Skip to content

UBSAN: shift-out-of-bounds in drivers/gpu/drm/display/drm_dp_mst_topology.c:4416:36 shift exponent -1 is negative

Before submitting your bug report:

Brief summary of the problem:

With latest Linux master (v6.5-rc4-174-gc1a515d3c027), I still see this error intermittently when plugging a USB-C dock on a suspended system then resuming:

[18380.764687] amdgpu 0000:03:00.0: amdgpu: ring gfx uses VM inv eng 0 on hub 0
[18380.764689] amdgpu 0000:03:00.0: amdgpu: ring gfx_low uses VM inv eng 1 on hub 0
[18380.764690] amdgpu 0000:03:00.0: amdgpu: ring gfx_high uses VM inv eng 4 on hub 0
[18380.764691] amdgpu 0000:03:00.0: amdgpu: ring comp_1.0.0 uses VM inv eng 5 on hub 0
[18380.764691] amdgpu 0000:03:00.0: amdgpu: ring comp_1.1.0 uses VM inv eng 6 on hub 0
[18380.764692] amdgpu 0000:03:00.0: amdgpu: ring comp_1.2.0 uses VM inv eng 7 on hub 0
[18380.764692] amdgpu 0000:03:00.0: amdgpu: ring comp_1.3.0 uses VM inv eng 8 on hub 0
[18380.764693] amdgpu 0000:03:00.0: amdgpu: ring comp_1.0.1 uses VM inv eng 9 on hub 0
[18380.764693] amdgpu 0000:03:00.0: amdgpu: ring comp_1.1.1 uses VM inv eng 10 on hub 0
[18380.764694] amdgpu 0000:03:00.0: amdgpu: ring comp_1.2.1 uses VM inv eng 11 on hub 0
[18380.764695] amdgpu 0000:03:00.0: amdgpu: ring comp_1.3.1 uses VM inv eng 12 on hub 0
[18380.764695] amdgpu 0000:03:00.0: amdgpu: ring kiq_0.2.1.0 uses VM inv eng 13 on hub 0
[18380.764696] amdgpu 0000:03:00.0: amdgpu: ring sdma0 uses VM inv eng 0 on hub 8
[18380.764696] amdgpu 0000:03:00.0: amdgpu: ring vcn_dec uses VM inv eng 1 on hub 8
[18380.764697] amdgpu 0000:03:00.0: amdgpu: ring vcn_enc0 uses VM inv eng 4 on hub 8
[18380.764697] amdgpu 0000:03:00.0: amdgpu: ring vcn_enc1 uses VM inv eng 5 on hub 8
[18380.764698] amdgpu 0000:03:00.0: amdgpu: ring jpeg_dec uses VM inv eng 6 on hub 8
[18383.434553] OOM killer enabled.
[18383.434555] Restarting tasks ... 
[18383.434594] usb 2-1.3: USB disconnect, device number 4
[18383.434595] usb 2-1.3.3: USB disconnect, device number 5
[18383.434629] usb 1-1: USB disconnect, device number 4
[18383.434633] usb 1-1.2: USB disconnect, device number 5
[18383.435165] ================================================================================
[18383.435169] UBSAN: shift-out-of-bounds in drivers/gpu/drm/display/drm_dp_mst_topology.c:4416:36
[18383.435172] shift exponent -1 is negative
[18383.435175] CPU: 3 PID: 1239 Comm: Xorg Tainted: G        W   E      9.9.9 #609
[18383.435177] Hardware name: HP HP Pavilion Aero Laptop 13-be0xxx/8916, BIOS F.12 04/11/2023
[18383.435180] Call Trace:
[18383.435183]  <TASK>
[18383.435185]  dump_stack_lvl+0x48/0x70
[18383.435198]  dump_stack+0x10/0x20
[18383.435200]  __ubsan_handle_shift_out_of_bounds+0x1ac/0x360
[18383.435207]  drm_dp_atomic_release_time_slots.cold+0x17/0x3d [drm_display_helper]
[18383.435236]  dm_dp_mst_atomic_check+0x29/0x40 [amdgpu]
[18383.435757]  drm_atomic_helper_check_modeset+0x46e/0xd80 [drm_kms_helper]
[18383.435783]  ? psi_group_change+0x219/0x530
[18383.435789]  amdgpu_dm_atomic_check+0x81/0x1460 [amdgpu]
[18383.436125]  ? __kmem_cache_alloc_node+0x1aa/0x360
[18383.436130]  ? amdgpu_dm_connector_atomic_duplicate_state+0x2c/0x110 [amdgpu]
[18383.436435]  drm_atomic_check_only+0x66b/0xb20 [drm]
[18383.436495]  drm_atomic_commit+0x58/0xd0 [drm]
[18383.436525]  ? __pfx___drm_printfn_info+0x10/0x10 [drm]
[18383.436557]  drm_atomic_helper_set_config+0x82/0xd0 [drm_kms_helper]
[18383.436579]  drm_mode_setcrtc+0x5e6/0x900 [drm]
[18383.436611]  ? __pfx_drm_mode_setcrtc+0x10/0x10 [drm]
[18383.436643]  drm_ioctl_kernel+0xd6/0x180 [drm]
[18383.436676]  drm_ioctl+0x2d0/0x550 [drm]
[18383.436707]  ? __pfx_drm_mode_setcrtc+0x10/0x10 [drm]
[18383.436740]  amdgpu_drm_ioctl+0x4e/0x90 [amdgpu]
[18383.436977]  __x64_sys_ioctl+0xa3/0xf0
[18383.436984]  do_syscall_64+0x5b/0x90
[18383.436989]  ? syscall_exit_to_user_mode+0x29/0x50
[18383.436995]  ? do_syscall_64+0x67/0x90
[18383.436996]  ? do_syscall_64+0x67/0x90
[18383.436998]  ? exit_to_user_mode_prepare+0x9b/0x190
[18383.437006]  ? syscall_exit_to_user_mode+0x29/0x50
[18383.437007]  ? do_syscall_64+0x67/0x90
[18383.437009]  entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[18383.437014] RIP: 0033:0x7feea531cb3b
[18383.437018] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
[18383.437021] RSP: 002b:00007ffeaf0a1e80 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[18383.437024] RAX: ffffffffffffffda RBX: 00005605580c6bf0 RCX: 00007feea531cb3b
[18383.437026] RDX: 00007ffeaf0a1f10 RSI: 00000000c06864a2 RDI: 000000000000000f
[18383.437026] RBP: 00007ffeaf0a1f10 R08: 0000000000000000 R09: 0000000000000000
[18383.437027] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000c06864a2
[18383.437028] R13: 000000000000000f R14: 0000560557704be0 R15: 0000560557ec05e0
[18383.437030]  </TASK>
[18383.437091] ================================================================================
[18383.437274] usb 2-1: USB disconnect, device number 3
[18383.437326] done.

Hardware description: HP Pavilion Aero Laptop 13-be0xxx/8916, BIOS F.12 04/11/2023

  • CPU: AMD Ryzen 7 5800U with Radeon Graphics
  • GPU: [AMD/ATI] Cezanne [Radeon Vega Series / Radeon Vega Mobile Series] [1002:1638] (rev c1)
  • System Memory: 16GB
  • Display(s): laptop screen 2560x1600 and 3 external monitors via USB-C dock
  • Type of Display Connection: eDP + USB-C

System information:

  • Debian 12
  • Custom kernel: v6.5-rc4-174-gc1a515d3c027
  • AMD official driver version: N/A

How to reproduce the issue:

  • suspend laptop, unplug dock and use with another laptop, replug dock and resume laptop