Hi, While fuzzing kernel v7.1 with syzkaller, we found a kernel double fault PANIC in the amdgpu IP discovery initialization path. The crash was triggered during GPU probe on a custom QEMU virtual NAVI14 device.
Kernel PANIC via double fault in `amdgpu_discovery_init()` at drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:635 during IP discovery table reading. The function triggered a double fault at its entry point (large stack frame allocation of 0x1358 bytes), causing a PANIC. The crash occurs at `amdgpu_discovery_init+0x18` — very early in the function. The trapping instruction is a `call` at offset 0x18, after the function prologue allocates a large stack frame (`sub $0x1358, %rsp` = 4952 bytes). A double fault at function entry indicates stack corruption or stack overflow — the large stack allocation may have crossed into an unmapped guard page, or the stack was already corrupted by anomalous MMIO responses from the virtual device. The amdgpu driver's `amdgpu_discovery_init()` function does not validate the device's IP discovery data sufficiently before proceeding with stack-intensive operations. The virtual device returned anomalous IP discovery data, causing memory/stack corruption that led to the double fault. - Kernel: 7.1.0 #1 PREEMPT(lazy) - Hardware: QEMU Standard PC (Q35 + ICH9), virtual NAVI14 (0x1002:0x7340) - Tainted: G B W O (BAD_PAGE, WARN, OOT_MODULE) The crash report attached below: amdgpu 0000:00:05.0: enabling device (0000 -> 0002) amdgpu 0000:00:05.0: initializing kernel modesetting (NAVI14 0x1002:0x7340 0x1AF4:0x1100 0x00). amdgpu 0000:00:05.0: register mmio base: 0xFC000000 amdgpu 0000:00:05.0: register mmio size: 33554432 traps: PANIC: double fault, error_code: 0x0 Oops: double fault: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 715 Comm: syz.0.2 Tainted: G B W O 7.1.0 #1 PREEMPT(lazy) Tainted: [B]=BAD_PAGE, [W]=WARN, [O]=OOT_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:amdgpu_discovery_init+0x18/0x87f0 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:635 [amdgpu] Code: 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 57 41 56 41 54 53 48 81 ec 58 13 00 00 48 89 bc 24 08 13 00 00 31 ff <e8> b3 df b8 f6 48 89 84 24 f0 12 00 00 31 ff e8 54 e3 b8 f6 48 89 RSP: 0018:ffff8880600ff710 EFLAGS: 00010246 RAX: 0000000000000001 RBX: ffff8880099860c8 RCX: 0000000000100000 RDX: ffffc90004409000 RSI: 00000000000fffff RDI: 0000000000000000 RBP: ffff888060106d48 R08: 0000000000000000 R09: 0000000000000000 R10: ffff888060106c20 R11: ffffed100c020da4 R12: ffff8880099860c8 R13: ffff888009986078 R14: ffff888009986000 R15: ffff888009986000 FS: 000055557874c500(0000) GS:ffff8880e6a8d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8880600ff708 CR3: 00000000694a9000 CR4: 00000000000006f0 Call Trace: <TASK> amdgpu_driver_load_kms+0x147/0x5c0 drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c:148 [amdgpu] </TASK> Modules linked in: amdgpu(+) ppp_generic slhc gadgetfs udc_core sit tunnel4 ip_tunnel geneve ip6_udp_tunnel udp_tunnel macsec macvtap tap ipvlan macvlan virt_wifi veth nlmon dummy team bonding tun rfuzzer_device(O) i2c_dev iTCO_wdt intel_pmc_bxt ppdev watchdog vga16fb vgastate parport_pc parport gpu_sched drm_panel_backlight_quirks amdxcp drm_exec drm_suballoc_helper lpc_ich mfd_core drm_ttm_helper bochs mousedev serio_raw tpm_tis tpm_tis_core tpm dm_mod dax dmi_sysfs qemu_fw_cfg virtio_rng kt_runtime(O) uio_pci_kerneltracker_driver(O) [last unloaded: amdgpu] ---[ end trace 0000000000000000 ]--- RIP: 0010:amdgpu_discovery_init+0x18/0x87f0 drivers/gpu/drm/amd/amdgpu/amdgpu_discovery.c:635 [amdgpu] Code: 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 41 57 41 56 41 54 53 48 81 ec 58 13 00 00 48 89 bc 24 08 13 00 00 31 ff <e8> b3 df b8 f6 48 89 84 24 f0 12 00 00 31 ff e8 54 e3 b8 f6 48 89 RSP: 0018:ffff8880600ff710 EFLAGS: 00010246 RAX: 0000000000000001 RBX: ffff8880099860c8 RCX: 0000000000100000 RDX: ffffc90004409000 RSI: 00000000000fffff RDI: 0000000000000000 RBP: ffff888060106d48 R08: 0000000000000000 R09: 0000000000000000 R10: ffff888060106c20 R11: ffffed100c020da4 R12: ffff8880099860c8 R13: ffff888009986078 R14: ffff888009986000 R15: ffff888009986000 FS: 000055557874c500(0000) GS:ffff8880e6a8d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8880600ff708 CR3: 00000000694a9000 CR4: 00000000000006f0 ---------------- Code disassembly (best guess): 0: 66 90 xchg %ax,%ax 2: 90 nop 3: 90 nop 4: 90 nop 5: 90 nop 6: 90 nop 7: 90 nop 8: 90 nop 9: 90 nop a: 90 nop b: 90 nop c: 90 nop d: 90 nop e: 90 nop f: 90 nop 10: 90 nop 11: 90 nop 12: 41 57 push %r15 14: 41 56 push %r14 16: 41 54 push %r12 18: 53 push %rbx 19: 48 81 ec 58 13 00 00 sub $0x1358,%rsp 20: 48 89 bc 24 08 13 00 mov %rdi,0x1308(%rsp) 27: 00 28: 31 ff xor %edi,%edi * 2a: e8 b3 df b8 f6 call 0xf6b8dfe2 <-- trapping instruction 2f: 48 89 84 24 f0 12 00 mov %rax,0x12f0(%rsp) 36: 00 37: 31 ff xor %edi,%edi 39: e8 54 e3 b8 f6 call 0xf6b8e392 3e: 48 rex.W 3f: 89 .byte 0x89 <<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>> Regards, Yang Zi
