Messages in this thread | | | From | Oleksandr Natalenko <> | Subject | Re: [REGRESSION] BUG: KFENCE: memory corruption in drm_gem_put_pages+0x186/0x250 | Date | Thu, 05 Oct 2023 15:34:41 +0200 |
| |
On čtvrtek 5. října 2023 15:05:27 CEST Matthew Wilcox wrote: > On Thu, Oct 05, 2023 at 02:30:55PM +0200, Oleksandr Natalenko wrote: > > No-no, sorry for possible confusion. Let me explain again: > > > > 1. we had an issue with i915, which was introduced by 0b62af28f249, and later was fixed by 863a8eb3f270 > > 2. now I've discovered another issue, which looks very similar to 1., but in a VM with Cirrus VGA, and it happens even while having 863a8eb3f270 applied > > 3. I've tried reverting 3291e09a4638, after which I cannot reproduce the issue with Cirrus VGA, but clearly there was no fix for it discussed > > > > IOW, 863a8eb3f270 is the fix for 0b62af28f249, but not for 3291e09a4638. It looks like 3291e09a4638 requires a separate fix. > > Thank you! Sorry about the misunderstanding. Try this: > > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c > index 6129b89bb366..44a948b80ee1 100644 > --- a/drivers/gpu/drm/drm_gem.c > +++ b/drivers/gpu/drm/drm_gem.c > @@ -540,7 +540,7 @@ struct page **drm_gem_get_pages(struct drm_gem_object *obj) > struct page **pages; > struct folio *folio; > struct folio_batch fbatch; > - int i, j, npages; > + long i, j, npages; > > if (WARN_ON(!obj->filp)) > return ERR_PTR(-EINVAL); > @@ -564,11 +564,13 @@ struct page **drm_gem_get_pages(struct drm_gem_object *obj) > > i = 0; > while (i < npages) { > + long nr; > folio = shmem_read_folio_gfp(mapping, i, > mapping_gfp_mask(mapping)); > if (IS_ERR(folio)) > goto fail; > - for (j = 0; j < folio_nr_pages(folio); j++, i++) > + nr = min(npages - i, folio_nr_pages(folio)); > + for (j = 0; j < nr; j++, i++) > pages[i] = folio_file_page(folio, i); > > /* Make sure shmem keeps __GFP_DMA32 allocated pages in the
No issues after five reboots with this patch applied on top of v6.5.5.
Reported-by: Oleksandr Natalenko <oleksandr@natalenko.name> Tested-by: Oleksandr Natalenko <oleksandr@natalenko.name> Link: https://lore.kernel.org/lkml/13360591.uLZWGnKmhe@natalenko.name/ Fixes: 3291e09a4638 ("drm: convert drm_gem_put_pages() to use a folio_batch") Cc: stable@vger.kernel.org # 6.5.x
Thank you!
-- Oleksandr Natalenko (post-factum)[unhandled content-type:application/pgp-signature] | |