From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.free-electrons.com ([62.4.15.54]:38315 "EHLO mail.free-electrons.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754806AbeARO60 (ORCPT ); Thu, 18 Jan 2018 09:58:26 -0500 From: Boris Brezillon To: David Airlie , Daniel Vetter , dri-devel@lists.freedesktop.org, Eric Anholt Cc: Boris Brezillon , stable@vger.kernel.org Subject: [PATCH v2] drm/vc4: Fix NULL pointer dereference in vc4_save_hang_state() Date: Thu, 18 Jan 2018 15:58:21 +0100 Message-Id: <20180118145821.22344-1-boris.brezillon@free-electrons.com> Sender: stable-owner@vger.kernel.org List-ID: When saving BOs in the hang state we skip one entry of the kernel_state->bo[] array, thus leaving it to NULL. This leads to a NULL pointer dereference when, later in this function, we iterate over all BOs to check their ->madv state. Fixes: ca26d28bbaa3 ("drm/vc4: improve throughput by pipelining binning and rendering jobs") Cc: Signed-off-by: Boris Brezillon --- Changes in v2: - Get rid of prev_idx an replace it by k which is indepently incremented every time a new object is added to kernel_state->bo[]. - Add a WARN_ON_ONCE() when final value of k is inconsistent --- drivers/gpu/drm/vc4/vc4_gem.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c index 6c32c89a83a9..3216f12052fe 100644 --- a/drivers/gpu/drm/vc4/vc4_gem.c +++ b/drivers/gpu/drm/vc4/vc4_gem.c @@ -146,7 +146,7 @@ vc4_save_hang_state(struct drm_device *dev) struct vc4_exec_info *exec[2]; struct vc4_bo *bo; unsigned long irqflags; - unsigned int i, j, unref_list_count, prev_idx; + unsigned int i, j, k, unref_list_count; kernel_state = kcalloc(1, sizeof(*kernel_state), GFP_KERNEL); if (!kernel_state) @@ -182,7 +182,7 @@ vc4_save_hang_state(struct drm_device *dev) return; } - prev_idx = 0; + k = 0; for (i = 0; i < 2; i++) { if (!exec[i]) continue; @@ -197,7 +197,7 @@ vc4_save_hang_state(struct drm_device *dev) WARN_ON(!refcount_read(&bo->usecnt)); refcount_inc(&bo->usecnt); drm_gem_object_get(&exec[i]->bo[j]->base); - kernel_state->bo[j + prev_idx] = &exec[i]->bo[j]->base; + kernel_state->bo[k++] = &exec[i]->bo[j]->base; } list_for_each_entry(bo, &exec[i]->unref_list, unref_head) { @@ -205,12 +205,12 @@ vc4_save_hang_state(struct drm_device *dev) * because they are naturally unpurgeable. */ drm_gem_object_get(&bo->base.base); - kernel_state->bo[j + prev_idx] = &bo->base.base; - j++; + kernel_state->bo[k++] = &bo->base.base; } - prev_idx = j + 1; } + WARN_ON_ONCE(k != state->bo_count); + if (exec[0]) state->start_bin = exec[0]->ct0ca; if (exec[1]) -- 2.11.0 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Boris Brezillon Subject: [PATCH v2] drm/vc4: Fix NULL pointer dereference in vc4_save_hang_state() Date: Thu, 18 Jan 2018 15:58:21 +0100 Message-ID: <20180118145821.22344-1-boris.brezillon@free-electrons.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Return-path: Received: from mail.free-electrons.com (mail.free-electrons.com [62.4.15.54]) by gabe.freedesktop.org (Postfix) with ESMTP id 9D42F6E609 for ; Thu, 18 Jan 2018 14:58:25 +0000 (UTC) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" To: David Airlie , Daniel Vetter , dri-devel@lists.freedesktop.org, Eric Anholt Cc: Boris Brezillon , stable@vger.kernel.org List-Id: dri-devel@lists.freedesktop.org V2hlbiBzYXZpbmcgQk9zIGluIHRoZSBoYW5nIHN0YXRlIHdlIHNraXAgb25lIGVudHJ5IG9mIHRo ZQprZXJuZWxfc3RhdGUtPmJvW10gYXJyYXksIHRodXMgbGVhdmluZyBpdCB0byBOVUxMLiBUaGlz IGxlYWRzIHRvIGEgTlVMTApwb2ludGVyIGRlcmVmZXJlbmNlIHdoZW4sIGxhdGVyIGluIHRoaXMg ZnVuY3Rpb24sIHdlIGl0ZXJhdGUgb3ZlciBhbGwKQk9zIHRvIGNoZWNrIHRoZWlyIC0+bWFkdiBz dGF0ZS4KCkZpeGVzOiBjYTI2ZDI4YmJhYTMgKCJkcm0vdmM0OiBpbXByb3ZlIHRocm91Z2hwdXQg YnkgcGlwZWxpbmluZyBiaW5uaW5nIGFuZCByZW5kZXJpbmcgam9icyIpCkNjOiA8c3RhYmxlQHZn ZXIua2VybmVsLm9yZz4KU2lnbmVkLW9mZi1ieTogQm9yaXMgQnJlemlsbG9uIDxib3Jpcy5icmV6 aWxsb25AZnJlZS1lbGVjdHJvbnMuY29tPgotLS0KQ2hhbmdlcyBpbiB2MjoKLSBHZXQgcmlkIG9m IHByZXZfaWR4IGFuIHJlcGxhY2UgaXQgYnkgayB3aGljaCBpcyBpbmRlcGVudGx5IGluY3JlbWVu dGVkCiAgZXZlcnkgdGltZSBhIG5ldyBvYmplY3QgaXMgYWRkZWQgdG8ga2VybmVsX3N0YXRlLT5i b1tdLgotIEFkZCBhIFdBUk5fT05fT05DRSgpIHdoZW4gZmluYWwgdmFsdWUgb2YgayBpcyBpbmNv bnNpc3RlbnQKLS0tCiBkcml2ZXJzL2dwdS9kcm0vdmM0L3ZjNF9nZW0uYyB8IDEyICsrKysrKy0t LS0tLQogMSBmaWxlIGNoYW5nZWQsIDYgaW5zZXJ0aW9ucygrKSwgNiBkZWxldGlvbnMoLSkKCmRp ZmYgLS1naXQgYS9kcml2ZXJzL2dwdS9kcm0vdmM0L3ZjNF9nZW0uYyBiL2RyaXZlcnMvZ3B1L2Ry bS92YzQvdmM0X2dlbS5jCmluZGV4IDZjMzJjODlhODNhOS4uMzIxNmYxMjA1MmZlIDEwMDY0NAot LS0gYS9kcml2ZXJzL2dwdS9kcm0vdmM0L3ZjNF9nZW0uYworKysgYi9kcml2ZXJzL2dwdS9kcm0v dmM0L3ZjNF9nZW0uYwpAQCAtMTQ2LDcgKzE0Niw3IEBAIHZjNF9zYXZlX2hhbmdfc3RhdGUoc3Ry dWN0IGRybV9kZXZpY2UgKmRldikKIAlzdHJ1Y3QgdmM0X2V4ZWNfaW5mbyAqZXhlY1syXTsKIAlz dHJ1Y3QgdmM0X2JvICpibzsKIAl1bnNpZ25lZCBsb25nIGlycWZsYWdzOwotCXVuc2lnbmVkIGlu dCBpLCBqLCB1bnJlZl9saXN0X2NvdW50LCBwcmV2X2lkeDsKKwl1bnNpZ25lZCBpbnQgaSwgaiwg aywgdW5yZWZfbGlzdF9jb3VudDsKIAogCWtlcm5lbF9zdGF0ZSA9IGtjYWxsb2MoMSwgc2l6ZW9m KCprZXJuZWxfc3RhdGUpLCBHRlBfS0VSTkVMKTsKIAlpZiAoIWtlcm5lbF9zdGF0ZSkKQEAgLTE4 Miw3ICsxODIsNyBAQCB2YzRfc2F2ZV9oYW5nX3N0YXRlKHN0cnVjdCBkcm1fZGV2aWNlICpkZXYp CiAJCXJldHVybjsKIAl9CiAKLQlwcmV2X2lkeCA9IDA7CisJayA9IDA7CiAJZm9yIChpID0gMDsg aSA8IDI7IGkrKykgewogCQlpZiAoIWV4ZWNbaV0pCiAJCQljb250aW51ZTsKQEAgLTE5Nyw3ICsx OTcsNyBAQCB2YzRfc2F2ZV9oYW5nX3N0YXRlKHN0cnVjdCBkcm1fZGV2aWNlICpkZXYpCiAJCQlX QVJOX09OKCFyZWZjb3VudF9yZWFkKCZiby0+dXNlY250KSk7CiAJCQlyZWZjb3VudF9pbmMoJmJv LT51c2VjbnQpOwogCQkJZHJtX2dlbV9vYmplY3RfZ2V0KCZleGVjW2ldLT5ib1tqXS0+YmFzZSk7 Ci0JCQlrZXJuZWxfc3RhdGUtPmJvW2ogKyBwcmV2X2lkeF0gPSAmZXhlY1tpXS0+Ym9bal0tPmJh c2U7CisJCQlrZXJuZWxfc3RhdGUtPmJvW2srK10gPSAmZXhlY1tpXS0+Ym9bal0tPmJhc2U7CiAJ CX0KIAogCQlsaXN0X2Zvcl9lYWNoX2VudHJ5KGJvLCAmZXhlY1tpXS0+dW5yZWZfbGlzdCwgdW5y ZWZfaGVhZCkgewpAQCAtMjA1LDEyICsyMDUsMTIgQEAgdmM0X3NhdmVfaGFuZ19zdGF0ZShzdHJ1 Y3QgZHJtX2RldmljZSAqZGV2KQogCQkJICogYmVjYXVzZSB0aGV5IGFyZSBuYXR1cmFsbHkgdW5w dXJnZWFibGUuCiAJCQkgKi8KIAkJCWRybV9nZW1fb2JqZWN0X2dldCgmYm8tPmJhc2UuYmFzZSk7 Ci0JCQlrZXJuZWxfc3RhdGUtPmJvW2ogKyBwcmV2X2lkeF0gPSAmYm8tPmJhc2UuYmFzZTsKLQkJ CWorKzsKKwkJCWtlcm5lbF9zdGF0ZS0+Ym9baysrXSA9ICZiby0+YmFzZS5iYXNlOwogCQl9Ci0J CXByZXZfaWR4ID0gaiArIDE7CiAJfQogCisJV0FSTl9PTl9PTkNFKGsgIT0gc3RhdGUtPmJvX2Nv dW50KTsKKwogCWlmIChleGVjWzBdKQogCQlzdGF0ZS0+c3RhcnRfYmluID0gZXhlY1swXS0+Y3Qw Y2E7CiAJaWYgKGV4ZWNbMV0pCi0tIAoyLjExLjAKCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fCmRyaS1kZXZlbCBtYWlsaW5nIGxpc3QKZHJpLWRldmVsQGxp c3RzLmZyZWVkZXNrdG9wLm9yZwpodHRwczovL2xpc3RzLmZyZWVkZXNrdG9wLm9yZy9tYWlsbWFu L2xpc3RpbmZvL2RyaS1kZXZlbAo=