<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><span class="vcard"><a class="email" href="mailto:chris@chris-wilson.co.uk" title="Chris Wilson <chris@chris-wilson.co.uk>"> <span class="fn">Chris Wilson</span></a>
</span> changed
<a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - [CI][DRMTIP] igt@sw_sync@sync_multi_producer_single_consumer - incomplete - BUG: kernel NULL pointer dereference, address: 0000000000000000"
href="https://bugs.freedesktop.org/show_bug.cgi?id=111381">bug 111381</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">Status</td>
<td>NEW
</td>
<td>RESOLVED
</td>
</tr>
<tr>
<td style="text-align:right;">Resolution</td>
<td>---
</td>
<td>FIXED
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - [CI][DRMTIP] igt@sw_sync@sync_multi_producer_single_consumer - incomplete - BUG: kernel NULL pointer dereference, address: 0000000000000000"
href="https://bugs.freedesktop.org/show_bug.cgi?id=111381#c4">Comment # 4</a>
on <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - [CI][DRMTIP] igt@sw_sync@sync_multi_producer_single_consumer - incomplete - BUG: kernel NULL pointer dereference, address: 0000000000000000"
href="https://bugs.freedesktop.org/show_bug.cgi?id=111381">bug 111381</a>
from <span class="vcard"><a class="email" href="mailto:chris@chris-wilson.co.uk" title="Chris Wilson <chris@chris-wilson.co.uk>"> <span class="fn">Chris Wilson</span></a>
</span></b>
<pre>commit d3c6dd1fb30d3853c2012549affe75c930f4a2f9 (HEAD -> drm-misc-next,
drm-misc/for-linux-next, drm-misc/drm-misc-next)
Author: Chris Wilson <<a href="mailto:chris@chris-wilson.co.uk">chris@chris-wilson.co.uk</a>>
Date: Mon Aug 12 16:42:47 2019 +0100
dma-buf/sw_sync: Synchronize signal vs syncpt free
During release of the syncpt, we remove it from the list of syncpt and
the tree, but only if it is not already been removed. However, during
signaling, we first remove the syncpt from the list. So, if we
concurrently free and signal the syncpt, the free may decide that it is
not part of the tree and immediately free itself -- meanwhile the
signaler goes on to use the now freed datastructure.
In particular, we get struck by commit 0e2f733addbf ("dma-buf: make
dma_fence structure a bit smaller v2") as the cb_list is immediately
clobbered by the kfree_rcu.
v2: Avoid calling into timeline_fence_release() from under the spinlock
Bugzilla: <a class="bz_bug_link
bz_status_RESOLVED bz_closed"
title="RESOLVED FIXED - [CI][DRMTIP] igt@sw_sync@sync_multi_producer_single_consumer - incomplete - BUG: kernel NULL pointer dereference, address: 0000000000000000"
href="show_bug.cgi?id=111381">https://bugs.freedesktop.org/show_bug.cgi?id=111381</a>
Fixes: d3862e44daa7 ("dma-buf/sw-sync: Fix locking around sync_timeline
lists")
References: 0e2f733addbf ("dma-buf: make dma_fence structure a bit smaller
v2")
Signed-off-by: Chris Wilson <<a href="mailto:chris@chris-wilson.co.uk">chris@chris-wilson.co.uk</a>>
Cc: Sumit Semwal <<a href="mailto:sumit.semwal@linaro.org">sumit.semwal@linaro.org</a>>
Cc: Sean Paul <<a href="mailto:seanpaul@chromium.org">seanpaul@chromium.org</a>>
Cc: Gustavo Padovan <<a href="mailto:gustavo@padovan.org">gustavo@padovan.org</a>>
Cc: Christian König <<a href="mailto:christian.koenig@amd.com">christian.koenig@amd.com</a>>
Cc: <<a href="mailto:stable@vger.kernel.org">stable@vger.kernel.org</a>> # v4.14+
Acked-by: Christian König <<a href="mailto:christian.koenig@amd.com">christian.koenig@amd.com</a>>
Link:
<a href="https://patchwork.freedesktop.org/patch/msgid/20190812154247.20508-1-chris@chris-wilson.co.uk">https://patchwork.freedesktop.org/patch/msgid/20190812154247.20508-1-chris@chris-wilson.co.uk</a></pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
<li>You are on the CC list for the bug.</li>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>