From patchwork Fri Jun 30 15:38:46 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Takashi Iwai X-Patchwork-Id: 9819863 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E7846603F2 for ; Fri, 30 Jun 2017 15:38:53 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DA5D428683 for ; Fri, 30 Jun 2017 15:38:53 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id CDDC7286B5; Fri, 30 Jun 2017 15:38:53 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 7380628683 for ; Fri, 30 Jun 2017 15:38:52 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 1136A6E198; Fri, 30 Jun 2017 15:38:52 +0000 (UTC) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from mx1.suse.de (mx2.suse.de [195.135.220.15]) by gabe.freedesktop.org (Postfix) with ESMTPS id 05CE76E198 for ; Fri, 30 Jun 2017 15:38:50 +0000 (UTC) X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id 95FE0AAC5; Fri, 30 Jun 2017 15:38:48 +0000 (UTC) Date: Fri, 30 Jun 2017 17:38:46 +0200 Message-ID: From: Takashi Iwai To: intel-gfx@lists.freedesktop.org User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/25.2 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Cc: Daniel Vetter , linux-kernel@vger.kernel.org Subject: [Intel-gfx] [REGRESSION 4.12] i915 Oops at intel_fbdev_invalidate() X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" X-Virus-Scanned: ClamAV using ClamSMTP Hi, I hit an Oops with the latest Linus tree (4.12-rc7+) on a HSW machine like the following at boot: BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0 IP: intel_fbdev_invalidate.isra.3+0xc/0x40 [i915] Oops: 0000 [#1] PREEMPT SMP CPU: 2 PID: 833 Comm: X Not tainted 4.10.0-rc5-btest9+ #15 Hardware name: Hewlett-Packard HP ProBook 430 G1/1946, BIOS L73 Ver. 08.05 2013/03/15 task: ffff917313db8000 task.stack: ffffb6e70379c000 RIP: 0010:intel_fbdev_invalidate.isra.3+0xc/0x40 [i915] RSP: 0018:ffffb6e70379fde0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff9172f70e1c00 RCX: 0000000000000000 RDX: ffff917313db8000 RSI: 0000000000000000 RDI: ffff91731934d040 RBP: ffffb6e70379fdf0 R08: 0000000000000002 R09: ffff91731934ead0 R10: ffff9173192f0368 R11: 0000000000000001 R12: ffff9173192f0000 R13: ffff9172f71016e8 R14: ffff9173227c8480 R15: ffff9172f71016c8 FS: 00007f8cc8c3fa00(0000) GS:ffff9173c0a80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000b0 CR3: 000000006273b000 CR4: 00000000001406e0 Call Trace: ? intel_fbdev_restore_mode+0x4e/0x70 [i915] i915_driver_lastclose+0xe/0x20 [i915] drm_lastclose+0x3b/0xf0 [drm] drm_release+0x2b8/0x360 [drm] __fput+0xd9/0x1e0 ____fput+0xe/0x10 task_work_run+0x83/0xa0 exit_to_usermode_loop+0x59/0x85 do_syscall_64+0xb3/0xd0 entry_SYSCALL64_slow_path+0x25/0x25 And git bisection leaded to the commit fabef825626d7bd05a321e4427fdf31a169b5173 drm/i915: Drop struct_mutex around frontbuffer flushes The band-aid patch below seems fixing it. thanks, Takashi -- 8< -- From: Takashi Iwai Subject: [PATCH] drm/i915: Fix NULL-dereference at intel_fbdev_invalidate() The commit fabef825626d ("drm/i915: Drop struct_mutex around frontbuffer flushes") caused an Oops at boot on a HSW machine like: BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0 IP: intel_fbdev_invalidate.isra.3+0xc/0x40 [i915] Oops: 0000 [#1] PREEMPT SMP CPU: 2 PID: 833 Comm: X Not tainted 4.10.0-rc5-btest9+ #15 Hardware name: Hewlett-Packard HP ProBook 430 G1/1946, BIOS L73 Ver. 08.05 2013/03/15 Call Trace: ? intel_fbdev_restore_mode+0x4e/0x70 [i915] i915_driver_lastclose+0xe/0x20 [i915] drm_lastclose+0x3b/0xf0 [drm] drm_release+0x2b8/0x360 [drm] __fput+0xd9/0x1e0 ____fput+0xe/0x10 task_work_run+0x83/0xa0 exit_to_usermode_loop+0x59/0x85 do_syscall_64+0xb3/0xd0 entry_SYSCALL64_slow_path+0x25/0x25 As this is a simple NULL dereference, check it before reference as a band-aid fix. Fixes: fabef825626d ("drm/i915: Drop struct_mutex around frontbuffer flushes") Signed-off-by: Takashi Iwai --- drivers/gpu/drm/i915/intel_fbdev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c index 332254a8eebe..fdefe6941912 100644 --- a/drivers/gpu/drm/i915/intel_fbdev.c +++ b/drivers/gpu/drm/i915/intel_fbdev.c @@ -48,8 +48,10 @@ static void intel_fbdev_invalidate(struct intel_fbdev *ifbdev) { struct drm_i915_gem_object *obj = ifbdev->fb->obj; - unsigned int origin = ifbdev->vma->fence ? ORIGIN_GTT : ORIGIN_CPU; + unsigned int origin = ORIGIN_GTT; + if (ifbdev->vma && !ifbdev->vma->fence) + origin = ORIGIN_CPU; intel_fb_obj_invalidate(obj, origin); }