general protection fault in soft_cursor

Status: fixed on 2023/07/01 16:05
Subsystems: fbdev
[Documentation on labels]
Reported-by: syzbot+d910bd780e6efac35869@syzkaller.appspotmail.com
Fix commit: d78bd6cc6827 fbcon: Fix null-ptr-deref in soft_cursor
First crash: 1209d, last: 1177d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [fbdev?] general protection fault in soft_cursor 0 (1) 2023/05/27 04:07
▶ ▼ Similar bugs (10)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 KASAN: null-ptr-deref Read in soft_cursor origin:lts-only 11 syz error 1 1176d 1177d 0/3 auto-obsoleted due to no activity on 2024/12/24 15:39
linux-6.1 KASAN: slab-out-of-bounds Read in soft_cursor 17 2 2d22h 23d 0/3 upstream: reported on 2026/07/24 00:48
linux-4.14 KASAN: use-after-free Read in soft_cursor 19 syz, C inconclusive 7 1936d 2447d 0/1 upstream: reported C repro on 2019/12/04 13:11
linux-4.19 KASAN: slab-out-of-bounds Read in soft_cursor (2) 17 syz, C done 8 1912d 2034d 1/1 fixed on 2021/06/23 17:43
linux-4.14 KASAN: slab-out-of-bounds Read in soft_cursor 17 syz, C unreliable 57 1917d 2448d 0/1 upstream: reported C repro on 2019/12/03 14:54
upstream KASAN: slab-out-of-bounds Read in soft_cursor (2) fbdev 17 9 194d 328d 0/29 auto-obsoleted due to no activity on 2026/05/14 02:42
upstream KASAN: global-out-of-bounds Read in soft_cursor (3) fbdev 19 23 6h59m 10d 22/29 upstream: reported on 2026/08/07 00:01
upstream KASAN: global-out-of-bounds Read in soft_cursor (2) fbdev 17 1 540d 536d 0/29 auto-obsoleted due to no activity on 2025/05/23 01:13
linux-4.19 KASAN: global-out-of-bounds Read in soft_cursor 17 syz, C done 22 1910d 2377d 1/1 fixed on 2021/06/24 08:01
linux-4.14 KASAN: global-out-of-bounds Read in soft_cursor 17 syz, C error 19 1436d 2436d 0/1 upstream: reported C repro on 2019/12/16 00:09
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2023/05/27 06:49 21m deller@gmx.de https://github.com/hdeller/linux.git 9ee79acc491c58252a91df942cb704aa06853734 no crash log

Sample crash report:
==================================================================
BUG: KASAN: null-ptr-deref in soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70
Read of size 16 at addr 0000000000000200 by task kworker/u4:1/12

CPU: 0 PID: 12 Comm: kworker/u4:1 Not tainted 6.4.0-rc3-syzkaller-geb0f1697d729 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Workqueue: events_power_efficient fb_flashcursor
Call trace:
 dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233
 show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
 print_report+0xe4/0x514 mm/kasan/report.c:465
 kasan_report+0xd4/0x130 mm/kasan/report.c:572
 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187
 __asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105
 soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70
 bit_cursor+0x113c/0x1a64 drivers/video/fbdev/core/bitblit.c:377
 fb_flashcursor+0x35c/0x54c drivers/video/fbdev/core/fbcon.c:380
 process_one_work+0x788/0x12d4 kernel/workqueue.c:2405
 worker_thread+0x8e0/0xfe8 kernel/workqueue.c:2552
 kthread+0x288/0x310 kernel/kthread.c:379
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:853
==================================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/05/27 04:06 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci eb0f1697d729 cf184559 .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in soft_cursor
2023/04/25 13:36 upstream 173ea743bf7a 65320f8e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root general protection fault in soft_cursor
2023/05/27 02:49 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci eb0f1697d729 cf184559 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: null-ptr-deref Read in soft_cursor
* Struck through repros no longer work on HEAD.