diff mbox

[REGRESSION,4.12] i915 Oops at intel_fbdev_invalidate()

Message ID s5h1sq1cwop.wl-tiwai@suse.de (mailing list archive)
State New, archived
Headers show

Commit Message

Takashi Iwai June 30, 2017, 3:38 p.m. UTC 
Hi,

I hit an Oops with the latest Linus tree (4.12-rc7+) on a HSW machine
like the following at boot:

 BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0
 IP: intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
 Oops: 0000 [#1] PREEMPT SMP
 CPU: 2 PID: 833 Comm: X Not tainted 4.10.0-rc5-btest9+ #15
 Hardware name: Hewlett-Packard HP ProBook 430 G1/1946, BIOS L73 Ver. 08.05 2013/03/15
 task: ffff917313db8000 task.stack: ffffb6e70379c000
 RIP: 0010:intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
 RSP: 0018:ffffb6e70379fde0 EFLAGS: 00010246
 RAX: 0000000000000000 RBX: ffff9172f70e1c00 RCX: 0000000000000000
 RDX: ffff917313db8000 RSI: 0000000000000000 RDI: ffff91731934d040
 RBP: ffffb6e70379fdf0 R08: 0000000000000002 R09: ffff91731934ead0
 R10: ffff9173192f0368 R11: 0000000000000001 R12: ffff9173192f0000
 R13: ffff9172f71016e8 R14: ffff9173227c8480 R15: ffff9172f71016c8
 FS:  00007f8cc8c3fa00(0000) GS:ffff9173c0a80000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00000000000000b0 CR3: 000000006273b000 CR4: 00000000001406e0
 Call Trace:
  ? intel_fbdev_restore_mode+0x4e/0x70 [i915]
  i915_driver_lastclose+0xe/0x20 [i915]
  drm_lastclose+0x3b/0xf0 [drm]
  drm_release+0x2b8/0x360 [drm]
  __fput+0xd9/0x1e0
  ____fput+0xe/0x10
  task_work_run+0x83/0xa0
  exit_to_usermode_loop+0x59/0x85
  do_syscall_64+0xb3/0xd0
  entry_SYSCALL64_slow_path+0x25/0x25

And git bisection leaded to the commit 
fabef825626d7bd05a321e4427fdf31a169b5173
    drm/i915: Drop struct_mutex around frontbuffer flushes

The band-aid patch below seems fixing it.


thanks,

Takashi

-- 8< --
From: Takashi Iwai <tiwai@suse.de>
Subject: [PATCH] drm/i915: Fix NULL-dereference at intel_fbdev_invalidate()

The commit fabef825626d ("drm/i915: Drop struct_mutex around
frontbuffer flushes") caused an Oops at boot on a HSW machine like:

 BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0
 IP: intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
 Oops: 0000 [#1] PREEMPT SMP
 CPU: 2 PID: 833 Comm: X Not tainted 4.10.0-rc5-btest9+ #15
 Hardware name: Hewlett-Packard HP ProBook 430 G1/1946, BIOS L73 Ver. 08.05 2013/03/15
 Call Trace:
  ? intel_fbdev_restore_mode+0x4e/0x70 [i915]
  i915_driver_lastclose+0xe/0x20 [i915]
  drm_lastclose+0x3b/0xf0 [drm]
  drm_release+0x2b8/0x360 [drm]
  __fput+0xd9/0x1e0
  ____fput+0xe/0x10
  task_work_run+0x83/0xa0
  exit_to_usermode_loop+0x59/0x85
  do_syscall_64+0xb3/0xd0
  entry_SYSCALL64_slow_path+0x25/0x25

As this is a simple NULL dereference, check it before reference as a
band-aid fix.

Fixes: fabef825626d ("drm/i915: Drop struct_mutex around frontbuffer flushes")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 drivers/gpu/drm/i915/intel_fbdev.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

Chris Wilson June 30, 2017, 3:40 p.m. UTC | #1 
Quoting Takashi Iwai (2017-06-30 16:38:46)
> Hi,
> 
> I hit an Oops with the latest Linus tree (4.12-rc7+) on a HSW machine
> like the following at boot:
> 
>  BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0
>  IP: intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
>  Oops: 0000 [#1] PREEMPT SMP
>  CPU: 2 PID: 833 Comm: X Not tainted 4.10.0-rc5-btest9+ #15
>  Hardware name: Hewlett-Packard HP ProBook 430 G1/1946, BIOS L73 Ver. 08.05 2013/03/15
>  task: ffff917313db8000 task.stack: ffffb6e70379c000
>  RIP: 0010:intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
>  RSP: 0018:ffffb6e70379fde0 EFLAGS: 00010246
>  RAX: 0000000000000000 RBX: ffff9172f70e1c00 RCX: 0000000000000000
>  RDX: ffff917313db8000 RSI: 0000000000000000 RDI: ffff91731934d040
>  RBP: ffffb6e70379fdf0 R08: 0000000000000002 R09: ffff91731934ead0
>  R10: ffff9173192f0368 R11: 0000000000000001 R12: ffff9173192f0000
>  R13: ffff9172f71016e8 R14: ffff9173227c8480 R15: ffff9172f71016c8
>  FS:  00007f8cc8c3fa00(0000) GS:ffff9173c0a80000(0000) knlGS:0000000000000000
>  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>  CR2: 00000000000000b0 CR3: 000000006273b000 CR4: 00000000001406e0
>  Call Trace:
>   ? intel_fbdev_restore_mode+0x4e/0x70 [i915]
>   i915_driver_lastclose+0xe/0x20 [i915]
>   drm_lastclose+0x3b/0xf0 [drm]
>   drm_release+0x2b8/0x360 [drm]
>   __fput+0xd9/0x1e0
>   ____fput+0xe/0x10
>   task_work_run+0x83/0xa0
>   exit_to_usermode_loop+0x59/0x85
>   do_syscall_64+0xb3/0xd0
>   entry_SYSCALL64_slow_path+0x25/0x25
> 
> And git bisection leaded to the commit 
> fabef825626d7bd05a321e4427fdf31a169b5173
>     drm/i915: Drop struct_mutex around frontbuffer flushes
> 
> The band-aid patch below seems fixing it.

See https://patchwork.freedesktop.org/patch/163261/
-Chris
Takashi Iwai June 30, 2017, 4:58 p.m. UTC | #2 
On Fri, 30 Jun 2017 17:40:43 +0200,
Chris Wilson wrote:
> 
> Quoting Takashi Iwai (2017-06-30 16:38:46)
> > Hi,
> > 
> > I hit an Oops with the latest Linus tree (4.12-rc7+) on a HSW machine
> > like the following at boot:
> > 
> >  BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0
> >  IP: intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
> >  Oops: 0000 [#1] PREEMPT SMP
> >  CPU: 2 PID: 833 Comm: X Not tainted 4.10.0-rc5-btest9+ #15
> >  Hardware name: Hewlett-Packard HP ProBook 430 G1/1946, BIOS L73 Ver. 08.05 2013/03/15
> >  task: ffff917313db8000 task.stack: ffffb6e70379c000
> >  RIP: 0010:intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
> >  RSP: 0018:ffffb6e70379fde0 EFLAGS: 00010246
> >  RAX: 0000000000000000 RBX: ffff9172f70e1c00 RCX: 0000000000000000
> >  RDX: ffff917313db8000 RSI: 0000000000000000 RDI: ffff91731934d040
> >  RBP: ffffb6e70379fdf0 R08: 0000000000000002 R09: ffff91731934ead0
> >  R10: ffff9173192f0368 R11: 0000000000000001 R12: ffff9173192f0000
> >  R13: ffff9172f71016e8 R14: ffff9173227c8480 R15: ffff9172f71016c8
> >  FS:  00007f8cc8c3fa00(0000) GS:ffff9173c0a80000(0000) knlGS:0000000000000000
> >  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >  CR2: 00000000000000b0 CR3: 000000006273b000 CR4: 00000000001406e0
> >  Call Trace:
> >   ? intel_fbdev_restore_mode+0x4e/0x70 [i915]
> >   i915_driver_lastclose+0xe/0x20 [i915]
> >   drm_lastclose+0x3b/0xf0 [drm]
> >   drm_release+0x2b8/0x360 [drm]
> >   __fput+0xd9/0x1e0
> >   ____fput+0xe/0x10
> >   task_work_run+0x83/0xa0
> >   exit_to_usermode_loop+0x59/0x85
> >   do_syscall_64+0xb3/0xd0
> >   entry_SYSCALL64_slow_path+0x25/0x25
> > 
> > And git bisection leaded to the commit 
> > fabef825626d7bd05a321e4427fdf31a169b5173
> >     drm/i915: Drop struct_mutex around frontbuffer flushes
> > 
> > The band-aid patch below seems fixing it.
> 
> See https://patchwork.freedesktop.org/patch/163261/

Thanks, it worked.
  Tested-by: Takashi Iwai <tiwai@suse.de>

Could you guys pick it up to for-linus?  For 4.12 it's likely too
late, but there might be a miracle.


Takashi
diff mbox

Patch

diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 332254a8eebe..fdefe6941912 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -48,8 +48,10 @@ 
 static void intel_fbdev_invalidate(struct intel_fbdev *ifbdev)
 {
 	struct drm_i915_gem_object *obj = ifbdev->fb->obj;
-	unsigned int origin = ifbdev->vma->fence ? ORIGIN_GTT : ORIGIN_CPU;
+	unsigned int origin = ORIGIN_GTT;
 
+	if (ifbdev->vma && !ifbdev->vma->fence)
+		origin = ORIGIN_CPU;
 	intel_fb_obj_invalidate(obj, origin);
 }