From: Jason Gunthorpe <jgg-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
To: Petr Cvek <petrcvekcz-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
Cc: "Deucher,
Alexander" <Alexander.Deucher-5C7GfCeVMHo@public.gmane.org>,
"David1.Zhou-5C7GfCeVMHo@public.gmane.org"
<David1.Zhou-5C7GfCeVMHo@public.gmane.org>,
"Koenig,
Christian" <christian.koenig-5C7GfCeVMHo@public.gmane.org>,
"amd-gfx-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org"
<amd-gfx-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org>,
"sfr-3FnU+UHB4dNDw9hX6IcOSA@public.gmane.org"
<sfr-3FnU+UHB4dNDw9hX6IcOSA@public.gmane.org>
Subject: Re: [BUG, regression] Dereferencing of NULL pointer in radeon_mn_unregister()
Date: Mon, 2 Sep 2019 06:19:00 +0000 [thread overview]
Message-ID: <20190902061858.GI24116@mellanox.com> (raw)
In-Reply-To: <2fc7ef14-e89a-1f2d-381d-1c9b05da02d3-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
On Sun, Sep 01, 2019 at 05:48:36PM +0200, Petr Cvek wrote:
> > Is just adding a
> >
> > if (!rmn)
> > retrun
> >
> > To the top of radeon_mn_unregister enough to fix it?
>
> Yeah it seems to work. A further test with minetest works too.
Okay, I added this patch to the hmm tree, thanks.
From 829394d77e3026e08e7879fb37f14c90de7b0fd8 Mon Sep 17 00:00:00 2001
From: Jason Gunthorpe <jgg@mellanox.com>
Date: Mon, 2 Sep 2019 03:01:03 -0300
Subject: [PATCH] drm/radeon: guard against calling an unpaired
radeon_mn_unregister()
This check was accidently deleted in the below commit. There are cases
where the driver will call unregister even though it hasn't registered
anything.
CPU 0 Unable to handle kernel paging request at virtual address 0000001c, epc == 808de6d4, ra == 804d32ec
Call Trace:
[<808de6d4>] mutex_lock+0x8/0x44
[<804d32ec>] radeon_mn_unregister+0x3c/0xb0
[<8041583c>] radeon_gem_object_free+0x18/0x2c
[<803a451c>] drm_gem_object_release_handle+0x74/0xac
[<803a45d0>] drm_gem_handle_delete+0x7c/0x128
[<803a5bf4>] drm_ioctl_kernel+0xb0/0x108
[<803a5e74>] drm_ioctl+0x200/0x3a8
[<803e07b4>] radeon_drm_ioctl+0x54/0xc0
[<801214dc>] do_vfs_ioctl+0x4e8/0x81c
[<80121864>] ksys_ioctl+0x54/0xb0
[<8001100c>] syscall_common+0x34/0x58
Link: https://lore.kernel.org/r/2fc7ef14-e89a-1f2d-381d-1c9b05da02d3@gmail.com
Fixes: 534e5f84b7a9 ("drm/radeon: use mmu_notifier_get/put for struct radeon_mn")
Reported-by: Petr Cvek <petrcvekcz@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
---
drivers/gpu/drm/radeon/radeon_mn.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/radeon/radeon_mn.c b/drivers/gpu/drm/radeon/radeon_mn.c
index fc8254273a800b..1ee20d528a7c24 100644
--- a/drivers/gpu/drm/radeon/radeon_mn.c
+++ b/drivers/gpu/drm/radeon/radeon_mn.c
@@ -234,6 +234,9 @@ void radeon_mn_unregister(struct radeon_bo *bo)
struct radeon_mn *rmn = bo->mn;
struct list_head *head;
+ if (!rmn)
+ return;
+
mutex_lock(&rmn->lock);
/* save the next list entry for later */
head = bo->mn_list.next;
--
2.23.0
_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx
prev parent reply other threads:[~2019-09-02 6:19 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-09-01 9:38 [BUG, regression] Dereferencing of NULL pointer in radeon_mn_unregister() Petr Cvek
[not found] ` <dad0e51a-0f06-e2b0-cef7-3587207c2045-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2019-09-01 14:04 ` Jason Gunthorpe
[not found] ` <20190901140409.GA1251-VPRAkNaXOzVWk0Htik3J/w@public.gmane.org>
2019-09-01 15:48 ` Petr Cvek
[not found] ` <2fc7ef14-e89a-1f2d-381d-1c9b05da02d3-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2019-09-02 6:19 ` Jason Gunthorpe [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190902061858.GI24116@mellanox.com \
--to=jgg-vpraknaxozvwk0htik3j/w@public.gmane.org \
--cc=Alexander.Deucher-5C7GfCeVMHo@public.gmane.org \
--cc=David1.Zhou-5C7GfCeVMHo@public.gmane.org \
--cc=amd-gfx-PD4FTy7X32lNgt0PjOBp9y5qC8QIuHrW@public.gmane.org \
--cc=christian.koenig-5C7GfCeVMHo@public.gmane.org \
--cc=petrcvekcz-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org \
--cc=sfr-3FnU+UHB4dNDw9hX6IcOSA@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.