Re: [BUG, regression] Dereferencing of NULL pointer in radeon_mn_unregister()

From: Jason Gunthorpe <jgg-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
To: Petr Cvek <petrcvekcz-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
Cc: "Deucher,
	Alexander" <Alexander.Deucher-5C7GfCeVMHo@public.gmane.org>,
	"David1.Zhou-5C7GfCeVMHo@public.gmane.org"
	<David1.Zhou-5C7GfCeVMHo@public.gmane.org>,
	"Koenig,
	Christian" <christian.koenig-5C7GfCeVMHo@public.gmane.org>,
	"amd-gfx-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org"
	<amd-gfx-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org>,
	"sfr-3FnU+UHB4dNDw9hX6IcOSA@public.gmane.org"
	<sfr-3FnU+UHB4dNDw9hX6IcOSA@public.gmane.org>
Subject: Re: [BUG, regression] Dereferencing of NULL pointer in radeon_mn_unregister()
Date: Sun, 1 Sep 2019 14:04:12 +0000	[thread overview]
Message-ID: <20190901140409.GA1251@mellanox.com> (raw)
In-Reply-To: <dad0e51a-0f06-e2b0-cef7-3587207c2045-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>

On Sun, Sep 01, 2019 at 11:38:10AM +0200, Petr Cvek wrote:

> The code is:
> 
> 	struct radeon_mn *rmn = bo->mn;
> 	...
> 	mutex_lock(&rmn->lock);		//<-crash
> 
> A quick assert proves the bo->mn returns NULL. The code worked in
> 4.19-rc and it seems the problematic patch is

Hum, the code went away because the locking protecting that variable
went away.. It means the caller is not careful to pair register and
unregister.

> 	drm/radeon: use mmu_notifier_get/put for struct radeon_mn
> 
> as it removes the NULL check.
> 
> Forcing -ENODEV in the register funtion (and immediate return in
> unregister as without CONFIG_MMU_NOTIFIER) works.

Is just adding a

  if (!rmn)
       retrun

To the top of radeon_mn_unregister enough to fix it?

Jason
_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx