linux-kernel - Re: [PATCH 3.12 36/58] Revert "drm/radeon: hold reference to fences in radeon_sa_bo

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 16 Mar 2016 14:41:35 -0500
From:	Nicolai Hähnle <nicolai.haehnle@....com>
To:	Jiri Slaby <jslaby@...e.cz>, <stable@...r.kernel.org>
CC:	<linux-kernel@...r.kernel.org>,
	Christian König <christian.koenig@....com>
Subject: Re: [PATCH 3.12 36/58] Revert "drm/radeon: hold reference to fences
 in radeon_sa_bo_new"

This is fine. Please consider applying the corrected backport that I 
sent around yesterday.

Apologies for the mess - an unfortunate interaction with older code, 
plus then some stable branches already reverted the original backport 
while others didn't. The best way forward right now is to revert the 
original backport (as indicated in your mail) and apply the fixed one.

Thanks,
Nicolai

On 16.03.2016 05:59, Jiri Slaby wrote:
> 3.12-stable review patch.  If anyone has any objections, please let me know.
>
> ===============
>
> This reverts commit 40df18b49e7fe4ec9ab93f68c33661ee291149bd, commit
> f6ff4f67cdf8455d0a4226eeeaf5af17c37d05eb upstream.
>
> It causes oopses:
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
> IP: [<ffffffffa010345d>] radeon_fence_ref+0xd/0x50 [radeon]
>
> Signed-off-by: Jiri Slaby <jslaby@...e.cz>
> Cc: Nicolai Hähnle <nicolai.haehnle@....com>
> Cc: Christian König <christian.koenig@....com>
> ---
>   drivers/gpu/drm/radeon/radeon_sa.c | 5 -----
>   1 file changed, 5 deletions(-)
>
> diff --git a/drivers/gpu/drm/radeon/radeon_sa.c b/drivers/gpu/drm/radeon/radeon_sa.c
> index bb166849aa6e..f0bac68254b7 100644
> --- a/drivers/gpu/drm/radeon/radeon_sa.c
> +++ b/drivers/gpu/drm/radeon/radeon_sa.c
> @@ -349,13 +349,8 @@ int radeon_sa_bo_new(struct radeon_device *rdev,
>   			/* see if we can skip over some allocations */
>   		} while (radeon_sa_bo_next_hole(sa_manager, fences, tries));
>
> -		for (i = 0; i < RADEON_NUM_RINGS; ++i)
> -			radeon_fence_ref(fences[i]);
> -
>   		spin_unlock(&sa_manager->wq.lock);
>   		r = radeon_fence_wait_any(rdev, fences, false);
> -		for (i = 0; i < RADEON_NUM_RINGS; ++i)
> -			radeon_fence_unref(&fences[i]);
>   		spin_lock(&sa_manager->wq.lock);
>   		/* if we have nothing to wait for block */
>   		if (r == -ENOENT && block) {
>