New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 626012 link

Starred by 3 users

Issue metadata

Status: Untriaged
Owner: ----
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Android , Chrome
Pri: 3
Type: Bug



Sign in to add a comment

Invalid DRM ioctl triggers a warning in drm_setversion() in the 3.18 kernel

Project Member Reported by glider@chromium.org, Jul 6 2016

Issue description

The attached program (found by syzkaller) triggers the following warning in the 3.18 amd64-generic kernel:

------------[ cut here ]------------
WARNING: CPU: 0 PID: 13580 at /mnt/host/source/src/third_party/kernel/v3.18/drivers/gpu/drm/drm_ioctl.c:144 drm_setversion+0x1e0/0x36b()
No drm_driver.set_busid() implementation provided by vgem_driver. Use drm_dev_set_unique() to set the unique name explicitly.
Modules linked in: hci_vhci algif_skcipher cmac algif_hash af_alg i2c_dev uinput sr_mod cdrom bluetooth zram fuse cfg80211 nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables virtio_net i2c_piix4 snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device ppp_async ppp_generic slhc tun
CPU: 0 PID: 13580 Comm: warn_drm_setver Tainted: G        W      3.18.0 #19
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
 0000000000000009 000000009d1b1a9d ffff8800236a7c28 ffffffff81b50047
 ffff8800236a7c00 ffffffff9d1b1a9d ffff8800236a7ca0 ffff880021230080
 ffff8800236a7c78 ffffffff810636af 0000000000000000 ffffffff8152b3bf
Call Trace:
 [<     inline     >] __dump_stack /mnt/host/source/src/third_party/kernel/v3.18/lib/dump_stack.c:15
 [<ffffffff81b50047>] dump_stack+0x74/0xb3 /mnt/host/source/src/third_party/kernel/v3.18/lib/dump_stack.c:50
 [<ffffffff810636af>] warn_slowpath_common+0xa9/0xc7 /mnt/host/source/src/third_party/kernel/v3.18/kernel/panic.c:441
 [<     inline     >] ? drm_set_busid /mnt/host/source/src/third_party/kernel/v3.18/drivers/gpu/drm/drm_ioctl.c:141
 [<ffffffff8152b3bf>] ? drm_setversion+0x1e0/0x36b /mnt/host/source/src/third_party/kernel/v3.18/drivers/gpu/drm/drm_ioctl.c:400
 [<ffffffff81063739>] warn_slowpath_fmt+0x6c/0x87 /mnt/host/source/src/third_party/kernel/v3.18/kernel/panic.c:453
 [<     inline     >] drm_set_busid /mnt/host/source/src/third_party/kernel/v3.18/drivers/gpu/drm/drm_ioctl.c:141
 [<ffffffff8152b3bf>] drm_setversion+0x1e0/0x36b /mnt/host/source/src/third_party/kernel/v3.18/drivers/gpu/drm/drm_ioctl.c:400
 [<ffffffff8152b06e>] drm_ioctl+0x6f3/0x78f /mnt/host/source/src/third_party/kernel/v3.18/drivers/gpu/drm/drm_ioctl.c:755
 [<ffffffff8152b1df>] ? drm_getunique+0xd5/0xd5 /mnt/host/source/src/third_party/kernel/v3.18/drivers/gpu/drm/drm_ioctl.c:70
 [<     inline     >] ? fatal_signal_pending /mnt/host/source/src/third_party/kernel/v3.18/include/linux/sched.h:2792
 [<ffffffff8105292f>] ? __do_page_fault+0x4a5/0x5de /mnt/host/source/src/third_party/kernel/v3.18/arch/x86/mm/fault.c:1246
 [<ffffffff8152a97b>] ? drm_version+0x16a/0x16a /mnt/host/source/src/third_party/kernel/v3.18/drivers/gpu/drm/drm_ioctl.c:486
 [<     inline     >] vfs_ioctl /mnt/host/source/src/third_party/kernel/v3.18/fs/ioctl.c:43
 [<ffffffff811e8178>] do_vfs_ioctl+0x6e5/0x71e /mnt/host/source/src/third_party/kernel/v3.18/fs/ioctl.c:598
 [<ffffffff811e4076>] ? final_putname+0x7d/0x82 /mnt/host/source/src/third_party/kernel/v3.18/fs/namei.c:129
 [<ffffffff811f6b13>] ? __fget_light+0xd5/0xe0 /mnt/host/source/src/third_party/kernel/v3.18/fs/file.c:692
 [<     inline     >] SYSC_ioctl /mnt/host/source/src/third_party/kernel/v3.18/fs/ioctl.c:613
 [<ffffffff811e8225>] SyS_ioctl+0x74/0xb3 /mnt/host/source/src/third_party/kernel/v3.18/fs/ioctl.c:604
 [<ffffffff81b57cdc>] system_call_fastpath+0x1c/0x21 /mnt/host/source/src/third_party/kernel/v3.18/arch/x86/kernel/entry_64.S:436
---[ end trace 77e9c0fc14a42a41 ]---

Need to backport https://github.com/torvalds/linux/commit/fa2f97dd33c2c32a06a5ea7f6e87af06a2e26baa to fix that.
 
warn_drm_setversion.c
847 bytes View Download
Cc: za...@chromium.org
Project Member

Comment 2 by bugdroid1@chromium.org, Jul 19 2016

Labels: merge-merged-chromeos-3.18
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/4d1fd086468d06f2cbf239e5ec29280808e36d6b

commit 4d1fd086468d06f2cbf239e5ec29280808e36d6b
Author: Daniel Vetter <daniel.vetter@ffwll.ch>
Date: Tue Jun 23 14:35:06 2015

CHROMIUM : drm: Set unique in drm_get_platform_dev()

Call drm_dev_set_unique() when registering the platform DRM device.
This is required to stop a WARNING in the get_unique ioctl for the
vgem driver that the unique name isn't set.

Because the Chromium version of vgem_init() differs from the upstream
one significantly, it's not possible to simply backport upstream
commit fa2f97dd33c2 ("drm/vgem: Set unique to "vgem""), so we have to
call drm_dev_set_unique() at the place where struct drm_device is
available.

Signed-off-by: Alexander Potapenko <glider@google.com>

BUG=chromium:626012
TEST=no warnings in drm_setversion() for the given repro

Change-Id: Ide10ce12769295ddd82e96ae41b35cc002020ff1
Reviewed-on: https://chromium-review.googlesource.com/359230
Commit-Ready: Alexander Potapenko <glider@chromium.org>
Tested-by: Alexander Potapenko <glider@chromium.org>
Reviewed-by: Stéphane Marchesin <marcheu@chromium.org>

[modify] https://crrev.com/4d1fd086468d06f2cbf239e5ec29280808e36d6b/drivers/gpu/drm/drm_platform.c

Components: OS>Kernel>Graphics
Status: Archived (was: Untriaged)

Comment 5 by ketakid@google.com, Mar 18 2017

Status: Available (was: Archived)
Activating. Please assign to the right owner and the appropriate priority.
Project Member

Comment 6 by sheriffbot@chromium.org, Apr 12 2018

Labels: Hotlist-Recharge-Cold
Status: Untriaged (was: Available)
This issue has been Available for over a year. If it's no longer important or seems unlikely to be fixed, please consider closing it out. If it is important, please re-triage the issue.

Sorry for the inconvenience if the bug really should have been left as Available.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment