From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755670AbbCCJLx (ORCPT ); Tue, 3 Mar 2015 04:11:53 -0500 Received: from pegasos-out.vodafone.de ([80.84.1.38]:33191 "EHLO pegasos-out.vodafone.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751535AbbCCJLs (ORCPT ); Tue, 3 Mar 2015 04:11:48 -0500 X-Spam-Flag: NO X-Spam-Score: -0.053 Authentication-Results: rohrpostix2.prod.vfnet.de (amavisd-new); dkim=pass header.i=@vodafone.de X-DKIM: OpenDKIM Filter v2.6.8 pegasos-out.vodafone.de 021AF690223 Message-ID: <54F57A97.9040204@vodafone.de> Date: Tue, 03 Mar 2015 10:10:47 +0100 From: =?UTF-8?B?Q2hyaXN0aWFuIEvDtm5pZw==?= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.4.0 MIME-Version: 1.0 To: Tommi Rantala , Alex Deucher , =?UTF-8?B?Q2hyaXN0aWFuIEvDtm5pZw==?= , David Airlie CC: linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org Subject: Re: [PATCH] drm/radeon: fix DRM_IOCTL_RADEON_CS oops References: <1425324967-7427-1-git-send-email-tt.rantala@gmail.com> In-Reply-To: <1425324967-7427-1-git-send-email-tt.rantala@gmail.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Good catch. Patch is Reviewed-by: Christian König Regards, Christian. On 02.03.2015 20:36, Tommi Rantala wrote: > Passing zeroed drm_radeon_cs struct to DRM_IOCTL_RADEON_CS produces the > following oops. > > Fix by always calling INIT_LIST_HEAD() to avoid the crash in list_sort(). > > ---------------------------------- > > #include > #include > #include > #include > #include > > static const struct drm_radeon_cs cs; > > int main(int argc, char **argv) > { > return ioctl(open(argv[1], O_RDWR), DRM_IOCTL_RADEON_CS, &cs); > } > > ---------------------------------- > > [ttrantal@test2 ~]$ ./main /dev/dri/card0 > [ 46.904650] BUG: unable to handle kernel NULL pointer dereference at (null) > [ 46.905022] IP: [] list_sort+0x42/0x240 > [ 46.905022] PGD 68f29067 PUD 688b5067 PMD 0 > [ 46.905022] Oops: 0002 [#1] SMP > [ 46.905022] CPU: 0 PID: 2413 Comm: main Not tainted 4.0.0-rc1+ #58 > [ 46.905022] Hardware name: Hewlett-Packard HP Compaq dc5750 Small Form Factor/0A64h, BIOS 786E3 v02.10 01/25/2007 > [ 46.905022] task: ffff880058e2bcc0 ti: ffff880058e64000 task.ti: ffff880058e64000 > [ 46.905022] RIP: 0010:[] [] list_sort+0x42/0x240 > [ 46.905022] RSP: 0018:ffff880058e67998 EFLAGS: 00010246 > [ 46.905022] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 > [ 46.905022] RDX: ffffffff81644410 RSI: ffff880058e67b40 RDI: ffff880058e67a58 > [ 46.905022] RBP: ffff880058e67a88 R08: 0000000000000000 R09: 0000000000000000 > [ 46.905022] R10: ffff880058e2bcc0 R11: ffffffff828e6ca0 R12: ffffffff81644410 > [ 46.905022] R13: ffff8800694b8018 R14: 0000000000000000 R15: ffff880058e679b0 > [ 46.905022] FS: 00007fdc65a65700(0000) GS:ffff88006d600000(0000) knlGS:0000000000000000 > [ 46.905022] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 46.905022] CR2: 0000000000000000 CR3: 0000000058dd9000 CR4: 00000000000006f0 > [ 46.905022] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > [ 46.905022] DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400 > [ 46.905022] Stack: > [ 46.905022] ffff880058e67b40 ffff880058e2bcc0 ffff880058e67a78 0000000000000000 > [ 46.905022] 0000000000000000 0000000000000000 0000000000000000 0000000000000000 > [ 46.905022] 0000000000000000 0000000000000000 0000000000000000 0000000000000000 > [ 46.905022] Call Trace: > [ 46.905022] [] radeon_cs_parser_fini+0x195/0x220 > [ 46.905022] [] radeon_cs_ioctl+0xa9/0x960 > [ 46.905022] [] drm_ioctl+0x19c/0x640 > [ 46.905022] [] ? trace_hardirqs_on_caller+0xfd/0x1c0 > [ 46.905022] [] ? trace_hardirqs_on+0xd/0x10 > [ 46.905022] [] radeon_drm_ioctl+0x46/0x80 > [ 46.905022] [] do_vfs_ioctl+0x318/0x570 > [ 46.905022] [] ? selinux_file_ioctl+0x56/0x110 > [ 46.905022] [] SyS_ioctl+0x81/0xa0 > [ 46.905022] [] system_call_fastpath+0x12/0x17 > [ 46.905022] Code: 48 89 b5 10 ff ff ff 0f 84 03 01 00 00 4c 8d bd 28 ff ff > ff 31 c0 48 89 fb b9 15 00 00 00 49 89 d4 4c 89 ff f3 48 ab 48 8b 46 08 <48> c7 > 00 00 00 00 00 48 8b 0e 48 85 c9 0f 84 7d 00 00 00 c7 85 > [ 46.905022] RIP [] list_sort+0x42/0x240 > [ 46.905022] RSP > [ 46.905022] CR2: 0000000000000000 > [ 47.149253] ---[ end trace 09576b4e8b2c20b8 ]--- > > Signed-off-by: Tommi Rantala > --- > drivers/gpu/drm/radeon/radeon_cs.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c > index a579ed3..4d0f96c 100644 > --- a/drivers/gpu/drm/radeon/radeon_cs.c > +++ b/drivers/gpu/drm/radeon/radeon_cs.c > @@ -256,11 +256,13 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data) > u32 ring = RADEON_CS_RING_GFX; > s32 priority = 0; > > + INIT_LIST_HEAD(&p->validated); > + > if (!cs->num_chunks) { > return 0; > } > + > /* get chunks */ > - INIT_LIST_HEAD(&p->validated); > p->idx = 0; > p->ib.sa_bo = NULL; > p->const_ib.sa_bo = NULL;