All of lore.kernel.org
 help / color / mirror / Atom feed
From: vcaputo@pengaru.com
To: chris@chris-wilson.co.uk
Cc: dri-devel@lists.freedesktop.org
Subject: NULL pointer dereference in i915_gem_request_alloc()
Date: Sun, 1 Jan 2017 15:16:31 -0600	[thread overview]
Message-ID: <20170101211631.GA26952@shells.gnugeneration.com> (raw)

Hi Chris,

I've uncovered a bug in i915_gem_request_alloc():
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/drivers/gpu/drm/i915/i915_gem_request.c?h=v4.9#n425

ctx here may be NULL, and i915_gem_context_get() is unconditionally
adding a reference to the supplied ctx, which makes things go boom when
NULL.

This happens for me in practice via:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/drivers/gpu/drm/i915/intel_display.c?h=v4.9#n12317

It appears engine->last_context may be NULL.

The comment heading i915_gem_request_alloc() states that ctx shall be
NULL and that an appropriate context will be chosen automatically.  This
is not what is currently implemented.

My reproducer is an unaccelerated drm graphics toy which just sets a
mode and submits page flips using dumb buffers.  If I start Xorg first,
the bug doesn't trigger, presumably because engine->last_context gets
initialized.  But running the toy from the console immediately after
booting without starting Xorg, i915 explodes.

I would have only mailed dri-devel but my last email there seems to be
lost in a moderation queue, and I'd rather not subscribe to another
relatively high-volume list.  I've CC'd the list just in case it gets
through.

Thanks,
Vito Caputo
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

             reply	other threads:[~2017-01-01 21:16 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-01-01 21:16 vcaputo [this message]
2017-01-02 10:09 ` NULL pointer dereference in i915_gem_request_alloc() Chris Wilson
2017-01-09 19:43   ` vcaputo

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170101211631.GA26952@shells.gnugeneration.com \
    --to=vcaputo@pengaru.com \
    --cc=chris@chris-wilson.co.uk \
    --cc=dri-devel@lists.freedesktop.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.