For a kernel development project I'm working on, I'm using Linux in a VMware guest. After kernel v5.16.2, I noticed this KASAN splat:
Mar 15 14:50:39 oracle-102.nfsv4.dev kernel: vmwgfx 0000:00:0f.0: vgaarb: deactivate vga console Mar 15 14:50:39 oracle-102.nfsv4.dev kernel: Console: switching to colour dummy device 80x25 Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: [TTM] Zone kernel: Available graphics memory: 2027952 KiB Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: vmwgfx 0000:00:0f.0: [drm] FIFO at 0x00000000fe000000 size is 8192 kiB Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: vmwgfx 0000:00:0f.0: [drm] VRAM at 0x00000000e8000000 size is 131072 kiB Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: vmwgfx 0000:00:0f.0: [drm] Running on SVGA version 2. Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: vmwgfx 0000:00:0f.0: [drm] DMA map mode: Caching DMA mappings. Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: vmwgfx 0000:00:0f.0: [drm] Legacy memory limits: VRAM = 4096 kB, FIFO = 256 kB, surface = 0 kB Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: vmwgfx 0000:00:0f.0: [drm] MOB limits: max mob size = 1048576 kB, max mob pages = 2097152 Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: vmwgfx 0000:00:0f.0: [drm] Capabilities: rect copy, cursor, cursor bypass, cursor bypass 2, 8bit e> Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: vmwgfx 0000:00:0f.0: [drm] Capabilities2: grow otable, intra surface copy, dx2, gb memsize 2, scre> Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: vmwgfx 0000:00:0f.0: [drm] Max GMR ids is 64 Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: vmwgfx 0000:00:0f.0: [drm] Max number of GMR pages is 65536 Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: vmwgfx 0000:00:0f.0: [drm] Maximum display memory size is 262144 kiB Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: vmwgfx 0000:00:0f.0: [drm] Screen Target display unit initialized Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: vmwgfx 0000:00:0f.0: [drm] Fifo max 0x00040000 min 0x00001000 cap 0x0000077f Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: ================================================================== Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: BUG: KASAN: slab-out-of-bounds in vmw_query_move_notify+0x206/0x230 [vmwgfx] Mar 15 14:50:40 oracle-102.nfsv4.dev kernel: Read of size 8 at addr ffff88813101a1c8 by task systemd-udevd/405
Bisected to f6be23264bba ("drm/vmwgfx: Introduce a new placement for MOB page tables")
I don't see an obvious fix for this issue in the stream of subsequent commits.
-- Chuck Lever