R08: 0000000000000008 R09: 0000000001000000 [ 419.620709] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fbb1c72f778 [ 419.621659] R13: 0000000000000002 R14: 00007fbb1cd666a0 R15: 00000000017bc2e0 [ 419.622599] [ 419.622819] [ 419.623031] Memory state around the buggy address: [ 419.623661] ffffc90000897c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 419.624571] ffffc90000897c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 419.625476] >ffffc90000897d00: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 f3 f3 00 00 [ 419.626420] ^ [ 419.627043] ffffc90000897d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 419.627970] ffffc90000897e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 419.628897] ================================================================== [ 419.629823] Disabling lock debugging due to kernel taint [ 420.487934] _warn_unseeded_randomness: 282 callbacks suppressed [ 420.487946] random: get_random_u64 called from arch_rnd+0x48/0x80 with crng_init=0 [ 420.487961] random: get_random_u64 called from randomize_stack_top+0x5c/0x80 with crng_init=0 [ 420.488000] random: get_random_u64 called from arch_rnd+0x48/0x80 with crng_init=0 [ 420.498675] random: fast init done [ 421.493166] _warn_unseeded_randomness: 225 callbacks suppressed [ 421.493175] random: get_random_u64 called from arch_rnd+0x48/0x80 with crng_init=1 [ 421.493187] random: get_random_u64 called from randomize_stack_top+0x5c/0x80 with crng_init=1 [ 421.493309] random: get_random_u32 called from arch_setup_additional_pages+0x11f/0x180 with crng_init=1 [ 421.516720] init: failsafe main process (528) killed by TERM signal [ 421.519905] init: networking main process (548) terminated with status 1 [ 421.576147] Seeding trinity based on x86_64-randconfig-a015-20210513 [ 421.576165] [ 421.664568] random: dd: uninitialized urandom read (4096 bytes read) [ 421.809592] random: trinity: uninitialized urandom read (4 bytes read) [ 422.496319] _warn_unseeded_randomness: 654 callbacks suppressed [ 422.496329] random: get_random_u64 called from arch_rnd+0x48/0x80 with crng_init=1 [ 422.496340] random: get_random_u64 called from randomize_stack_top+0x5c/0x80 with crng_init=1 [ 422.496466] random: get_random_u32 called from arch_setup_additional_pages+0x11f/0x180 with crng_init=1 [ 423.501918] _warn_unseeded_randomness: 553 callbacks suppressed [ 423.501932] random: get_random_u64 called from arch_rnd+0x48/0x80 with crng_init=1 [ 423.501971] random: get_random_u64 called from randomize_stack_top+0x5c/0x80 with crng_init=1 [ 423.508779] random: get_random_u32 called from arch_setup_additional_pages+0x11f/0x180 with crng_init=1 [ 424.505237] _warn_unseeded_randomness: 472 callbacks suppressed [ 424.505278] random: get_random_u64 called from dup_task_struct+0x298/0x8e0 with crng_init=1 [ 424.516542] random: get_random_u64 called from arch_rnd+0x48/0x80 with crng_init=1 [ 424.516597] random: get_random_u64 called from randomize_stack_top+0x5c/0x80 with crng_init=1 [ 425.513898] _warn_unseeded_randomness: 488 callbacks suppressed [ 425.513913] random: get_random_u64 called from dup_task_struct+0x298/0x8e0 with crng_init=1 [ 425.524730] random: get_random_u64 called from arch_rnd+0x48/0x80 with crng_init=1 [ 425.524755] random: get_random_u64 called from randomize_stack_top+0x5c/0x80 with crng_init=1 [ 426.451592] 2021-05-14 20:15:06 chroot --userspec nobody:nogroup / trinity -q -q -l off -s 3463942183 -N 99999 [ 426.451639] [ 426.544444] Trinity 2019.06 Dave Jones davej@codemonkey.org.uk [ 426.544475] [ 426.552070] shm:0x7f13f7a52000-0x7f140464ed00 (4 pages) [ 426.552099] [ 426.563116] [main] Couldn't chmod tmp/ to 0777. [ 426.563144] [ 426.569843] [main] Using user passed random seed: 3463942183. [ 426.569868] [ 426.579139] _warn_unseeded_randomness: 451 callbacks suppressed [ 426.579152] random: get_random_u32 called from htab_map_alloc+0xa4d/0xda0 with crng_init=1 [ 426.586604] [main] Kernel was tainted on startup. Will ignore flags that are already set. [ 426.586630] [ 426.589859] Marking all syscalls as enabled. [ 426.589880] [ 426.600218] [main] 32-bit syscalls: 429 enabled. 64-bit syscalls: 347 enabled, 89 disabled. [ 426.600251] [ 426.610199] [main] Using pid_max = 4096 [ 426.610230] [ 426.612222] [main] futex: 0 owner:0 [ 426.612243] [ 426.614161] [main] futex: 0 owner:0 [ 426.623585] [ 426.625630] [main] futex: 0 owner:0 [ 426.625650]

To reproduce:

# build kernel cd linux cp config-5.13.0-rc1-00044-gdc13cac4862c .config make HOSTCC=gcc-9 CC=gcc-9 ARCH=x86_64 olddefconfig prepare modules_prepare bzImage

git clone https://github.com/intel/lkp-tests.git cd lkp-tests bin/lkp qemu -k <bzImage> job-script # job-script is attached in this email

--- 0DAY/LKP+ Test Infrastructure Open Source Technology Center https://lists.01.org/hyperkitty/list/lkp@lists.01.org Intel Corporation

Thanks, Oliver Sang