Messages in this thread Patch in this message | | | Date | Fri, 19 Apr 2024 16:59:15 +0200 | From | Nam Cao <> | Subject | Re: [bug-report] task info hung problem in fb_deferred_io_work() |
| |
On 2024-04-18 Harshit Mogalapalli wrote: > While fuzzing 5.15.y kernel with Syzkaller, we noticed a INFO: task hung > bug in fb_deferred_io_work()
I think the problem is because of improper offset address calculation. The kernel calculate address offset with: offset = vmf->address - vmf->vma->vm_start
Now the problem is that your C program mmap the framebuffer at 2 different offsets: mmap(ptr, 4096, PROT_WRITE, MAP_FIXED | MAP_SHARED, fd, 0xff000); mmap(ptr, 4096, PROT_WRITE, MAP_FIXED | MAP_SHARED, fd, 0);
but the kernel doesn't take these different offsets into account. So, 2 different pages are mistakenly recognized as the same page.
Can you try the following patch?
Best regards, Nam
diff --git a/drivers/video/fbdev/core/fb_defio.c b/drivers/video/fbdev/core/fb_defio.c index dae96c9f61cf..d5d6cd9e8b29 100644 --- a/drivers/video/fbdev/core/fb_defio.c +++ b/drivers/video/fbdev/core/fb_defio.c @@ -196,7 +196,8 @@ static vm_fault_t fb_deferred_io_track_page(struct fb_info *info, unsigned long */ static vm_fault_t fb_deferred_io_page_mkwrite(struct fb_info *info, struct vm_fault *vmf) { - unsigned long offset = vmf->address - vmf->vma->vm_start; + unsigned long offset = vmf->address - vmf->vma->vm_start + + (vmf->vma->vm_pgoff << PAGE_SHIFT); struct page *page = vmf->page; file_update_time(vmf->vma->vm_file);
| |