linux/drivers/gpu/drm/msm/msm_gem_vma.c
Hans Verkuil 79687057c2 drm/msm: NULL pointer dereference in drivers/gpu/drm/msm/msm_gem_vma.c
While I was testing the upcoming adv7533 CEC support with my Dragonboard c410
I encountered this NULL pointer dereference:

[   17.912822] Unable to handle kernel NULL pointer dereference at virtual address 000000e8
[   17.917191] user pgtable: 4k pages, 48-bit VAs, pgd = ffff800030e9f000
[   17.925249] [00000000000000e8] *pgd=00000000b0daf003, *pud=0000000000000000
[   17.931650] Internal error: Oops: 96000005 [#1] PREEMPT SMP
[   17.938395] Modules linked in: btqcomsmd btqca arc4 wcn36xx mac80211 bluetooth cfg80211 ecdh_generic r8152 snd_soc_hdmi_codec adv7511 cec
qcom_wcnss_pil msm mdt_loader drm_kms_helper msm_rng rng_core drm
[   17.943967] CPU: 0 PID: 1684 Comm: Xorg Tainted: G        W       4.13.0-rc1-dragonboard #111
[   17.962005] Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT)
[   17.970685] task: ffff800031236c00 task.stack: ffff800033fbc000
[   17.977582] PC is at msm_gem_unmap_vma+0x20/0x80 [msm]
[   17.983213] LR is at put_iova+0x60/0xb8 [msm]
[   17.988303] pc : [<ffff000000ac2d58>] lr : [<ffff000000ac07c8>] pstate: 20000145
[   17.992733] sp : ffff800033fbfb30
[   18.000193] x29: ffff800033fbfb30 x28: ffff800030b5f000
[   18.003407] x27: 00000000000000b4 x26: ffff0000009f8cd8
[   18.008789] x25: 0000000000000004 x24: dead000000000100
[   18.014085] x23: dead000000000200 x22: ffff800030b5fd40
[   18.019379] x21: ffff800030b5fc00 x20: 0000000000000000
[   18.024675] x19: ffff80003082bf00 x18: 0000000000000000
[   18.029970] x17: 0000ffffb3347e70 x16: ffff000008207638
[   18.035265] x15: 0000000000000053 x14: 0000000000000000
[   18.040560] x13: 0000000000000038 x12: 0101010101010101
[   18.045855] x11: 7f7f7f7f7f7f7f7f x10: 0000000000000040
[   18.051150] x9 : ffff800030b5f038 x8 : ffff800031657b50
[   18.056446] x7 : ffff800031657b78 x6 : 0000000000000000
[   18.061740] x5 : 0000000000000000 x4 : 00000000b5c01000
[   18.067036] x3 : 0000000000000000 x2 : ffff8000337bf300
[   18.072330] x1 : ffff80003082bf00 x0 : 0000000000000000
[   18.077629] Process Xorg (pid: 1684, stack limit = 0xffff800033fbc000)
[   18.082925] Stack: (0xffff800033fbfb30 to 0xffff800033fc0000)
[   18.089262] fb20:                                   ffff800033fbfb60 ffff000000ac07c8
[   18.095081] fb40: ffff80003082bf00 ffff800030b5fc90 ffff800030b5fc00 ffff000000abf4a0
[   18.102893] fb60: ffff800033fbfba0 ffff000000ac16b0 ffff800030b5fc00 ffff8000338ff870
[   18.110706] fb80: ffff8000338ff800 ffff800030b5fc00 ffff800030b5fda8 ffff800033fbfd80
[   18.118518] fba0: ffff800033fbfbe0 ffff0000009d4244 ffff800030b5fc00 ffff800030b5f038
[   18.126332] fbc0: ffff800033fbfbd0 ffff800030b5fc00 ffff800030b5f038 ffff0000009d4840
[   18.134144] fbe0: ffff800033fbfbf0 ffff0000009d4858 ffff800033fbfc10 ffff0000009d48e4
[   18.141955] fc00: ffff800030b5fc00 ffff8000338ffd98 ffff800033fbfc30 ffff0000009d49a4
[   18.149768] fc20: ffff800030b5fc00 ffff800030b5f000 ffff800033fbfc60 ffff0000009d4a4c
[   18.157581] fc40: ffff800030b5f050 ffff800030b5f000 0000000000000001 ffff800030b5fc00
[   18.165394] fc60: ffff800033fbfca0 ffff0000009d4ab0 0000000000000018 ffff800030b5f000
[   18.173206] fc80: ffff0000009efd28 ffff800033fbfd80 ffff8000338ff800 ffff0000009d56a8
[   18.181019] fca0: ffff800033fbfcb0 ffff0000009efd54 ffff800033fbfcc0 ffff0000009d56c8
[   18.188831] fcc0: ffff800033fbfd00 ffff0000009d58e0 ffff0000009fa6e0 00000000c00464b4
[   18.196643] fce0: 0000000000000004 ffff80003082b400 0000ffffea1f0e00 0000000000000000
[   18.204456] fd00: ffff800033fbfe00 ffff000008206f0c ffff80000335caf8 ffff80003082b400
[   18.212269] fd20: 0000ffffea1f0e00 ffff80003082b400 00000000c00464b4 0000ffffea1f0e00
[   18.220081] fd40: 0000000000000124 000000000000001d ffff0000089d2000 ffff800031236c00
[   18.227894] fd60: ffff800033fbfd80 0000000000000004 ffff0000009efd28 ffff800033fbfd80
[   18.235706] fd80: 0000000100000001 0000008000000001 0000001800000020 0000000000000001
[   18.243518] fda0: 0000000100000000 0000000100000001 0000ffff00000000 0000ffff00000000
[   18.251331] fdc0: 0000000000000124 0000000000000038 ffff0000089d2000 ffff800031236c00
[   18.259144] fde0: ffff800033fbfe40 ffff000008214124 ffff800033fbfe30 ffff000008203290
[   18.266956] fe00: ffff800033fbfe80 ffff0000082076b4 0000000000000000 ffff800030d8a000
[   18.274768] fe20: ffff80003082b400 0000000000000016 ffff800033fbfe50 ffff0000081f0488
[   18.282581] fe40: ffff800033fbfe80 ffff000008207678 0000000000000000 ffff80003082b400
[   18.290393] fe60: ffff800033fbfe70 ffff0000082138b0 ffff800033fbfe80 ffff000008207658
[   18.298207] fe80: 0000000000000000 ffff000008082f84 0000000000000000 0000800034a16000
[   18.306017] fea0: ffffffffffffffff 0000ffffb3347e7c 0000000000000000 0000000000000015
[   18.313832] fec0: 0000000000000016 00000000c00464b4 0000ffffea1f0e00 0000000000000001
[   18.321643] fee0: 0000000000000020 0000000000000080 0000000000000001 0000000000000000
[   18.329456] ff00: 000000000000001d 000000012692c5b0 0101010101010101 7f7f7f7f7f7f7f7f
[   18.337269] ff20: 0101010101010101 0000000000000038 0000000000000000 0000000000000053
[   18.345082] ff40: 0000ffffb368b2b8 0000ffffb3347e70 0000000000000000 0000ffffb3847000
[   18.352894] ff60: 0000ffffea1f0e00 00000000c00464b4 0000000000000016 0000ffffea1f0edc
[   18.360705] ff80: 000000012692ad20 0000000000000003 00000001214282e4 0000000121428388
[   18.368518] ffa0: 0000000000000000 0000ffffea1f0da0 0000ffffb367185c 0000ffffea1f0da0
[   18.376332] ffc0: 0000ffffb3347e7c 0000000000000000 0000000000000016 000000000000001d
[   18.384142] ffe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
[   18.391953] Call trace:
[   18.399760] Exception stack(0xffff800033fbf950 to 0xffff800033fbfa80)
[   18.402023] f940:                                   ffff80003082bf00 0001000000000000
[   18.408622] f960: ffff800033fbfb30 ffff000000ac2d58 0000000020000145 ffff8000338ffa78
[   18.416435] f980: 0000000000000000 0000000000000000 ffff800033fbf9e0 ffff0000089afcf0
[   18.424248] f9a0: ffff80000348f230 ffff8000338ffa78 0000000000000000 0000000000000000
[   18.432060] f9c0: ffff8000338ffaa8 0000000000000001 ffff800033fbfb80 ffff0000009e8f38
[   18.439872] f9e0: ffff800033fbfa10 ffff0000089a9ff8 0000000000000027 ffff80003082b918
[   18.447684] fa00: 0000000000000000 ffff80003082bf00 ffff8000337bf300 0000000000000000
[   18.455497] fa20: 00000000b5c01000 0000000000000000 0000000000000000 ffff800031657b78
[   18.463310] fa40: ffff800031657b50 ffff800030b5f038 0000000000000040 7f7f7f7f7f7f7f7f
[   18.471122] fa60: 0101010101010101 0000000000000038 0000000000000000 0000000000000053
[   18.479062] [<ffff000000ac2d58>] msm_gem_unmap_vma+0x20/0x80 [msm]
[   18.486862] [<ffff000000ac07c8>] put_iova+0x60/0xb8 [msm]
[   18.492938] [<ffff000000ac16b0>] msm_gem_free_object+0x60/0x198 [msm]
[   18.498432] [<ffff0000009d4244>] drm_gem_object_free+0x1c/0x58 [drm]
[   18.504854] [<ffff0000009d4858>] drm_gem_object_put_unlocked+0x90/0xa0 [drm]
[   18.511273] [<ffff0000009d48e4>] drm_gem_object_handle_put_unlocked+0x64/0xd0 [drm]
[   18.518300] [<ffff0000009d49a4>] drm_gem_object_release_handle+0x54/0x98 [drm]
[   18.525679] [<ffff0000009d4a4c>] drm_gem_handle_delete+0x64/0xb8 [drm]
[   18.532968] [<ffff0000009d4ab0>] drm_gem_dumb_destroy+0x10/0x18 [drm]
[   18.539479] [<ffff0000009efd54>] drm_mode_destroy_dumb_ioctl+0x2c/0x40 [drm]
[   18.545992] [<ffff0000009d56c8>] drm_ioctl_kernel+0x68/0xe0 [drm]
[   18.553105] [<ffff0000009d58e0>] drm_ioctl+0x178/0x3b0 [drm]
[   18.558970] [<ffff000008206f0c>] do_vfs_ioctl+0xa4/0x7d0
[   18.564694] [<ffff0000082076b4>] SyS_ioctl+0x7c/0x98
[   18.569992] [<ffff000008082f84>] el0_svc_naked+0x38/0x3c
[   18.574941] Code: a90153f3 aa0003f4 f90013f5 aa0103f3 (f9407400)
[   18.580502] ---[ end trace b1ac6888ec40b0be ]---

It turns out that the aspace argument in msm_gem_unmap_vma() is NULL.

Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
[Note: this case gets hit with !IOMMU config]
Signed-off-by: Rob Clark <robdclark@gmail.com>
2017-08-01 18:41:16 -04:00

115 lines
2.7 KiB
C

/*
* Copyright (C) 2016 Red Hat
* Author: Rob Clark <robdclark@gmail.com>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 as published by
* the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
* more details.
*
* You should have received a copy of the GNU General Public License along with
* this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "msm_drv.h"
#include "msm_gem.h"
#include "msm_mmu.h"
static void
msm_gem_address_space_destroy(struct kref *kref)
{
struct msm_gem_address_space *aspace = container_of(kref,
struct msm_gem_address_space, kref);
drm_mm_takedown(&aspace->mm);
if (aspace->mmu)
aspace->mmu->funcs->destroy(aspace->mmu);
kfree(aspace);
}
void msm_gem_address_space_put(struct msm_gem_address_space *aspace)
{
if (aspace)
kref_put(&aspace->kref, msm_gem_address_space_destroy);
}
void
msm_gem_unmap_vma(struct msm_gem_address_space *aspace,
struct msm_gem_vma *vma, struct sg_table *sgt)
{
if (!aspace || !vma->iova)
return;
if (aspace->mmu) {
unsigned size = vma->node.size << PAGE_SHIFT;
aspace->mmu->funcs->unmap(aspace->mmu, vma->iova, sgt, size);
}
spin_lock(&aspace->lock);
drm_mm_remove_node(&vma->node);
spin_unlock(&aspace->lock);
vma->iova = 0;
msm_gem_address_space_put(aspace);
}
int
msm_gem_map_vma(struct msm_gem_address_space *aspace,
struct msm_gem_vma *vma, struct sg_table *sgt, int npages)
{
int ret;
spin_lock(&aspace->lock);
if (WARN_ON(drm_mm_node_allocated(&vma->node))) {
spin_unlock(&aspace->lock);
return 0;
}
ret = drm_mm_insert_node(&aspace->mm, &vma->node, npages);
spin_unlock(&aspace->lock);
if (ret)
return ret;
vma->iova = vma->node.start << PAGE_SHIFT;
if (aspace->mmu) {
unsigned size = npages << PAGE_SHIFT;
ret = aspace->mmu->funcs->map(aspace->mmu, vma->iova, sgt,
size, IOMMU_READ | IOMMU_WRITE);
}
/* Get a reference to the aspace to keep it around */
kref_get(&aspace->kref);
return ret;
}
struct msm_gem_address_space *
msm_gem_address_space_create(struct device *dev, struct iommu_domain *domain,
const char *name)
{
struct msm_gem_address_space *aspace;
aspace = kzalloc(sizeof(*aspace), GFP_KERNEL);
if (!aspace)
return ERR_PTR(-ENOMEM);
spin_lock_init(&aspace->lock);
aspace->name = name;
aspace->mmu = msm_iommu_new(dev, domain);
drm_mm_init(&aspace->mm, (domain->geometry.aperture_start >> PAGE_SHIFT),
(domain->geometry.aperture_end >> PAGE_SHIFT) - 1);
kref_init(&aspace->kref);
return aspace;
}