<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - i965 miptree tiled_memcpy code uses MAP_RAW without error checks"
href="https://bugs.freedesktop.org/show_bug.cgi?id=110670">110670</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>i965 miptree tiled_memcpy code uses MAP_RAW without error checks
</td>
</tr>
<tr>
<th>Product</th>
<td>Mesa
</td>
</tr>
<tr>
<th>Version</th>
<td>git
</td>
</tr>
<tr>
<th>Hardware</th>
<td>All
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux (All)
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Component</th>
<td>Drivers/DRI/i965
</td>
</tr>
<tr>
<th>Assignee</th>
<td>intel-3d-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>anssi.hannula@bitwise.fi
</td>
</tr>
<tr>
<th>QA Contact</th>
<td>intel-3d-bugs@lists.freedesktop.org
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=144244" name="attach_144244" title="Simple workaround/hack to avoid tiled_memcpy without MMAP_WC">attachment 144244</a> <a href="attachment.cgi?id=144244&action=edit" title="Simple workaround/hack to avoid tiled_memcpy without MMAP_WC">[details]</a></span> <a href='page.cgi?id=splinter.html&bug=110670&attachment=144244'>[review]</a>
Simple workaround/hack to avoid tiled_memcpy without MMAP_WC
The i965 miptree tiled_memcpy mode, added in
54c823ec790427acbea31212a6ed30a17bd25ff0 ("i965/miptree: Use cpu
tiling/detiling when mapping"), calls intel_miptree_map_raw(,,MAP_RAW) from
intel_miptree_map_tiled_memcpy() and intel_miptree_unmap_tiled_memcpy(), and
does not check return value.
This causes invalid pointer dereferences if the call fails, causing a segfault.
In my case the call fails because pre-4.0 kernel versions do not support
I915_MMAP_WC so brw_bo_map_wc() fails (like in <a class="bz_bug_link
bz_status_NEW "
title="NEW - i965 miptree MCS aux_buf allocation failure with old kernels"
href="show_bug.cgi?id=110602">bug #110602</a>), but I guess there
may be a number of other failure cases where the mmap request may fail.
The code in intel_miptree_map() should select another mapping mode if
tiled_memcpy mode is not possible due to missing I915_MMAP_WC. Attached is a
quick workaround that avoids the mapping mode in my case.
There seem to be several other non-checked intel_miptree_map_raw() calls in
intel_mipmap_tree.c (and several checked ones), but they do not add MAP_RAW
flag so they did not fail for me. But maybe error checks should still be added
to those as well in case of other failure reasons?
This was observed on a ValleyView Gen7 (8086:0f31) with kernel 3.10.35 with the
attached small Qt program with Qt 5.11.2.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>