From: Takashi Iwai <tiwai@suse.de>
To: intel-gfx@lists.freedesktop.org
Cc: Chris Wilson <chris@chris-wilson.co.uk>,
Daniel Vetter <daniel.vetter@intel.com>,
Jani Nikula <jani.nikula@linux.intel.com>,
linux-kernel@vger.kernel.org
Subject: [REGRESSION 4.12] i915 Oops at intel_fbdev_invalidate()
Date: Fri, 30 Jun 2017 17:38:46 +0200 [thread overview]
Message-ID: <s5h1sq1cwop.wl-tiwai@suse.de> (raw)
Hi,
I hit an Oops with the latest Linus tree (4.12-rc7+) on a HSW machine
like the following at boot:
BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0
IP: intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
Oops: 0000 [#1] PREEMPT SMP
CPU: 2 PID: 833 Comm: X Not tainted 4.10.0-rc5-btest9+ #15
Hardware name: Hewlett-Packard HP ProBook 430 G1/1946, BIOS L73 Ver. 08.05 2013/03/15
task: ffff917313db8000 task.stack: ffffb6e70379c000
RIP: 0010:intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
RSP: 0018:ffffb6e70379fde0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff9172f70e1c00 RCX: 0000000000000000
RDX: ffff917313db8000 RSI: 0000000000000000 RDI: ffff91731934d040
RBP: ffffb6e70379fdf0 R08: 0000000000000002 R09: ffff91731934ead0
R10: ffff9173192f0368 R11: 0000000000000001 R12: ffff9173192f0000
R13: ffff9172f71016e8 R14: ffff9173227c8480 R15: ffff9172f71016c8
FS: 00007f8cc8c3fa00(0000) GS:ffff9173c0a80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000b0 CR3: 000000006273b000 CR4: 00000000001406e0
Call Trace:
? intel_fbdev_restore_mode+0x4e/0x70 [i915]
i915_driver_lastclose+0xe/0x20 [i915]
drm_lastclose+0x3b/0xf0 [drm]
drm_release+0x2b8/0x360 [drm]
__fput+0xd9/0x1e0
____fput+0xe/0x10
task_work_run+0x83/0xa0
exit_to_usermode_loop+0x59/0x85
do_syscall_64+0xb3/0xd0
entry_SYSCALL64_slow_path+0x25/0x25
And git bisection leaded to the commit
fabef825626d7bd05a321e4427fdf31a169b5173
drm/i915: Drop struct_mutex around frontbuffer flushes
The band-aid patch below seems fixing it.
thanks,
Takashi
-- 8< --
From: Takashi Iwai <tiwai@suse.de>
Subject: [PATCH] drm/i915: Fix NULL-dereference at intel_fbdev_invalidate()
The commit fabef825626d ("drm/i915: Drop struct_mutex around
frontbuffer flushes") caused an Oops at boot on a HSW machine like:
BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0
IP: intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
Oops: 0000 [#1] PREEMPT SMP
CPU: 2 PID: 833 Comm: X Not tainted 4.10.0-rc5-btest9+ #15
Hardware name: Hewlett-Packard HP ProBook 430 G1/1946, BIOS L73 Ver. 08.05 2013/03/15
Call Trace:
? intel_fbdev_restore_mode+0x4e/0x70 [i915]
i915_driver_lastclose+0xe/0x20 [i915]
drm_lastclose+0x3b/0xf0 [drm]
drm_release+0x2b8/0x360 [drm]
__fput+0xd9/0x1e0
____fput+0xe/0x10
task_work_run+0x83/0xa0
exit_to_usermode_loop+0x59/0x85
do_syscall_64+0xb3/0xd0
entry_SYSCALL64_slow_path+0x25/0x25
As this is a simple NULL dereference, check it before reference as a
band-aid fix.
Fixes: fabef825626d ("drm/i915: Drop struct_mutex around frontbuffer flushes")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
drivers/gpu/drm/i915/intel_fbdev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 332254a8eebe..fdefe6941912 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -48,8 +48,10 @@
static void intel_fbdev_invalidate(struct intel_fbdev *ifbdev)
{
struct drm_i915_gem_object *obj = ifbdev->fb->obj;
- unsigned int origin = ifbdev->vma->fence ? ORIGIN_GTT : ORIGIN_CPU;
+ unsigned int origin = ORIGIN_GTT;
+ if (ifbdev->vma && !ifbdev->vma->fence)
+ origin = ORIGIN_CPU;
intel_fb_obj_invalidate(obj, origin);
}
--
2.13.2
WARNING: multiple messages have this Message-ID (diff)
From: Takashi Iwai <tiwai@suse.de>
To: intel-gfx@lists.freedesktop.org
Cc: Daniel Vetter <daniel.vetter@intel.com>, linux-kernel@vger.kernel.org
Subject: [REGRESSION 4.12] i915 Oops at intel_fbdev_invalidate()
Date: Fri, 30 Jun 2017 17:38:46 +0200 [thread overview]
Message-ID: <s5h1sq1cwop.wl-tiwai@suse.de> (raw)
Hi,
I hit an Oops with the latest Linus tree (4.12-rc7+) on a HSW machine
like the following at boot:
BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0
IP: intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
Oops: 0000 [#1] PREEMPT SMP
CPU: 2 PID: 833 Comm: X Not tainted 4.10.0-rc5-btest9+ #15
Hardware name: Hewlett-Packard HP ProBook 430 G1/1946, BIOS L73 Ver. 08.05 2013/03/15
task: ffff917313db8000 task.stack: ffffb6e70379c000
RIP: 0010:intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
RSP: 0018:ffffb6e70379fde0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff9172f70e1c00 RCX: 0000000000000000
RDX: ffff917313db8000 RSI: 0000000000000000 RDI: ffff91731934d040
RBP: ffffb6e70379fdf0 R08: 0000000000000002 R09: ffff91731934ead0
R10: ffff9173192f0368 R11: 0000000000000001 R12: ffff9173192f0000
R13: ffff9172f71016e8 R14: ffff9173227c8480 R15: ffff9172f71016c8
FS: 00007f8cc8c3fa00(0000) GS:ffff9173c0a80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000b0 CR3: 000000006273b000 CR4: 00000000001406e0
Call Trace:
? intel_fbdev_restore_mode+0x4e/0x70 [i915]
i915_driver_lastclose+0xe/0x20 [i915]
drm_lastclose+0x3b/0xf0 [drm]
drm_release+0x2b8/0x360 [drm]
__fput+0xd9/0x1e0
____fput+0xe/0x10
task_work_run+0x83/0xa0
exit_to_usermode_loop+0x59/0x85
do_syscall_64+0xb3/0xd0
entry_SYSCALL64_slow_path+0x25/0x25
And git bisection leaded to the commit
fabef825626d7bd05a321e4427fdf31a169b5173
drm/i915: Drop struct_mutex around frontbuffer flushes
The band-aid patch below seems fixing it.
thanks,
Takashi
-- 8< --
From: Takashi Iwai <tiwai@suse.de>
Subject: [PATCH] drm/i915: Fix NULL-dereference at intel_fbdev_invalidate()
The commit fabef825626d ("drm/i915: Drop struct_mutex around
frontbuffer flushes") caused an Oops at boot on a HSW machine like:
BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0
IP: intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
Oops: 0000 [#1] PREEMPT SMP
CPU: 2 PID: 833 Comm: X Not tainted 4.10.0-rc5-btest9+ #15
Hardware name: Hewlett-Packard HP ProBook 430 G1/1946, BIOS L73 Ver. 08.05 2013/03/15
Call Trace:
? intel_fbdev_restore_mode+0x4e/0x70 [i915]
i915_driver_lastclose+0xe/0x20 [i915]
drm_lastclose+0x3b/0xf0 [drm]
drm_release+0x2b8/0x360 [drm]
__fput+0xd9/0x1e0
____fput+0xe/0x10
task_work_run+0x83/0xa0
exit_to_usermode_loop+0x59/0x85
do_syscall_64+0xb3/0xd0
entry_SYSCALL64_slow_path+0x25/0x25
As this is a simple NULL dereference, check it before reference as a
band-aid fix.
Fixes: fabef825626d ("drm/i915: Drop struct_mutex around frontbuffer flushes")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
drivers/gpu/drm/i915/intel_fbdev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 332254a8eebe..fdefe6941912 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -48,8 +48,10 @@
static void intel_fbdev_invalidate(struct intel_fbdev *ifbdev)
{
struct drm_i915_gem_object *obj = ifbdev->fb->obj;
- unsigned int origin = ifbdev->vma->fence ? ORIGIN_GTT : ORIGIN_CPU;
+ unsigned int origin = ORIGIN_GTT;
+ if (ifbdev->vma && !ifbdev->vma->fence)
+ origin = ORIGIN_CPU;
intel_fb_obj_invalidate(obj, origin);
}
--
2.13.2
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
next reply other threads:[~2017-06-30 15:38 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-06-30 15:38 Takashi Iwai [this message]
2017-06-30 15:38 ` [REGRESSION 4.12] i915 Oops at intel_fbdev_invalidate() Takashi Iwai
2017-06-30 15:40 ` Chris Wilson
2017-06-30 16:58 ` Takashi Iwai
2017-06-30 16:58 ` Takashi Iwai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=s5h1sq1cwop.wl-tiwai@suse.de \
--to=tiwai@suse.de \
--cc=chris@chris-wilson.co.uk \
--cc=daniel.vetter@intel.com \
--cc=intel-gfx@lists.freedesktop.org \
--cc=jani.nikula@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.