[PATCH] drm/shmem-helper: Fix obj->filp derefence
Thomas Zimmermann
tzimmermann at suse.de
Tue Jun 16 11:24:28 UTC 2020
Hi Daniel
Am 15.06.20 um 17:10 schrieb Daniel Vetter:
> I broke that in my refactoring:
>
> commit 7d2cd72a9aa3df3604cafd169a2d4a525afb68ca
> Author: Daniel Vetter <daniel.vetter at ffwll.ch>
> Date: Fri May 29 16:05:42 2020 +0200
>
> drm/shmem-helpers: Simplify dma-buf importing
>
> Reported-by: Thomas Zimmermann <tzimmermann at suse.de>
> Fixes: 7d2cd72a9aa3 ("drm/shmem-helpers: Simplify dma-buf importing")
> Cc: Boris Brezillon <boris.brezillon at collabora.com>
> Cc: Thomas Zimmermann <tzimmermann at suse.de>
> Cc: Gerd Hoffmann <kraxel at redhat.com>
> Cc: Rob Herring <robh at kernel.org>
> Cc: Noralf Trønnes <noralf at tronnes.org>
> Signed-off-by: Daniel Vetter <daniel.vetter at intel.com>
> ---
> drivers/gpu/drm/drm_gem_shmem_helper.c | 20 +++++++++++---------
> 1 file changed, 11 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c
> index 0a7e3b664bc2..3e7ee407a17c 100644
> --- a/drivers/gpu/drm/drm_gem_shmem_helper.c
> +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
> @@ -70,15 +70,17 @@ __drm_gem_shmem_create(struct drm_device *dev, size_t size, bool private)
> mutex_init(&shmem->vmap_lock);
> INIT_LIST_HEAD(&shmem->madv_list);
>
> - /*
> - * Our buffers are kept pinned, so allocating them
> - * from the MOVABLE zone is a really bad idea, and
> - * conflicts with CMA. See comments above new_inode()
> - * why this is required _and_ expected if you're
> - * going to pin these pages.
> - */
> - mapping_set_gfp_mask(obj->filp->f_mapping, GFP_HIGHUSER |
> - __GFP_RETRY_MAYFAIL | __GFP_NOWARN);
> + if (!private) {
> + /*
> + * Our buffers are kept pinned, so allocating them
> + * from the MOVABLE zone is a really bad idea, and
> + * conflicts with CMA. See comments above new_inode()
> + * why this is required _and_ expected if you're
> + * going to pin these pages.
> + */
> + mapping_set_gfp_mask(obj->filp->f_mapping, GFP_HIGHUSER |
> + __GFP_RETRY_MAYFAIL | __GFP_NOWARN);
> + }
This bug is gone, but now I see
[ 5.577857] ------------[ cut here ]------------
[ 5.577881] WARNING: CPU: 0 PID: 1 at drivers/gpu/drm/drm_gem.c:564
drm_gem_get_pages+0x190/0x1b0
[ 5.577883] Modules linked in:
[ 5.577891] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.7.0-1-pae+ #40
[ 5.577893] Hardware name: MSI MS-6380
/MS-6380 , BIOS 07.00T
[ 5.577897] EIP: drm_gem_get_pages+0x190/0x1b0
[ 5.577904] Code: b7 ff 8d 45 b0 e8 30 63 b7 ff e8 6b d8 38 00 eb 9d
8d b4 26 00 00 00 00 66 90 89 fb eb 97 8d 74 26 00 bb f4 ff ff ff eb 8c
90 <0f> 0b bb ea ff ff ff eb 82 8d b4 26 00 00 00 00 0f 0b e9 95 fe ff
[ 5.577907] EAX: f24c0c00 EBX: f24c0c00 ECX: f3ae1900 EDX: 00000000
[ 5.577909] ESI: 00000000 EDI: 00000000 EBP: f3941b50 ESP: f3941afc
[ 5.577912] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00010246
[ 5.577915] CR0: 80050033 CR2: b7f5c784 CR3: 1b6b8000 CR4: 000006f0
[ 5.577918] Call Trace:
[ 5.577938] ? _cond_resched+0x18/0x50
[ 5.577950] drm_gem_shmem_get_pages+0x52/0xa0
[ 5.577955] drm_gem_shmem_vmap+0xa1/0x160
[ 5.577963] skms_simple_display_pipe_update+0x68/0xb0
[ 5.577973] drm_simple_kms_plane_atomic_update+0x23/0x30
[ 5.577976] drm_atomic_helper_commit_planes+0xba/0x220
[ 5.577981] drm_atomic_helper_commit_tail+0x33/0x70
[ 5.577984] commit_tail+0xe7/0x120
[ 5.577988] drm_atomic_helper_commit+0x107/0x130
[ 5.577991] ? drm_atomic_helper_setup_commit+0x5a0/0x5a0
[ 5.577995] drm_atomic_commit+0x3a/0x50
[ 5.577999] drm_client_modeset_commit_atomic+0x1ae/0x1e0
[ 5.578004] drm_client_modeset_commit_locked+0x48/0x80
[ 5.578008] drm_client_modeset_commit+0x20/0x40
[ 5.578012] drm_fb_helper_restore_fbdev_mode_unlocked+0x44/0x90
[ 5.578015] drm_fb_helper_set_par+0x2e/0x40
[ 5.578025] fbcon_init+0x285/0x590
[ 5.578035] visual_init+0xb9/0x120
[ 5.578040] do_bind_con_driver.isra.0+0x18a/0x280
[ 5.578045] do_take_over_console+0x2c/0x40
[ 5.578049] do_fbcon_takeover+0x5f/0xd0
[ 5.578053] fbcon_fb_registered+0xb7/0xe0
[ 5.578057] do_register_framebuffer+0x1ae/0x2e0
[ 5.578062] register_framebuffer+0x1c/0x30
[ 5.578065] __drm_fb_helper_initial_config_and_unlock+0x96/0xd0
[ 5.578069] drm_fbdev_client_hotplug+0x136/0x220
[ 5.578072] drm_fbdev_generic_setup+0x9f/0x14a
[ 5.578076] ? skms_device_create.constprop.0+0x9f/0xb0
[ 5.578079] skms_probe+0x1b/0x20
[ 5.578083] platform_drv_probe+0x47/0x90
[ 5.578092] really_probe+0x2a9/0x3f0
[ 5.578096] driver_probe_device+0xa9/0xf0
[ 5.578100] ? _cond_resched+0x18/0x50
[ 5.578103] device_driver_attach+0x99/0xa0
[ 5.578107] __driver_attach+0x79/0x130
[ 5.578111] ? device_driver_attach+0xa0/0xa0
[ 5.578114] bus_for_each_dev+0x5b/0xa0
[ 5.578118] driver_attach+0x19/0x20
[ 5.578122] ? device_driver_attach+0xa0/0xa0
[ 5.578125] bus_add_driver+0x10d/0x1e0
[ 5.578130] driver_register+0x79/0xd0
[ 5.578137] ? mipi_dsi_bus_init+0x14/0x14
[ 5.578140] __platform_driver_register+0x2f/0x40
[ 5.578143] skms_platform_driver_init+0x14/0x16
[ 5.578150] do_one_initcall+0x42/0x1e0
[ 5.578158] ? rdinit_setup+0x2a/0x2a
[ 5.578161] ? rdinit_setup+0x2a/0x2a
[ 5.578166] do_initcalls+0xae/0xd1
[ 5.578170] kernel_init_freeable+0x108/0x14f
[ 5.578181] ? rest_init+0x9b/0x9b
[ 5.578185] kernel_init+0xd/0xe5
[ 5.578193] ret_from_fork+0x2e/0x38
[ 5.578201] ---[ end trace d857253095ede2e3 ]---
[ 5.578221] BUG: unable to handle page fault for address: ffffffea
[ 5.578223] #PF: supervisor read access in kernel mode
[ 5.578225] #PF: error_code(0x0000) - not-present page
[ 5.578227] *pdpt = 000000001b6b4001 *pde = 000000001bc91067 *pte =
0000000000000000
[ 5.578233] Oops: 0000 [#1] SMP NOPTI
[ 5.578237] CPU: 0 PID: 1 Comm: swapper/0 Tainted: G W
5.7.0-1-pae+ #40
[ 5.578239] Hardware name: MSI MS-6380
/MS-6380 , BIOS 07.00T
[ 5.578249] EIP: memcpy_toio+0x2b/0x60
[ 5.578252] Code: 8d 44 20 00 85 c9 74 47 55 89 e5 57 89 c7 56 89 d6
53 89 cb a8 01 75 3f 83 fb 01 76 08 f7 c7 02 00 00 00 75 1a 89 d9 c1 e9
02 <f3> a5 f6 c3 02 74 02 66 a5 f6 c3 01 74 01 a4 5b 5e 5f 5d c3 90 66
[ 5.578255] EAX: f7200000 EBX: 00001400 ECX: 00000500 EDX: ffffffea
[ 5.578257] ESI: ffffffea EDI: f7200000 EBP: f3941b3c ESP: f3941b30
[ 5.578260] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 EFLAGS: 00010216
[ 5.578262] CR0: 80050033 CR2: ffffffea CR3: 1b6b8000 CR4: 000006f0
[ 5.578263] Call Trace:
[ 5.578271] drm_fb_memcpy_dstclip+0x6f/0x90
[ 5.578276] drm_fb_blit_rect_dstclip+0x8d/0xc0
[ 5.578280] skms_simple_display_pipe_update+0x8d/0xb0
[ 5.578285] drm_simple_kms_plane_atomic_update+0x23/0x30
[ 5.578288] drm_atomic_helper_commit_planes+0xba/0x220
[ 5.578292] drm_atomic_helper_commit_tail+0x33/0x70
[ 5.578295] commit_tail+0xe7/0x120
[ 5.578299] drm_atomic_helper_commit+0x107/0x130
[ 5.578303] ? drm_atomic_helper_setup_commit+0x5a0/0x5a0
[ 5.578306] drm_atomic_commit+0x3a/0x50
[ 5.578310] drm_client_modeset_commit_atomic+0x1ae/0x1e0
[ 5.578315] drm_client_modeset_commit_locked+0x48/0x80
[ 5.578318] drm_client_modeset_commit+0x20/0x40
[ 5.578322] drm_fb_helper_restore_fbdev_mode_unlocked+0x44/0x90
[ 5.578325] drm_fb_helper_set_par+0x2e/0x40
[ 5.578329] fbcon_init+0x285/0x590
[ 5.578333] visual_init+0xb9/0x120
[ 5.578338] do_bind_con_driver.isra.0+0x18a/0x280
[ 5.578342] do_take_over_console+0x2c/0x40
[ 5.578346] do_fbcon_takeover+0x5f/0xd0
[ 5.578350] fbcon_fb_registered+0xb7/0xe0
[ 5.578353] do_register_framebuffer+0x1ae/0x2e0
[ 5.578358] register_framebuffer+0x1c/0x30
[ 5.578361] __drm_fb_helper_initial_config_and_unlock+0x96/0xd0
[ 5.578364] drm_fbdev_client_hotplug+0x136/0x220
[ 5.578368] drm_fbdev_generic_setup+0x9f/0x14a
[ 5.578371] ? skms_device_create.constprop.0+0x9f/0xb0
[ 5.578374] skms_probe+0x1b/0x20
[ 5.578377] platform_drv_probe+0x47/0x90
[ 5.578381] really_probe+0x2a9/0x3f0
[ 5.578385] driver_probe_device+0xa9/0xf0
[ 5.578388] ? _cond_resched+0x18/0x50
[ 5.578392] device_driver_attach+0x99/0xa0
[ 5.578396] __driver_attach+0x79/0x130
[ 5.578400] ? device_driver_attach+0xa0/0xa0
[ 5.578403] bus_for_each_dev+0x5b/0xa0
[ 5.578407] driver_attach+0x19/0x20
[ 5.578411] ? device_driver_attach+0xa0/0xa0
[ 5.578414] bus_add_driver+0x10d/0x1e0
[ 5.578418] driver_register+0x79/0xd0
[ 5.578421] ? mipi_dsi_bus_init+0x14/0x14
[ 5.578424] __platform_driver_register+0x2f/0x40
[ 5.578428] skms_platform_driver_init+0x14/0x16
[ 5.578431] do_one_initcall+0x42/0x1e0
[ 5.578434] ? rdinit_setup+0x2a/0x2a
[ 5.578437] ? rdinit_setup+0x2a/0x2a
[ 5.578441] do_initcalls+0xae/0xd1
[ 5.578445] kernel_init_freeable+0x108/0x14f
[ 5.578449] ? rest_init+0x9b/0x9b
[ 5.578453] kernel_init+0xd/0xe5
[ 5.578457] ret_from_fork+0x2e/0x38
[ 5.578459] Modules linked in:
[ 5.578463] CR2: 00000000ffffffea
[ 5.578472] ---[ end trace d857253095ede2e4 ]---
because drm_gem_get_pages() needs obj->filp.
All this happens for dumb buffers. Why is a dumb buffer set up with
(private == true) ? It has an associated file.
Best regards
Thomas
>
> return shmem;
>
>
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg)
Geschäftsführer: Felix Imendörffer
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 488 bytes
Desc: OpenPGP digital signature
URL: <https://lists.freedesktop.org/archives/dri-devel/attachments/20200616/eff425c9/attachment.sig>
More information about the dri-devel
mailing list