WARNING in drm_gem_object_handle_put_unlocked

9 views
Skip to first unread message

syzbot

unread,
May 30, 2022, 9:12:22 AM5/30/22
to syzkaller...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 501eec4f9e13 Linux 4.14.281
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1649bfcbf00000
kernel config: https://syzkaller.appspot.com/x/.config?x=f1fa63ddcfc7168c
dashboard link: https://syzkaller.appspot.com/bug?extid=dc0af42d0e75e0820368
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+dc0af4...@syzkaller.appspotmail.com

RDX: 0000000020000180 RSI: 00000000c02064b2 RDI: 0000000000000005
RBP: 00007f252deb31d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffe55f0b2af R14: 00007f252deb3300 R15: 0000000000022000
------------[ cut here ]------------
WARNING: CPU: 0 PID: 30587 at drivers/gpu/drm/drm_gem.c:227 drm_gem_object_handle_put_unlocked+0x211/0x280 drivers/gpu/drm/drm_gem.c:227
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 30587 Comm: syz-executor.4 Not tainted 4.14.281-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
__warn.cold+0x20/0x44 kernel/panic.c:547
report_bug+0x208/0x250 lib/bug.c:183
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:964
RIP: 0010:drm_gem_object_handle_put_unlocked+0x211/0x280 drivers/gpu/drm/drm_gem.c:227
RSP: 0018:ffff888095d57b08 EFLAGS: 00010246
RAX: 0000000000040000 RBX: ffff888238562200 RCX: ffffc900076e3000
RDX: 0000000000040000 RSI: ffffffff836d2351 RDI: ffff8880ab6a2d40
RBP: ffff8880ab6a2d40 R08: ffffffff8b9c7090 R09: 0000000000000000
R10: 0000000000000000 R11: ffff888099d220c0 R12: ffff8880ab6a2d44
R13: ffff888238562200 R14: ffff8880ab6a2d48 R15: ffff8880ab6a2d58
drm_gem_handle_create_tail+0x2a3/0x330 drivers/gpu/drm/drm_gem.c:431
vgem_gem_create drivers/gpu/drm/vgem/vgem_drv.c:192 [inline]
vgem_gem_dumb_create+0xe8/0x260 drivers/gpu/drm/vgem/vgem_drv.c:212
drm_mode_create_dumb_ioctl+0x221/0x2b0 drivers/gpu/drm/drm_dumb_buffers.c:92
drm_ioctl_kernel+0x14c/0x200 drivers/gpu/drm/drm_ioctl.c:737
drm_ioctl+0x42e/0x890 drivers/gpu/drm/drm_ioctl.c:840
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7f252f53e109
RSP: 002b:00007f252deb3168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f252f650f60 RCX: 00007f252f53e109
RDX: 0000000020000180 RSI: 00000000c02064b2 RDI: 0000000000000005
RBP: 00007f252deb31d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffe55f0b2af R14: 00007f252deb3300 R15: 0000000000022000
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

syzbot

unread,
May 30, 2022, 9:28:21 AM5/30/22
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:

HEAD commit: 501eec4f9e13 Linux 4.14.281
git tree: linux-4.14.y
console output: https://syzkaller.appspot.com/x/log.txt?x=168266edf00000
kernel config: https://syzkaller.appspot.com/x/.config?x=f1fa63ddcfc7168c
dashboard link: https://syzkaller.appspot.com/bug?extid=dc0af42d0e75e0820368
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1749c547f00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16efaf4bf00000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+dc0af4...@syzkaller.appspotmail.com

RDX: 0000000020000180 RSI: 00000000c02064b2 RDI: 0000000000000004
RBP: 00007f103c17c1f0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffefd19de7f R14: 00007f103c17c300 R15: 0000000000022000
------------[ cut here ]------------
WARNING: CPU: 0 PID: 7976 at drivers/gpu/drm/drm_gem.c:227 drm_gem_object_handle_put_unlocked+0x211/0x280 drivers/gpu/drm/drm_gem.c:227
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 7976 Comm: syz-executor110 Not tainted 4.14.281-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x281 lib/dump_stack.c:58
panic+0x1f9/0x42d kernel/panic.c:183
__warn.cold+0x20/0x44 kernel/panic.c:547
report_bug+0x208/0x250 lib/bug.c:183
fixup_bug arch/x86/kernel/traps.c:177 [inline]
fixup_bug arch/x86/kernel/traps.c:172 [inline]
do_error_trap+0x195/0x2d0 arch/x86/kernel/traps.c:295
invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:964
RIP: 0010:drm_gem_object_handle_put_unlocked+0x211/0x280 drivers/gpu/drm/drm_gem.c:227
RSP: 0018:ffff888098c4fb08 EFLAGS: 00010297
RAX: ffff8880b376e640 RBX: ffff8880af0f6700 RCX: 00000000fffffff4
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8880b3c04580
RBP: ffff8880b3c04580 R08: ffffffff8b9cc5e8 R09: 0000000000000000
R10: 0000000000000000 R11: ffff8880b376e640 R12: ffff8880b3c04584
R13: ffff8880af0f6700 R14: ffff8880b3c04588 R15: ffff8880b3c04598
drm_gem_handle_create_tail+0x2a3/0x330 drivers/gpu/drm/drm_gem.c:431
vgem_gem_create drivers/gpu/drm/vgem/vgem_drv.c:192 [inline]
vgem_gem_dumb_create+0xe8/0x260 drivers/gpu/drm/vgem/vgem_drv.c:212
drm_mode_create_dumb_ioctl+0x221/0x2b0 drivers/gpu/drm/drm_dumb_buffers.c:92
drm_ioctl_kernel+0x14c/0x200 drivers/gpu/drm/drm_ioctl.c:737
drm_ioctl+0x42e/0x890 drivers/gpu/drm/drm_ioctl.c:840
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692
do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x7f103c1cee79
RSP: 002b:00007f103c17c1d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f103c2544c8 RCX: 00007f103c1cee79
RDX: 0000000020000180 RSI: 00000000c02064b2 RDI: 0000000000000004
RBP: 00007f103c17c1f0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffefd19de7f R14: 00007f103c17c300 R15: 0000000000022000

syzbot

unread,
May 31, 2022, 10:19:31 PM5/31/22
to syzkaller...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 3f8a27f9e27b Linux 4.19.211
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=110a504df00000
kernel config: https://syzkaller.appspot.com/x/.config?x=9b9277b418617afe
dashboard link: https://syzkaller.appspot.com/bug?extid=a131cd2269228f91b652
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14b252ebf00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16b788f3f00000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a131cd...@syzkaller.appspotmail.com

RDX: 0000000020000180 RSI: 00000000c02064b2 RDI: 0000000000000004
RBP: 00007f240acbb194 R08: 0000000000000001 R09: 0000000000000037
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f240acee4cc
R13: 00007f240ac172f0 R14: 00007f240acee4c8 R15: 0000000000000001
------------[ cut here ]------------
WARNING: CPU: 0 PID: 8119 at drivers/gpu/drm/drm_gem.c:228 drm_gem_object_handle_put_unlocked.cold+0x11/0x18 drivers/gpu/drm/drm_gem.c:228
Kernel panic - not syncing: panic_on_warn set ...

CPU: 0 PID: 8119 Comm: syz-executor183 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
panic+0x26a/0x50e kernel/panic.c:186
__warn.cold+0x20/0x5a kernel/panic.c:541
report_bug+0x262/0x2b0 lib/bug.c:183
fixup_bug arch/x86/kernel/traps.c:178 [inline]
fixup_bug arch/x86/kernel/traps.c:173 [inline]
do_error_trap+0x1d7/0x310 arch/x86/kernel/traps.c:296
invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1038
RIP: 0010:drm_gem_object_handle_put_unlocked.cold+0x11/0x18 drivers/gpu/drm/drm_gem.c:228
Code: ea e8 ff 57 64 f9 48 c7 c7 c0 2b c4 88 e8 5e 89 f5 ff 0f 0b e9 1a f6 d6 fb e8 e7 57 64 f9 48 c7 c7 c0 2b c4 88 e8 46 89 f5 ff <0f> 0b e9 21 f9 d6 fb e8 cf 57 64 f9 48 c7 c7 c0 2b c4 88 e8 2e 89
RSP: 0018:ffff8880938d7a30 EFLAGS: 00010282
RAX: 0000000000000024 RBX: ffff888238956a40 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff814dff01 RDI: ffffed101271af38
RBP: ffff8880b3af5a00 R08: 0000000000000024 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: ffff888238956a40
R13: ffff8880b3af5a08 R14: 0000000000000000 R15: ffff8880b3af5a04
drm_gem_handle_create_tail+0x2a2/0x310 drivers/gpu/drm/drm_gem.c:429
vgem_gem_create drivers/gpu/drm/vgem/vgem_drv.c:191 [inline]
vgem_gem_dumb_create+0x101/0x240 drivers/gpu/drm/vgem/vgem_drv.c:210
drm_mode_create_dumb+0x27c/0x300 drivers/gpu/drm/drm_dumb_buffers.c:92
drm_ioctl_kernel+0x208/0x2a0 drivers/gpu/drm/drm_ioctl.c:758
drm_ioctl+0x5a0/0x9e0 drivers/gpu/drm/drm_ioctl.c:861
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:501 [inline]
do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688
ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705
__do_sys_ioctl fs/ioctl.c:712 [inline]
__se_sys_ioctl fs/ioctl.c:710 [inline]
__x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f240ac6a2e9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f240ac172e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f240acee4c0 RCX: 00007f240ac6a2e9
RDX: 0000000020000180 RSI: 00000000c02064b2 RDI: 0000000000000004
RBP: 00007f240acbb194 R08: 0000000000000001 R09: 0000000000000037
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f240acee4cc
R13: 00007f240ac172f0 R14: 00007f240acee4c8 R15: 0000000000000001
Kernel Offset: disabled
Rebooting in 86400 seconds..


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
Reply all
Reply to author
Forward
0 new messages