[BUG] BUG: kernel NULL pointer dereference at ttm_device_init+0xb4

[Steven Rostedt]

On Mon, 22 Jan 2024 18:06:05 -0500
Steven Rostedt <rostedt at goodmis.org> wrote:


>   qxl_ttm_init+0x34/0x130


> 
> int ttm_device_init(struct ttm_device *bdev, const struct ttm_device_funcs *funcs,
> 		    struct device *dev, struct address_space *mapping,
> 		    struct drm_vma_offset_manager *vma_manager,
> 		    bool use_dma_alloc, bool use_dma32)
> {
> 	struct ttm_global *glob = &ttm_glob;
> 	int ret;
> 
> 	if (WARN_ON(vma_manager == NULL))
> 		return -EINVAL;
> 
> 	ret = ttm_global_init();
> 	if (ret)
> 		return ret;
> 
> 	bdev->wq = alloc_workqueue("ttm",
> 				   WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_UNBOUND, 16);
> 	if (!bdev->wq) {
> 		ttm_global_release();
> 		return -ENOMEM;
> 	}
> 
> 	bdev->funcs = funcs;
> 
> 	ttm_sys_man_init(bdev);
> 
> 	ttm_pool_init(&bdev->pool, dev, dev_to_node(dev), use_dma_alloc, use_dma32); <<<------- BUG!
> 
> Specifically, it appears that dev is NULL and dev_to_node() doesn't like
> having a NULL pointer passed to it.
> 

Yeah, that qxl_ttm_init() has:

	/* No others user of address space so set it to 0 */
	r = ttm_device_init(&qdev->mman.bdev, &qxl_bo_driver, NULL,
			    qdev->ddev.anon_inode->i_mapping,
			    qdev->ddev.vma_offset_manager,
			    false, false);

Where that NULL is "dev"!

Thus that will never work here.

-- Steve