From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, "Philip Yang" <Philip.Yang@amd.com>,
"Christian König" <christian.koenig@amd.com>,
"Alex Deucher" <alexander.deucher@amd.com>,
"Linux Regressions" <regressions@lists.linux.dev>,
"Mario Limonciello" <mario.limonciello@amd.com>
Subject: [PATCH 5.15 05/15] drm/amdgpu: Set vmbo destroy after pt bo is created
Date: Mon, 3 Jul 2023 20:54:50 +0200 [thread overview]
Message-ID: <20230703184519.043464257@linuxfoundation.org> (raw)
In-Reply-To: <20230703184518.896751186@linuxfoundation.org>
From: Philip Yang <Philip.Yang@amd.com>
commit 9a3c6067bd2ee2ca2652fbb0679f422f3c9109f9 upstream.
Under VRAM usage pression, map to GPU may fail to create pt bo and
vmbo->shadow_list is not initialized, then ttm_bo_release calling
amdgpu_bo_vm_destroy to access vmbo->shadow_list generates below
dmesg and NULL pointer access backtrace:
Set vmbo destroy callback to amdgpu_bo_vm_destroy only after creating pt
bo successfully, otherwise use default callback amdgpu_bo_destroy.
amdgpu: amdgpu_vm_bo_update failed
amdgpu: update_gpuvm_pte() failed
amdgpu: Failed to map bo to gpuvm
amdgpu 0000:43:00.0: amdgpu: Failed to map peer:0000:43:00.0 mem_domain:2
BUG: kernel NULL pointer dereference, address:
RIP: 0010:amdgpu_bo_vm_destroy+0x4d/0x80 [amdgpu]
Call Trace:
<TASK>
ttm_bo_release+0x207/0x320 [amdttm]
amdttm_bo_init_reserved+0x1d6/0x210 [amdttm]
amdgpu_bo_create+0x1ba/0x520 [amdgpu]
amdgpu_bo_create_vm+0x3a/0x80 [amdgpu]
amdgpu_vm_pt_create+0xde/0x270 [amdgpu]
amdgpu_vm_ptes_update+0x63b/0x710 [amdgpu]
amdgpu_vm_update_range+0x2e7/0x6e0 [amdgpu]
amdgpu_vm_bo_update+0x2bd/0x600 [amdgpu]
update_gpuvm_pte+0x160/0x420 [amdgpu]
amdgpu_amdkfd_gpuvm_map_memory_to_gpu+0x313/0x1130 [amdgpu]
kfd_ioctl_map_memory_to_gpu+0x115/0x390 [amdgpu]
kfd_ioctl+0x24a/0x5b0 [amdgpu]
Signed-off-by: Philip Yang <Philip.Yang@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
[ This fixes a regression introduced by commit 1cc40dccad76 ("drm/amdgpu:
fix Null pointer dereference error in amdgpu_device_recover_vram") in
5.15.118. It's a hand modified cherry-pick because that commit that
introduced the regression touched nearby code and the context is now
incorrect. ]
Cc: Linux Regressions <regressions@lists.linux.dev>
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2650
Fixes: 1cc40dccad76 ("drm/amdgpu: fix Null pointer dereference error in amdgpu_device_recover_vram")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -685,7 +685,6 @@ int amdgpu_bo_create_vm(struct amdgpu_de
* num of amdgpu_vm_pt entries.
*/
BUG_ON(bp->bo_ptr_size < sizeof(struct amdgpu_bo_vm));
- bp->destroy = &amdgpu_bo_vm_destroy;
r = amdgpu_bo_create(adev, bp, &bo_ptr);
if (r)
return r;
next prev parent reply other threads:[~2023-07-03 18:57 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-03 18:54 [PATCH 5.15 00/15] 5.15.120-rc1 review Greg Kroah-Hartman
2023-07-03 18:54 ` [PATCH 5.15 01/15] mptcp: fix possible divide by zero in recvmsg() Greg Kroah-Hartman
2023-07-03 18:54 ` [PATCH 5.15 02/15] mptcp: consolidate fallback and non fallback state machine Greg Kroah-Hartman
2023-07-03 18:54 ` [PATCH 5.15 03/15] mm, hwpoison: try to recover from copy-on write faults Greg Kroah-Hartman
2023-07-03 18:54 ` [PATCH 5.15 04/15] mm, hwpoison: when copy-on-write hits poison, take page offline Greg Kroah-Hartman
2023-07-03 18:54 ` Greg Kroah-Hartman [this message]
2023-07-03 18:54 ` [PATCH 5.15 06/15] x86/microcode/AMD: Load late on both threads too Greg Kroah-Hartman
2023-07-03 18:54 ` [PATCH 5.15 07/15] x86/smp: Use dedicated cache-line for mwait_play_dead() Greg Kroah-Hartman
2023-07-03 18:54 ` [PATCH 5.15 08/15] can: isotp: isotp_sendmsg(): fix return error fix on TX path Greg Kroah-Hartman
2023-07-03 18:54 ` [PATCH 5.15 09/15] bpf: ensure main program has an extable Greg Kroah-Hartman
2023-07-03 18:54 ` [PATCH 5.15 10/15] HID: wacom: Use ktime_t rather than int when dealing with timestamps Greg Kroah-Hartman
2023-07-03 18:54 ` [PATCH 5.15 11/15] HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651 Greg Kroah-Hartman
2023-07-03 18:54 ` [PATCH 5.15 12/15] Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe" Greg Kroah-Hartman
2023-07-03 18:54 ` [PATCH 5.15 13/15] perf symbols: Symbol lookup with kcore can fail if multiple segments match stext Greg Kroah-Hartman
2023-07-03 18:54 ` [PATCH 5.15 14/15] scripts/tags.sh: Resolve gtags empty index generation Greg Kroah-Hartman
2023-07-03 18:55 ` [PATCH 5.15 15/15] drm/amdgpu: Validate VM ioctl flags Greg Kroah-Hartman
2023-07-04 7:00 ` [PATCH 5.15 00/15] 5.15.120-rc1 review Naresh Kamboju
2023-07-04 7:16 ` Helge Deller
2023-07-04 7:31 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230703184519.043464257@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=Philip.Yang@amd.com \
--cc=alexander.deucher@amd.com \
--cc=christian.koenig@amd.com \
--cc=mario.limonciello@amd.com \
--cc=patches@lists.linux.dev \
--cc=regressions@lists.linux.dev \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox