| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 30 Jun 2017 17:38:46 +0200
From: Takashi Iwai <tiwai@...e.de>
To: intel-gfx@...ts.freedesktop.org
Cc: Chris Wilson <chris@...is-wilson.co.uk>,
Daniel Vetter <daniel.vetter@...el.com>,
Jani Nikula <jani.nikula@...ux.intel.com>,
linux-kernel@...r.kernel.org
Subject: [REGRESSION 4.12] i915 Oops at intel_fbdev_invalidate()
Hi,
I hit an Oops with the latest Linus tree (4.12-rc7+) on a HSW machine
like the following at boot:
BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0
IP: intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
Oops: 0000 [#1] PREEMPT SMP
CPU: 2 PID: 833 Comm: X Not tainted 4.10.0-rc5-btest9+ #15
Hardware name: Hewlett-Packard HP ProBook 430 G1/1946, BIOS L73 Ver. 08.05 2013/03/15
task: ffff917313db8000 task.stack: ffffb6e70379c000
RIP: 0010:intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
RSP: 0018:ffffb6e70379fde0 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff9172f70e1c00 RCX: 0000000000000000
RDX: ffff917313db8000 RSI: 0000000000000000 RDI: ffff91731934d040
RBP: ffffb6e70379fdf0 R08: 0000000000000002 R09: ffff91731934ead0
R10: ffff9173192f0368 R11: 0000000000000001 R12: ffff9173192f0000
R13: ffff9172f71016e8 R14: ffff9173227c8480 R15: ffff9172f71016c8
FS: 00007f8cc8c3fa00(0000) GS:ffff9173c0a80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000000000b0 CR3: 000000006273b000 CR4: 00000000001406e0
Call Trace:
? intel_fbdev_restore_mode+0x4e/0x70 [i915]
i915_driver_lastclose+0xe/0x20 [i915]
drm_lastclose+0x3b/0xf0 [drm]
drm_release+0x2b8/0x360 [drm]
__fput+0xd9/0x1e0
____fput+0xe/0x10
task_work_run+0x83/0xa0
exit_to_usermode_loop+0x59/0x85
do_syscall_64+0xb3/0xd0
entry_SYSCALL64_slow_path+0x25/0x25
And git bisection leaded to the commit
fabef825626d7bd05a321e4427fdf31a169b5173
drm/i915: Drop struct_mutex around frontbuffer flushes
The band-aid patch below seems fixing it.
thanks,
Takashi
-- 8< --
From: Takashi Iwai <tiwai@...e.de>
Subject: [PATCH] drm/i915: Fix NULL-dereference at intel_fbdev_invalidate()
The commit fabef825626d ("drm/i915: Drop struct_mutex around
frontbuffer flushes") caused an Oops at boot on a HSW machine like:
BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0
IP: intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
Oops: 0000 [#1] PREEMPT SMP
CPU: 2 PID: 833 Comm: X Not tainted 4.10.0-rc5-btest9+ #15
Hardware name: Hewlett-Packard HP ProBook 430 G1/1946, BIOS L73 Ver. 08.05 2013/03/15
Call Trace:
? intel_fbdev_restore_mode+0x4e/0x70 [i915]
i915_driver_lastclose+0xe/0x20 [i915]
drm_lastclose+0x3b/0xf0 [drm]
drm_release+0x2b8/0x360 [drm]
__fput+0xd9/0x1e0
____fput+0xe/0x10
task_work_run+0x83/0xa0
exit_to_usermode_loop+0x59/0x85
do_syscall_64+0xb3/0xd0
entry_SYSCALL64_slow_path+0x25/0x25
As this is a simple NULL dereference, check it before reference as a
band-aid fix.
Fixes: fabef825626d ("drm/i915: Drop struct_mutex around frontbuffer flushes")
Signed-off-by: Takashi Iwai <tiwai@...e.de>
---
drivers/gpu/drm/i915/intel_fbdev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 332254a8eebe..fdefe6941912 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -48,8 +48,10 @@
static void intel_fbdev_invalidate(struct intel_fbdev *ifbdev)
{
struct drm_i915_gem_object *obj = ifbdev->fb->obj;
- unsigned int origin = ifbdev->vma->fence ? ORIGIN_GTT : ORIGIN_CPU;
+ unsigned int origin = ORIGIN_GTT;
+ if (ifbdev->vma && !ifbdev->vma->fence)
+ origin = ORIGIN_CPU;
intel_fb_obj_invalidate(obj, origin);
}
--
2.13.2
Powered by blists - more mailing lists