From: Daniel Vetter <daniel@ffwll.ch>
To: Chris Wilson <chris@chris-wilson.co.uk>,
Daniel Vetter <daniel.vetter@ffwll.ch>,
DRI Development <dri-devel@lists.freedesktop.org>,
Intel Graphics Development <intel-gfx@lists.freedesktop.org>,
Daniel Vetter <daniel.vetter@intel.com>
Subject: Re: [PATCH 09/16] drm/vgem: Stop calling drm_drv_set_unique
Date: Mon, 20 Jun 2016 14:51:20 +0200 [thread overview]
Message-ID: <20160620125120.GB23520@phenom.ffwll.local> (raw)
In-Reply-To: <20160620114255.GM15272@nuc-i3427.alporthouse.com>
On Mon, Jun 20, 2016 at 12:42:55PM +0100, Chris Wilson wrote:
> On Fri, Jun 17, 2016 at 09:33:27AM +0200, Daniel Vetter wrote:
> > With the previous patch this is now redudant, the core always
> > sets a reasonable dev->unique string.
> >
> > Cc: Sean Paul <seanpaul@chromium.org>
> > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
>
> Will this fix:
Oh the hilarity. No, this will unfortunately not fix this. And the bug has
been there since forever, since if you use the drmOpenByName (which
doesn't call SET_VERSION which hence might result with master->unique
still NULL).
I think the right fix for this would be to insert another
else if (dev->unique)
case in drm_name_info. I'll try to type that one.
-Daniel
>
> [ 4442.886507] ==================================================================
> [ 4442.886854] BUG: KASAN: null-ptr-deref on address 0000000000000050
> [ 4442.887116] Read of size 8 by task cat/1376
> [ 4442.887369] CPU: 1 PID: 1376 Comm: cat Not tainted 4.7.0-rc4+ #356
> [ 4442.887692] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0027.2015.0507.1758 05/07/2015
> [ 4442.888169] 0000000000000000 ffff88022f057a50 ffffffff8145ebab ffff88022f057ae0
> [ 4442.889531] ffff880234672900 ffff88022f057ad0 ffffffff812509f8 ffff880234672900
> [ 4442.890551] ffffffff8124c214 0000000000000292 ffff88022f057ab0 ffffffff81114554
> [ 4442.891561] Call Trace:
> [ 4442.891832] [<ffffffff8145ebab>] dump_stack+0x68/0x9d
> [ 4442.892119] [<ffffffff812509f8>] kasan_report_error+0x438/0x530
> [ 4442.892416] [<ffffffff8124c214>] ? __slab_alloc.constprop.66+0x44/0x70
> [ 4442.892710] [<ffffffff81114554>] ? __lock_is_held+0x84/0xc0
> [ 4442.893003] [<ffffffff81250ee9>] kasan_report+0x39/0x3b
> [ 4442.893290] [<ffffffff8124c300>] ? __kmalloc+0xc0/0x2b0
> [ 4442.893578] [<ffffffff815e2963>] ? drm_name_info+0xf3/0x150
> [ 4442.893864] [<ffffffff8124fa3e>] __asan_load8+0x5e/0x70
> [ 4442.894148] [<ffffffff815e2963>] drm_name_info+0xf3/0x150
> [ 4442.894436] [<ffffffff81294085>] seq_read+0x1f5/0x820
> [ 4442.894727] [<ffffffff81293e90>] ? seq_hlist_next_percpu+0x120/0x120
> [ 4442.895019] [<ffffffff811f2630>] ? warn_alloc_failed+0x1e0/0x1e0
> [ 4442.895314] [<ffffffff813d7ec5>] ? full_proxy_read+0x5/0xf0
> [ 4442.895604] [<ffffffff813d7f70>] full_proxy_read+0xb0/0xf0
> [ 4442.895892] [<ffffffff813d7ec5>] ? full_proxy_read+0x5/0xf0
> [ 4442.896182] [<ffffffff81254ad7>] __vfs_read+0xd7/0x320
> [ 4442.896469] [<ffffffff81254a00>] ? do_loop_readv_writev+0x120/0x120
> [ 4442.896760] [<ffffffff811185c0>] ? debug_check_no_locks_freed+0x1a0/0x1a0
> [ 4442.897063] [<ffffffff81226c60>] ? copy_page_range+0xc20/0xc20
> [ 4442.897352] [<ffffffff811368aa>] ? debug_lockdep_rcu_enabled.part.4+0x1a/0x30
> [ 4442.897694] [<ffffffff811368f5>] ? debug_lockdep_rcu_enabled+0x35/0x40
> [ 4442.897987] [<ffffffff81256735>] ? rw_verify_area+0x65/0x140
> [ 4442.898276] [<ffffffff812568cc>] vfs_read+0xbc/0x170
> [ 4442.898564] [<ffffffff812586bb>] SyS_read+0xab/0x130
> [ 4442.898850] [<ffffffff81258610>] ? vfs_copy_file_range+0x2f0/0x2f0
> [ 4442.899139] [<ffffffff81118072>] ? trace_hardirqs_on_caller+0x182/0x280
> [ 4442.899433] [<ffffffff8100179a>] ? trace_hardirqs_on_thunk+0x1a/0x1c
> [ 4442.899728] [<ffffffff8181b165>] entry_SYSCALL_64_fastpath+0x18/0xa8
> [ 4442.900018] [<ffffffff81113b20>] ? trace_hardirqs_off_caller+0xc0/0x110
> [ 4442.900301] ==================================================================
> [ 4442.900603] Disabling lock debugging due to kernel taint
> [ 4442.901031] BUG: unable to handle kernel NULL pointer dereference at 0000000000000050
> [ 4442.906576] IP: [<ffffffff815e2963>] drm_name_info+0xf3/0x150
> [ 4442.906877] PGD 23472f067 PUD 2350f8067 PMD 0
> [ 4442.907418] Oops: 0000 [#1] SMP KASAN
> [ 4442.907592] Modules linked in: vgem i915 intel_gtt
> [ 4442.908279] CPU: 1 PID: 1376 Comm: cat Tainted: G B 4.7.0-rc4+ #356
> [ 4442.908500] Hardware name: /NUC5CPYB, BIOS PYBSWCEL.86A.0027.2015.0507.1758 05/07/2015
> [ 4442.908732] task: ffff880234672900 ti: ffff88022f050000 task.ti: ffff88022f050000
> [ 4442.908952] RIP: 0010:[<ffffffff815e2963>] [<ffffffff815e2963>] drm_name_info+0xf3/0x150
> [ 4442.909310] RSP: 0018:ffff88022f057b28 EFLAGS: 00010282
> [ 4442.909492] RAX: ffff880234672900 RBX: 0000000000000000 RCX: ffffffff81117f06
> [ 4442.909680] RDX: 0000000000000004 RSI: 0000000000000003 RDI: ffffffff82181b20
> [ 4442.909868] RBP: ffff88022f057b50 R08: 0000000000000003 R09: 0000000000000000
> [ 4442.910054] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8802346c55f0
> [ 4442.910240] R13: ffff880235a6a000 R14: 0000000000000000 R15: ffff880231f1c7e0
> [ 4442.910428] FS: 00007f9349817700(0000) GS:ffff880237700000(0000) knlGS:0000000000000000
> [ 4442.910652] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 4442.910834] CR2: 0000000000000050 CR3: 00000002350f6000 CR4: 00000000001006e0
> [ 4442.911016] Stack:
> [ 4442.911185] ffff880235a6a000 0000000000000001 ffff880235a6a0c0 0000000000000000
> [ 4442.911906] ffff880231f1c7e0 ffff88022f057ca0 ffffffff81294085 ffff880234673028
> [ 4442.912627] ffff880234672fd8 00007f93497f5000 ffff880235a6a030 ffff88022f057ee0
> [ 4442.913349] Call Trace:
> [ 4442.913534] [<ffffffff81294085>] seq_read+0x1f5/0x820
> [ 4442.913735] [<ffffffff81293e90>] ? seq_hlist_next_percpu+0x120/0x120
> [ 4442.919906] [<ffffffff811f2630>] ? warn_alloc_failed+0x1e0/0x1e0
> [ 4442.920111] [<ffffffff813d7ec5>] ? full_proxy_read+0x5/0xf0
> [ 4442.920314] [<ffffffff813d7f70>] full_proxy_read+0xb0/0xf0
> [ 4442.920514] [<ffffffff813d7ec5>] ? full_proxy_read+0x5/0xf0
> [ 4442.920715] [<ffffffff81254ad7>] __vfs_read+0xd7/0x320
> [ 4442.920916] [<ffffffff81254a00>] ? do_loop_readv_writev+0x120/0x120
> [ 4442.921119] [<ffffffff811185c0>] ? debug_check_no_locks_freed+0x1a0/0x1a0
> [ 4442.921322] [<ffffffff81226c60>] ? copy_page_range+0xc20/0xc20
> [ 4442.921522] [<ffffffff811368aa>] ? debug_lockdep_rcu_enabled.part.4+0x1a/0x30
> [ 4442.921757] [<ffffffff811368f5>] ? debug_lockdep_rcu_enabled+0x35/0x40
> [ 4442.921961] [<ffffffff81256735>] ? rw_verify_area+0x65/0x140
> [ 4442.922162] [<ffffffff812568cc>] vfs_read+0xbc/0x170
> [ 4442.922360] [<ffffffff812586bb>] SyS_read+0xab/0x130
> [ 4442.922558] [<ffffffff81258610>] ? vfs_copy_file_range+0x2f0/0x2f0
> [ 4442.922758] [<ffffffff81118072>] ? trace_hardirqs_on_caller+0x182/0x280
> [ 4442.922962] [<ffffffff8100179a>] ? trace_hardirqs_on_thunk+0x1a/0x1c
> [ 4442.923163] [<ffffffff8181b165>] entry_SYSCALL_64_fastpath+0x18/0xa8
> [ 4442.923365] [<ffffffff81113b20>] ? trace_hardirqs_off_caller+0xc0/0x110
> [ 4442.923561] Code: 5c 41 5d 41 5e 41 5f 5d c3 48 8d 7b 10 e8 96 d0 c6 ff 4c 8b 7b 10 eb ad e8 8b d0 c6 ff 49 8b 5c 24 18 48 8d 7b 50 e8 7d d0 c6 ff <4c> 8b 73 50 4d 85 f6 74 41 49 8d 7c 24 20 e8 6a d0 c6 ff 49 8b
> [ 4442.937003] RIP [<ffffffff815e2963>] drm_name_info+0xf3/0x150
> [ 4442.937306] RSP <ffff88022f057b28>
> [ 4442.937476] CR2: 0000000000000050
> [ 4442.941304] ---[ end trace 7b3b90baf4ed1a85 ]---
>
> --
> Chris Wilson, Intel Open Source Technology Centre
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
next prev parent reply other threads:[~2016-06-20 12:51 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-06-17 7:33 [PATCH 00/16] More drm master and SET_UNIQUE cleanups Daniel Vetter
2016-06-17 7:33 ` [PATCH 01/16] drm: Only do the hw.lock cleanup in master_relase for !MODESET Daniel Vetter
2016-06-17 7:33 ` [PATCH 02/16] drm: Move authmagic cleanup into drm_master_release Daniel Vetter
2016-06-17 7:33 ` [PATCH 03/16] drm: Protect authmagic with master_mutex Daniel Vetter
2016-06-17 7:33 ` [PATCH 04/16] drm: Mark authmagic ioctls as unlocked Daniel Vetter
2016-06-17 7:33 ` [PATCH 05/16] drm: Mark set/drop master ioctl " Daniel Vetter
2016-06-17 7:33 ` [PATCH 06/16] drm: Move master pointer from drm_minor to drm_device Daniel Vetter
2016-06-17 7:51 ` Chris Wilson
2016-06-17 7:33 ` [PATCH 07/16] drm: Clean up drm_crtc.h Daniel Vetter
2016-06-17 7:53 ` [Intel-gfx] " Chris Wilson
2016-06-20 20:18 ` Daniel Vetter
2016-06-17 7:33 ` [PATCH 08/16] drm: Use dev->name as fallback for dev->unique Daniel Vetter
2016-06-17 22:25 ` Emil Velikov
2016-06-17 7:33 ` [PATCH 09/16] drm/vgem: Stop calling drm_drv_set_unique Daniel Vetter
2016-06-20 11:42 ` Chris Wilson
2016-06-20 12:51 ` Daniel Vetter [this message]
2016-06-17 7:33 ` [PATCH 10/16] drm: Don't call drm_dev_set_unique from platform drivers Daniel Vetter
2016-06-17 11:12 ` Laurent Pinchart
2016-06-19 19:44 ` Maxime Ripard
2016-06-20 12:03 ` Philipp Zabel
2016-06-17 7:33 ` [PATCH 11/16] drm: Nuke SET_UNIQUE ioctl Daniel Vetter
2016-06-17 22:35 ` Emil Velikov
2016-06-17 7:33 ` [PATCH 12/16] drm: Lobotomize set_busid nonsense for !pci drivers Daniel Vetter
2016-06-20 14:27 ` Emil Velikov
2016-06-17 7:33 ` [PATCH 13/16] drm: Refactor drop/set master code a bit Daniel Vetter
2016-06-17 7:55 ` Chris Wilson
2016-06-17 23:00 ` Emil Velikov
2016-06-17 23:47 ` Emil Velikov
2016-06-20 21:07 ` Daniel Vetter
2016-06-17 7:33 ` [PATCH 14/16] drm: Extract drm_is_current_master Daniel Vetter
2016-06-17 7:57 ` Chris Wilson
2016-06-17 7:33 ` [PATCH 15/16] drm: Clear up master tracking booleans Daniel Vetter
2016-06-17 7:57 ` Chris Wilson
2016-06-17 23:25 ` Emil Velikov
2016-06-17 7:33 ` [PATCH 16/16] drm: document drm_auth.c Daniel Vetter
2016-06-17 7:59 ` Chris Wilson
2016-06-17 23:46 ` Emil Velikov
2016-06-20 21:17 ` Daniel Vetter
2016-06-20 22:36 ` Emil Velikov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160620125120.GB23520@phenom.ffwll.local \
--to=daniel@ffwll.ch \
--cc=chris@chris-wilson.co.uk \
--cc=daniel.vetter@ffwll.ch \
--cc=daniel.vetter@intel.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=intel-gfx@lists.freedesktop.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox