public inbox for stable@vger.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Tobias Klausmann <tobias.klausmann@freenet.de>,
	Dave Airlie <airlied@redhat.com>, Sasha Levin <sashal@kernel.org>,
	dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org
Subject: [PATCH AUTOSEL 5.11 39/44] nouveau: Skip unvailable ttm page entries
Date: Thu, 25 Mar 2021 07:24:54 -0400	[thread overview]
Message-ID: <20210325112459.1926846-39-sashal@kernel.org> (raw)
In-Reply-To: <20210325112459.1926846-1-sashal@kernel.org>

From: Tobias Klausmann <tobias.klausmann@freenet.de>

[ Upstream commit e94c55b8e0a0bbe9a026250cf31e2fa45957d776 ]

Starting with commit f295c8cfec833c2707ff1512da10d65386dde7af
("drm/nouveau: fix dma syncing warning with debugging on.")
the following oops occures:

   BUG: kernel NULL pointer dereference, address: 0000000000000000
   #PF: supervisor read access in kernel mode
   #PF: error_code(0x0000) - not-present page
   PGD 0 P4D 0
   Oops: 0000 [#1] PREEMPT SMP PTI
   CPU: 6 PID: 1013 Comm: Xorg.bin Tainted: G E     5.11.0-desktop-rc0+ #2
   Hardware name: Acer Aspire VN7-593G/Pluto_KLS, BIOS V1.11 08/01/2018
   RIP: 0010:nouveau_bo_sync_for_device+0x40/0xb0 [nouveau]
   Call Trace:
    nouveau_bo_validate+0x5d/0x80 [nouveau]
    nouveau_gem_ioctl_pushbuf+0x662/0x1120 [nouveau]
    ? nouveau_gem_ioctl_new+0xf0/0xf0 [nouveau]
    drm_ioctl_kernel+0xa6/0xf0 [drm]
    drm_ioctl+0x1f4/0x3a0 [drm]
    ? nouveau_gem_ioctl_new+0xf0/0xf0 [nouveau]
    nouveau_drm_ioctl+0x50/0xa0 [nouveau]
    __x64_sys_ioctl+0x7e/0xb0
    do_syscall_64+0x33/0x80
    entry_SYSCALL_64_after_hwframe+0x44/0xae
   ---[ end trace ccfb1e7f4064374f ]---
   RIP: 0010:nouveau_bo_sync_for_device+0x40/0xb0 [nouveau]

The underlying problem is not introduced by the commit, yet it uncovered the
underlying issue. The cited commit relies on valid pages. This is not given for
due to some bugs. For now, just warn and work around the issue by just ignoring
the bad ttm objects.
Below is some debug info gathered while debugging this issue:

nouveau 0000:01:00.0: DRM: ttm_dma->num_pages: 2048
nouveau 0000:01:00.0: DRM: ttm_dma->pages is NULL
nouveau 0000:01:00.0: DRM: ttm_dma: 00000000e96058e7
nouveau 0000:01:00.0: DRM: ttm_dma->page_flags:
nouveau 0000:01:00.0: DRM: ttm_dma:   Populated: 1
nouveau 0000:01:00.0: DRM: ttm_dma:   No Retry: 0
nouveau 0000:01:00.0: DRM: ttm_dma:   SG: 256
nouveau 0000:01:00.0: DRM: ttm_dma:   Zero Alloc: 0
nouveau 0000:01:00.0: DRM: ttm_dma:   Swapped: 0

Signed-off-by: Tobias Klausmann <tobias.klausmann@freenet.de>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210313222159.3346-1-tobias.klausmann@freenet.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/nouveau/nouveau_bo.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index f1c9a22083be..e05565f284dc 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -551,6 +551,10 @@ nouveau_bo_sync_for_device(struct nouveau_bo *nvbo)
 
 	if (!ttm_dma)
 		return;
+	if (!ttm_dma->pages) {
+		NV_DEBUG(drm, "ttm_dma 0x%p: pages NULL\n", ttm_dma);
+		return;
+	}
 
 	/* Don't waste time looping if the object is coherent */
 	if (nvbo->force_coherent)
@@ -583,6 +587,10 @@ nouveau_bo_sync_for_cpu(struct nouveau_bo *nvbo)
 
 	if (!ttm_dma)
 		return;
+	if (!ttm_dma->pages) {
+		NV_DEBUG(drm, "ttm_dma 0x%p: pages NULL\n", ttm_dma);
+		return;
+	}
 
 	/* Don't waste time looping if the object is coherent */
 	if (nvbo->force_coherent)
-- 
2.30.1


  parent reply	other threads:[~2021-03-25 11:27 UTC|newest]

Thread overview: 57+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-25 11:24 [PATCH AUTOSEL 5.11 01/44] virtiofs: Fail dax mount if device does not support it Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 02/44] ext4: shrink race window in ext4_should_retry_alloc() Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 03/44] ext4: add reclaim checks to xattr code Sasha Levin
2021-03-25 14:30   ` Jan Kara
2021-03-30 21:14     ` Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 04/44] fs/ext4: fix integer overflow in s_log_groups_per_flex Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 05/44] ext4: fix bh ref count on error paths Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 06/44] fs: nfsd: fix kconfig dependency warning for NFSD_V4 Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 07/44] rpc: fix NULL dereference on kmalloc failure Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 08/44] iomap: Fix negative assignment to unsigned sis->pages in iomap_swapfile_activate Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 09/44] ASoC: rt1015: fix i2c communication error Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 10/44] ASoC: rt5640: Fix dac- and adc- vol-tlv values being off by a factor of 10 Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 11/44] ASoC: rt5651: " Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 12/44] ASoC: sgtl5000: set DAP_AVC_CTRL register to correct default value on probe Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 13/44] ASoC: es8316: Simplify adc_pga_gain_tlv table Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 14/44] ASoC: soc-core: Prevent warning if no DMI table is present Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 15/44] ASoC: cs42l42: Fix Bitclock polarity inversion Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 16/44] ASoC: cs42l42: Fix channel width support Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 17/44] ASoC: cs42l42: Fix mixer volume control Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 18/44] ASoC: cs42l42: Always wait at least 3ms after reset Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 19/44] NFSD: fix error handling in NFSv4.0 callbacks Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 20/44] ASoC: mediatek: mt8192: fix tdm out data is valid on rising edge Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 21/44] kernel: freezer should treat PF_IO_WORKER like PF_KTHREAD for freezing Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 22/44] powerpc: Force inlining of cpu_has_feature() to avoid build failure Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 23/44] vhost: Fix vhost_vq_reset() Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 24/44] io_uring: fix ->flags races by linked timeouts Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 25/44] io_uring: halt SQO submission on ctx exit Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 26/44] btrfs: track qgroup released data in own variable in insert_prealloc_file_extent Sasha Levin
2021-03-25 12:08   ` David Sterba
2021-03-30 21:15     ` Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 27/44] scsi: st: Fix a use after free in st_open() Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 28/44] scsi: qla2xxx: Fix broken #endif placement Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 29/44] staging: comedi: cb_pcidas: fix request_irq() warn Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 30/44] staging: comedi: cb_pcidas64: " Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 31/44] ASoC: rt5659: Update MCLK rate in set_sysclk() Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 32/44] ASoC: rt711: add snd_soc_component remove callback Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 33/44] thermal/core: Add NULL pointer check before using cooling device stats Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 34/44] locking/ww_mutex: Simplify use_ww_ctx & ww_ctx handling Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 35/44] locking/ww_mutex: Fix acquire/release imbalance in ww_acquire_init()/ww_acquire_fini() Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 36/44] nvmet-tcp: fix kmap leak when data digest in use Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 37/44] io_uring: imply MSG_NOSIGNAL for send[msg]()/recv[msg]() calls Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 38/44] Revert "PM: ACPI: reboot: Use S5 for reboot" Sasha Levin
2021-03-25 11:24 ` Sasha Levin [this message]
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 40/44] static_call: Align static_call_is_init() patching condition Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 41/44] ext4: do not iput inode under running transaction in ext4_rename() Sasha Levin
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 42/44] signal: don't allow sending any signals to PF_IO_WORKER threads Sasha Levin
2021-03-25 11:32   ` Stefan Metzmacher
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 43/44] signal: don't allow STOP on " Sasha Levin
2021-03-25 11:34   ` Stefan Metzmacher
2021-03-25 12:04     ` Eric W. Biederman
2021-03-25 12:11       ` Stefan Metzmacher
2021-03-25 13:38         ` Jens Axboe
2021-03-25 13:56           ` Stefan Metzmacher
2021-03-25 14:02             ` Jens Axboe
2021-03-25 15:00               ` Sasha Levin
2021-03-25 15:10               ` Jens Axboe
2021-03-25 11:24 ` [PATCH AUTOSEL 5.11 44/44] io_uring: call req_set_fail_links() on short send[msg]()/recv[msg]() with MSG_WAITALL Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210325112459.1926846-39-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=airlied@redhat.com \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=nouveau@lists.freedesktop.org \
    --cc=stable@vger.kernel.org \
    --cc=tobias.klausmann@freenet.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox