Messages in this thread Patch in this message | | | From | Vince Weaver <> | Date | Fri, 13 Dec 2019 14:53:48 -0500 (EST) | Subject | Re: [perf] perf_fuzzer triggers NULL pointer derefernce in i915 driver |
| |
On Fri, 13 Dec 2019, Dave Hansen wrote:
> On 12/12/19 11:09 PM, Jani Nikula wrote: > > On Thu, 12 Dec 2019, Vince Weaver <vincent.weaver@maine.edu> wrote: > >> with current git the perf_fuzzer was able to trigger this NULL pointer > >> de-reference in the i915 driver. > > Please file a bug. > > > > https://gitlab.freedesktop.org/drm/intel/wikis/How-to-file-i915-bugs > > I'm seeing the same thing. It's annoyingly and immediately reproducible > for me: > > https://gitlab.freedesktop.org/drm/intel/issues/826 > > Let me know if you want anything fancier done like a bisect. Looking > back through my kernel logs, it appears to also have happened with > 5.4.0-rc4.
This patch was sent out in response to my report (but not as a direct reply).
>From chris@chris-wilson.co.uk Thu Dec 12 10:42:36 2019 >Date: Thu, 12 Dec 2019 15:42:24 +0000 >From: Chris Wilson <chris@chris-wilson.co.uk> >To: intel-gfx@lists.freedesktop.org >Cc: Chris Wilson <chris@chris-wilson.co.uk>, Vince Weaver <vincent.weaver@maine.edu>, Matthew Auld <matthew.auld@intel.com> >Subject: [PATCH] drm/i915: Set fence_work.ops before dma_fence_init
Since dma_fence_init may call ops (because of a meaningless trace_dma_fence), we need to set the worker ops prior to that call.
Reported-by: Vince Weaver <vincent.weaver@maine.edu> Fixes: 8e458fe2ee05 ("drm/i915: Generalise the clflush dma-worker") Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Matthew Auld <matthew.auld@intel.com> Cc: Vince Weaver <vincent.weaver@maine.edu> --- drivers/gpu/drm/i915/i915_sw_fence_work.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/i915_sw_fence_work.c b/drivers/gpu/drm/i915/i915_sw_fence_work.c index 07552cd544f2..8538ee7a521d 100644 --- a/drivers/gpu/drm/i915/i915_sw_fence_work.c +++ b/drivers/gpu/drm/i915/i915_sw_fence_work.c @@ -78,12 +78,11 @@ static const struct dma_fence_ops fence_ops = { void dma_fence_work_init(struct dma_fence_work *f, const struct dma_fence_work_ops *ops) { + f->ops = ops; spin_lock_init(&f->lock); dma_fence_init(&f->dma, &fence_ops, &f->lock, 0, 0); i915_sw_fence_init(&f->chain, fence_notify); INIT_WORK(&f->work, fence_work); - - f->ops = ops; } int dma_fence_work_chain(struct dma_fence_work *f, struct dma_fence *signal) -- 2.24.0
| |