From: Emil Velikov <emil.l.velikov@gmail.com>
To: Chris Wilson <chris@chris-wilson.co.uk>
Cc: "Nirmoy Das" <nirmoy.das@amd.com>,
"Christian König" <christian.koenig@amd.com>,
"ML dri-devel" <dri-devel@lists.freedesktop.org>,
"Emil Velikov" <emil.velikov@collabora.com>
Subject: Re: [PATCH] drm: Restore the NULL check for drm_gem_object_put()
Date: Wed, 20 May 2020 15:25:05 +0100 [thread overview]
Message-ID: <CACvgo509GWuekwkW9Fc7TdmWyspqMMgD8FBUESt1L4KB5EyVgQ@mail.gmail.com> (raw)
In-Reply-To: <20200520142347.29060-1-chris@chris-wilson.co.uk>
On Wed, 20 May 2020 at 15:24, Chris Wilson <chris@chris-wilson.co.uk> wrote:
>
> Some users want to pass NULL to drm_gem_object_put(), but those using
> __drm_gem_object_put() did not. Compromise, have both and let the
> compiler sort it out.
>
> drm_gem_fb_destroy() calls drm_gem_object_put() with NULL obj causing:
> [ 11.584209] BUG: kernel NULL pointer dereference, address: 0000000000000000
> [ 11.584213] #PF: supervisor write access in kernel mode
> [ 11.584215] #PF: error_code(0x0002) - not-present page
> [ 11.584216] PGD 0 P4D 0
> [ 11.584220] Oops: 0002 [#1] SMP NOPTI
> [ 11.584223] CPU: 7 PID: 1571 Comm: gnome-shell Tainted: G E 5.7.0-rc1-1-default+ #27
> [ 11.584225] Hardware name: Micro-Star International Co., Ltd. MS-7A31/X370 XPOWER GAMING TITANIUM (MS-7A31), BIOS 1.MR 12/03/2019
> [ 11.584237] RIP: 0010:drm_gem_fb_destroy+0x28/0x70 [drm_kms_helper]
> <snip>
> [ 11.584256] Call Trace:
> [ 11.584279] drm_mode_rmfb+0x189/0x1c0 [drm]
> [ 11.584299] ? drm_mode_rmfb+0x1c0/0x1c0 [drm]
> [ 11.584314] drm_ioctl_kernel+0xaa/0xf0 [drm]
> [ 11.584329] drm_ioctl+0x1ff/0x3b0 [drm]
> [ 11.584347] ? drm_mode_rmfb+0x1c0/0x1c0 [drm]
> [ 11.584421] amdgpu_drm_ioctl+0x49/0x80 [amdgpu]
> [ 11.584427] ksys_ioctl+0x87/0xc0
> [ 11.584430] __x64_sys_ioctl+0x16/0x20
> [ 11.584434] do_syscall_64+0x5f/0x240
> [ 11.584438] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> [ 11.584440] RIP: 0033:0x7f0ef80f7227
>
> Reported-by: Nirmoy Das <nirmoy.das@amd.com>
> Fixes: b5d250744ccc ("drm/gem: fold drm_gem_object_put_unlocked and __drm_gem_object_put()")
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Nirmoy Das <nirmoy.das@amd.com>
> Cc: Emil Velikov <emil.velikov@collabora.com>
> Cc: Christian König <christian.koenig@amd.com>.
> Acked-by: Nirmoy Das <nirmoy.das@amd.com>
Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
I'm half way through checking the callers and I've noticed a handful of bugs.
Will send the series in due time, although your patch is a perfect
intermediate solution.
Thank you
Emil
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply other threads:[~2020-05-20 14:28 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-20 12:14 [PATCH 1/1] drm: check for NULL pointer in drm_gem_object_put Nirmoy Das
2020-05-20 12:19 ` Christian König
2020-05-20 12:49 ` Chris Wilson
2020-05-20 12:54 ` Christian König
2020-05-20 13:00 ` Daniel Vetter
2020-05-20 13:03 ` Christian König
2020-05-20 13:17 ` Chris Wilson
2020-05-20 13:30 ` Emil Velikov
2020-05-20 13:33 ` Emil Velikov
2020-05-20 14:23 ` [PATCH] drm: Restore the NULL check for drm_gem_object_put() Chris Wilson
2020-05-20 14:25 ` Emil Velikov [this message]
2020-05-20 16:37 ` Chris Wilson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CACvgo509GWuekwkW9Fc7TdmWyspqMMgD8FBUESt1L4KB5EyVgQ@mail.gmail.com \
--to=emil.l.velikov@gmail.com \
--cc=chris@chris-wilson.co.uk \
--cc=christian.koenig@amd.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=emil.velikov@collabora.com \
--cc=nirmoy.das@amd.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).