* [perf] perf_fuzzer triggers NULL pointer derefernce in i915 driver @ 2019-12-12 15:36 Vince Weaver 2019-12-13 7:09 ` Jani Nikula 0 siblings, 1 reply; 4+ messages in thread From: Vince Weaver @ 2019-12-12 15:36 UTC (permalink / raw) To: linux-kernel Cc: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo, Mark Rutland, Alexander Shishkin, Jiri Olsa, Namhyung Kim, Jani Nikula, Joonas Lahtinen, Rodrigo Vivi Hello with current git the perf_fuzzer was able to trigger this NULL pointer de-reference in the i915 driver. Vince [40119.349172] BUG: kernel NULL pointer dereference, address: 0000000000000000 [40119.356626] #PF: supervisor read access in kernel mode [40119.362121] #PF: error_code(0x0000) - not-present page [40119.367606] PGD 0 P4D 0 [40119.370320] Oops: 0000 [#1] SMP PTI [40119.374035] CPU: 0 PID: 654 Comm: Xorg Tainted: G W 5.5.0-rc1+ #138 [40119.382149] Hardware name: LENOVO 10AM000AUS/SHARKBAY, BIOS FBKT72AUS 01/26/2014 [40119.390053] RIP: 0010:get_timeline_name+0x13/0x20 [i915] [40119.395747] Code: 0f 1f 80 00 00 00 00 0f 1f 44 00 00 48 c7 c0 12 56 4e a0 c3 0f 1f 00 0f 1f 44 00 00 48 8b 87 d0 00 00 00 48 c7 c2 1c 56 4e a0 <48> 8b 00 48 85 c0 48 0f 44 c2 c3 66 90 0f 1f 44 00 00 55 48 8b 87 [40119.415853] RSP: 0018:ffffc90000903938 EFLAGS: 00010206 [40119.421479] RAX: 0000000000000000 RBX: ffff88811093af00 RCX: 0000000000000000 [40119.429148] RDX: ffffffffa04e561c RSI: ffff88811093af00 RDI: ffff88811093af00 [40119.436782] RBP: ffffc90000903990 R08: 0000000000000000 R09: ffff88811093af00 [40119.444420] R10: ffff88811371d208 R11: 0000000000000005 R12: 000000000000000a [40119.452063] R13: 0000000000000881 R14: ffffffff822f1840 R15: 00000000000a0018 [40119.459671] FS: 00007f61e3f0ff00(0000) GS:ffff88811ac00000(0000) knlGS:0000000000000000 [40119.468347] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [40119.474482] CR2: 0000000000000000 CR3: 0000000111f76003 CR4: 00000000001606f0 [40119.482134] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000009000000 [40119.489841] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 [40119.497477] Call Trace: [40119.500099] perf_trace_dma_fence+0x80/0x230 [40119.504687] dma_fence_init+0x9a/0xb0 [40119.508657] dma_fence_work_init+0x40/0xa0 [i915] [40119.513726] i915_vma_work+0x34/0x50 [i915] [40119.518256] i915_vma_pin+0x2a4/0x6d0 [i915] [40119.522884] eb_lookup_vmas+0x205/0xb80 [i915] [40119.527667] i915_gem_do_execbuffer+0x676/0x19c0 [i915] [40119.533290] ? __alloc_pages_nodemask+0x16f/0x300 [40119.538331] ? xas_store+0x56/0x5e0 [40119.542051] ? mem_cgroup_charge_statistics+0x4c/0xd0 [40119.547436] i915_gem_execbuffer2_ioctl+0x1df/0x3d0 [i915] [40119.553348] ? i915_gem_execbuffer_ioctl+0x2e0/0x2e0 [i915] [40119.559359] drm_ioctl_kernel+0xaa/0xf0 [drm] [40119.564034] drm_ioctl+0x1f7/0x390 [drm] [40119.568271] ? i915_gem_execbuffer_ioctl+0x2e0/0x2e0 [i915] [40119.574280] ? _raw_spin_unlock+0xa/0x10 [40119.578475] ? __handle_mm_fault+0x8ca/0x15f0 [40119.583163] do_vfs_ioctl+0x45f/0x6e0 [40119.587075] ksys_ioctl+0x5e/0x90 [40119.590653] __x64_sys_ioctl+0x16/0x20 [40119.594665] do_syscall_64+0x52/0x1a0 [40119.598592] entry_SYSCALL_64_after_hwframe+0x44/0xa9 ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [perf] perf_fuzzer triggers NULL pointer derefernce in i915 driver 2019-12-12 15:36 [perf] perf_fuzzer triggers NULL pointer derefernce in i915 driver Vince Weaver @ 2019-12-13 7:09 ` Jani Nikula 2019-12-13 19:20 ` Dave Hansen 0 siblings, 1 reply; 4+ messages in thread From: Jani Nikula @ 2019-12-13 7:09 UTC (permalink / raw) To: Vince Weaver, linux-kernel Cc: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo, Mark Rutland, Alexander Shishkin, Jiri Olsa, Namhyung Kim, Joonas Lahtinen, Rodrigo Vivi On Thu, 12 Dec 2019, Vince Weaver <vincent.weaver@maine.edu> wrote: > with current git the perf_fuzzer was able to trigger this NULL pointer > de-reference in the i915 driver. Please file a bug. https://gitlab.freedesktop.org/drm/intel/wikis/How-to-file-i915-bugs BR, Jani. -- Jani Nikula, Intel Open Source Graphics Center ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [perf] perf_fuzzer triggers NULL pointer derefernce in i915 driver 2019-12-13 7:09 ` Jani Nikula @ 2019-12-13 19:20 ` Dave Hansen 2019-12-13 19:53 ` Vince Weaver 0 siblings, 1 reply; 4+ messages in thread From: Dave Hansen @ 2019-12-13 19:20 UTC (permalink / raw) To: Jani Nikula, Vince Weaver, linux-kernel Cc: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo, Mark Rutland, Alexander Shishkin, Jiri Olsa, Namhyung Kim, Joonas Lahtinen, Rodrigo Vivi On 12/12/19 11:09 PM, Jani Nikula wrote: > On Thu, 12 Dec 2019, Vince Weaver <vincent.weaver@maine.edu> wrote: >> with current git the perf_fuzzer was able to trigger this NULL pointer >> de-reference in the i915 driver. > Please file a bug. > > https://gitlab.freedesktop.org/drm/intel/wikis/How-to-file-i915-bugs I'm seeing the same thing. It's annoyingly and immediately reproducible for me: https://gitlab.freedesktop.org/drm/intel/issues/826 Let me know if you want anything fancier done like a bisect. Looking back through my kernel logs, it appears to also have happened with 5.4.0-rc4. ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [perf] perf_fuzzer triggers NULL pointer derefernce in i915 driver 2019-12-13 19:20 ` Dave Hansen @ 2019-12-13 19:53 ` Vince Weaver 0 siblings, 0 replies; 4+ messages in thread From: Vince Weaver @ 2019-12-13 19:53 UTC (permalink / raw) To: Dave Hansen Cc: Jani Nikula, Vince Weaver, linux-kernel, Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo, Mark Rutland, Alexander Shishkin, Jiri Olsa, Namhyung Kim, Joonas Lahtinen, Rodrigo Vivi On Fri, 13 Dec 2019, Dave Hansen wrote: > On 12/12/19 11:09 PM, Jani Nikula wrote: > > On Thu, 12 Dec 2019, Vince Weaver <vincent.weaver@maine.edu> wrote: > >> with current git the perf_fuzzer was able to trigger this NULL pointer > >> de-reference in the i915 driver. > > Please file a bug. > > > > https://gitlab.freedesktop.org/drm/intel/wikis/How-to-file-i915-bugs > > I'm seeing the same thing. It's annoyingly and immediately reproducible > for me: > > https://gitlab.freedesktop.org/drm/intel/issues/826 > > Let me know if you want anything fancier done like a bisect. Looking > back through my kernel logs, it appears to also have happened with > 5.4.0-rc4. This patch was sent out in response to my report (but not as a direct reply). >From chris@chris-wilson.co.uk Thu Dec 12 10:42:36 2019 >Date: Thu, 12 Dec 2019 15:42:24 +0000 >From: Chris Wilson <chris@chris-wilson.co.uk> >To: intel-gfx@lists.freedesktop.org >Cc: Chris Wilson <chris@chris-wilson.co.uk>, Vince Weaver <vincent.weaver@maine.edu>, Matthew Auld <matthew.auld@intel.com> >Subject: [PATCH] drm/i915: Set fence_work.ops before dma_fence_init Since dma_fence_init may call ops (because of a meaningless trace_dma_fence), we need to set the worker ops prior to that call. Reported-by: Vince Weaver <vincent.weaver@maine.edu> Fixes: 8e458fe2ee05 ("drm/i915: Generalise the clflush dma-worker") Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Matthew Auld <matthew.auld@intel.com> Cc: Vince Weaver <vincent.weaver@maine.edu> --- drivers/gpu/drm/i915/i915_sw_fence_work.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_sw_fence_work.c b/drivers/gpu/drm/i915/i915_sw_fence_work.c index 07552cd544f2..8538ee7a521d 100644 --- a/drivers/gpu/drm/i915/i915_sw_fence_work.c +++ b/drivers/gpu/drm/i915/i915_sw_fence_work.c @@ -78,12 +78,11 @@ static const struct dma_fence_ops fence_ops = { void dma_fence_work_init(struct dma_fence_work *f, const struct dma_fence_work_ops *ops) { + f->ops = ops; spin_lock_init(&f->lock); dma_fence_init(&f->dma, &fence_ops, &f->lock, 0, 0); i915_sw_fence_init(&f->chain, fence_notify); INIT_WORK(&f->work, fence_work); - - f->ops = ops; } int dma_fence_work_chain(struct dma_fence_work *f, struct dma_fence *signal) -- 2.24.0 ^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-12-13 20:41 UTC | newest] Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2019-12-12 15:36 [perf] perf_fuzzer triggers NULL pointer derefernce in i915 driver Vince Weaver 2019-12-13 7:09 ` Jani Nikula 2019-12-13 19:20 ` Dave Hansen 2019-12-13 19:53 ` Vince Weaver
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).