[PATCH] drm/amdgpu: fix NULL pointer dereference when run App with DRI_PRIME=1

[Christian König]

NAK, that probably just fixed the symptom but not the underlying problem.

Somebody is accessing the page array when it should never be accessed.

How did you manage to trigger this?

Regards,
Christian.

Am 25.05.2018 um 07:41 schrieb Junwei Zhang:
> [  632.679861] BUG: unable to handle kernel NULL pointer dereference at (null)
> [  632.679892] IP: drm_prime_sg_to_page_addr_arrays+0x52/0xb0 [drm]
> <snip>
> [  632.680011] Call Trace:
> [  632.680082]  amdgpu_ttm_tt_populate+0x3e/0xa0 [amdgpu]
> [  632.680092]  ttm_tt_populate.part.7+0x22/0x60 [amdttm]
> [  632.680098]  amdttm_tt_bind+0x52/0x60 [amdttm]
> [  632.680106]  ttm_bo_handle_move_mem+0x54b/0x5c0 [amdttm]
> [  632.680112]  ? find_next_bit+0xb/0x10
> [  632.680119]  amdttm_bo_validate+0x11d/0x130 [amdttm]
> [  632.680176]  amdgpu_cs_bo_validate+0x9d/0x150 [amdgpu]
> [  632.680232]  amdgpu_cs_validate+0x41/0x270 [amdgpu]
> [  632.680288]  amdgpu_cs_list_validate+0xc7/0x1a0 [amdgpu]
> [  632.680343]  amdgpu_cs_ioctl+0x1634/0x1c00 [amdgpu]
> [  632.680401]  ? amdgpu_cs_find_mapping+0x120/0x120 [amdgpu]
> [  632.680416]  drm_ioctl_kernel+0x6b/0xb0 [drm]
> [  632.680431]  drm_ioctl+0x3e4/0x450 [drm]
> [  632.680485]  ? amdgpu_cs_find_mapping+0x120/0x120 [amdgpu]
> [  632.680537]  amdgpu_drm_ioctl+0x4c/0x80 [amdgpu]
> [  632.680542]  do_vfs_ioctl+0xa4/0x600
> [  632.680546]  ? SyS_futex+0x7f/0x180
> [  632.680549]  SyS_ioctl+0x79/0x90
> [  632.680554]  entry_SYSCALL_64_fastpath+0x24/0xab
>
> Signed-off-by: Junwei Zhang <Jerry.Zhang at amd.com>
> ---
>   drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
> index 57d4da6..b293809 100644
> --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
> +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
> @@ -1212,7 +1212,7 @@ static struct ttm_tt *amdgpu_ttm_tt_create(struct ttm_buffer_object *bo,
>   	gtt->ttm.ttm.func = &amdgpu_backend_func;
>   
>   	/* allocate space for the uninitialized page entries */
> -	if (ttm_sg_tt_init(&gtt->ttm, bo, page_flags)) {
> +	if (ttm_dma_tt_init(&gtt->ttm, bo, page_flags)) {
>   		kfree(gtt);
>   		return NULL;
>   	}