kernel: BUG: KFENCE: use-after-free read in amdgpu_bo_move+0x1db/0x810 [amdgpu]

system info

• CPU: AMD Ryzen 5600X
• GPU: AMD Radeon RX 6900XT
• System Memory: 32Gb
• Display: DP on TITAN ARMY P32A6VPD65W
• Resolution: 3840x2160/120hz
• ArchLinux rolling latest at 2024/3/30
• Kernel version: 6.8.2-zen2-1-zen

no signal on monitor when issue occured, plug out and in the power supply of monitor, the display can recover but resolution drop to 4k/60hz

dmesg

3月 31 12:23:18 arch kernel: ==================================================================
3月 31 12:23:18 arch kernel: BUG: KFENCE: use-after-free read in amdgpu_bo_move+0x1db/0x810 [amdgpu]
3月 31 12:23:18 arch kernel: Use-after-free read at 0x000000009869dbe1 (in kfence-#160):
3月 31 12:23:18 arch kernel:  amdgpu_bo_move+0x1db/0x810 [amdgpu]
3月 31 12:23:18 arch kernel:  ttm_bo_validate+0x154/0x370 [ttm]
3月 31 12:23:18 arch kernel:  amdgpu_cs_bo_validate+0x9c/0x2e0 [amdgpu]
3月 31 12:23:18 arch kernel:  amdgpu_vm_validate_pt_bos+0xc2/0x4a0 [amdgpu]
3月 31 12:23:18 arch kernel:  amdgpu_cs_parser_bos.isra.0+0x496/0x820 [amdgpu]
3月 31 12:23:18 arch kernel:  amdgpu_cs_ioctl+0xa7e/0x1cc0 [amdgpu]
3月 31 12:23:18 arch kernel:  drm_ioctl_kernel+0xb5/0x110
3月 31 12:23:18 arch kernel:  drm_ioctl+0x26d/0x4b0
3月 31 12:23:18 arch kernel:  amdgpu_drm_ioctl+0x4e/0x90 [amdgpu]
3月 31 12:23:18 arch kernel:  __x64_sys_ioctl+0x97/0xd0
3月 31 12:23:18 arch kernel:  do_syscall_64+0x89/0x170
3月 31 12:23:18 arch kernel:  entry_SYSCALL_64_after_hwframe+0x6e/0x76
3月 31 12:23:18 arch kernel: 
3月 31 12:23:18 arch kernel: kfence-#160: 0x000000003ea62cf0-0x0000000060b04b0f, size=240, cache=kmalloc-256
3月 31 12:23:18 arch kernel: allocated by task 19168 on cpu 8 at 5138.043093s:
3月 31 12:23:18 arch kernel:  kmalloc_trace+0x237/0x490
3月 31 12:23:18 arch kernel:  amdgpu_gtt_mgr_new+0x40/0x140 [amdgpu]
3月 31 12:23:18 arch kernel:  ttm_resource_alloc+0x45/0x190 [ttm]
3月 31 12:23:18 arch kernel:  ttm_bo_mem_space+0x89/0x230 [ttm]
3月 31 12:23:18 arch kernel:  ttm_mem_evict_first+0x290/0x6c0 [ttm]
3月 31 12:23:18 arch kernel:  ttm_resource_manager_evict_all+0xa7/0x1d0 [ttm]
3月 31 12:23:18 arch kernel:  amdgpu_device_prepare+0x54/0xf0 [amdgpu]
3月 31 12:23:18 arch kernel:  pci_pm_prepare+0x34/0x70
3月 31 12:23:18 arch kernel:  dpm_prepare+0xd7/0x790
3月 31 12:23:18 arch kernel:  hibernation_snapshot+0xa6/0x650
3月 31 12:23:18 arch kernel:  hibernate+0xdf/0x3b0
3月 31 12:23:18 arch kernel:  state_store+0xf6/0x140
3月 31 12:23:18 arch kernel:  kernfs_fop_write_iter+0x122/0x200
3月 31 12:23:18 arch kernel:  vfs_write+0x2d7/0x4c0
3月 31 12:23:18 arch kernel:  __x64_sys_write+0x74/0xf0
3月 31 12:23:18 arch kernel:  do_syscall_64+0x89/0x170
3月 31 12:23:18 arch kernel:  entry_SYSCALL_64_after_hwframe+0x6e/0x76
3月 31 12:23:18 arch kernel: 
3月 31 12:23:18 arch kernel: freed by task 4080 on cpu 2 at 5230.199079s:
3月 31 12:23:18 arch kernel:  ttm_resource_free+0x83/0x190 [ttm]
3月 31 12:23:18 arch kernel:  ttm_bo_move_accel_cleanup+0xc8/0x2a0 [ttm]
3月 31 12:23:18 arch kernel:  amdgpu_bo_move+0x1a3/0x810 [amdgpu]
3月 31 12:23:18 arch kernel:  ttm_bo_validate+0x154/0x370 [ttm]
3月 31 12:23:18 arch kernel:  amdgpu_cs_bo_validate+0x9c/0x2e0 [amdgpu]
3月 31 12:23:18 arch kernel:  amdgpu_vm_validate_pt_bos+0xc2/0x4a0 [amdgpu]
3月 31 12:23:18 arch kernel:  amdgpu_cs_parser_bos.isra.0+0x496/0x820 [amdgpu]
3月 31 12:23:18 arch kernel:  amdgpu_cs_ioctl+0xa7e/0x1cc0 [amdgpu]
3月 31 12:23:18 arch kernel:  drm_ioctl_kernel+0xb5/0x110
3月 31 12:23:18 arch kernel:  drm_ioctl+0x26d/0x4b0
3月 31 12:23:18 arch kernel:  amdgpu_drm_ioctl+0x4e/0x90 [amdgpu]
3月 31 12:23:18 arch kernel:  __x64_sys_ioctl+0x97/0xd0
3月 31 12:23:18 arch kernel:  do_syscall_64+0x89/0x170
3月 31 12:23:18 arch kernel:  entry_SYSCALL_64_after_hwframe+0x6e/0x76
3月 31 12:23:18 arch kernel: 
3月 31 12:23:18 arch kernel: CPU: 2 PID: 4080 Comm: firefox:cs0 Not tainted 6.8.2-zen2-1-zen #1 2f27ac2810bbd221aea68cde2f42843e>
3月 31 12:23:18 arch kernel: Hardware name: ASUS System Product Name/TUF GAMING B550M-PLUS (WI-FI), BIOS 2806 10/27/2022
3月 31 12:23:18 arch kernel: ==================================================================

changed the description

Likely, dup of #3171 (closed).

marked this issue as a duplicate of #3171 (closed)

closed

marked this issue as related to #3171 (closed)