Hans Verkuil 79687057c2 drm/msm: NULL pointer dereference in drivers/gpu/drm/msm/msm_gem_vma.c ... While I was testing the upcoming adv7533 CEC support with my Dragonboard c410 I encountered this NULL pointer dereference: [ 17.912822] Unable to handle kernel NULL pointer dereference at virtual address 000000e8 [ 17.917191] user pgtable: 4k pages, 48-bit VAs, pgd = ffff800030e9f000 [ 17.925249] [00000000000000e8] *pgd=00000000b0daf003, *pud=0000000000000000 [ 17.931650] Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 17.938395] Modules linked in: btqcomsmd btqca arc4 wcn36xx mac80211 bluetooth cfg80211 ecdh_generic r8152 snd_soc_hdmi_codec adv7511 cec qcom_wcnss_pil msm mdt_loader drm_kms_helper msm_rng rng_core drm [ 17.943967] CPU: 0 PID: 1684 Comm: Xorg Tainted: G W 4.13.0-rc1-dragonboard #111 [ 17.962005] Hardware name: Qualcomm Technologies, Inc. APQ 8016 SBC (DT) [ 17.970685] task: ffff800031236c00 task.stack: ffff800033fbc000 [ 17.977582] PC is at msm_gem_unmap_vma+0x20/0x80 [msm] [ 17.983213] LR is at put_iova+0x60/0xb8 [msm] [ 17.988303] pc : [<ffff000000ac2d58>] lr : [<ffff000000ac07c8>] pstate: 20000145 [ 17.992733] sp : ffff800033fbfb30 [ 18.000193] x29: ffff800033fbfb30 x28: ffff800030b5f000 [ 18.003407] x27: 00000000000000b4 x26: ffff0000009f8cd8 [ 18.008789] x25: 0000000000000004 x24: dead000000000100 [ 18.014085] x23: dead000000000200 x22: ffff800030b5fd40 [ 18.019379] x21: ffff800030b5fc00 x20: 0000000000000000 [ 18.024675] x19: ffff80003082bf00 x18: 0000000000000000 [ 18.029970] x17: 0000ffffb3347e70 x16: ffff000008207638 [ 18.035265] x15: 0000000000000053 x14: 0000000000000000 [ 18.040560] x13: 0000000000000038 x12: 0101010101010101 [ 18.045855] x11: 7f7f7f7f7f7f7f7f x10: 0000000000000040 [ 18.051150] x9 : ffff800030b5f038 x8 : ffff800031657b50 [ 18.056446] x7 : ffff800031657b78 x6 : 0000000000000000 [ 18.061740] x5 : 0000000000000000 x4 : 00000000b5c01000 [ 18.067036] x3 : 0000000000000000 x2 : ffff8000337bf300 [ 18.072330] x1 : ffff80003082bf00 x0 : 0000000000000000 [ 18.077629] Process Xorg (pid: 1684, stack limit = 0xffff800033fbc000) [ 18.082925] Stack: (0xffff800033fbfb30 to 0xffff800033fc0000) [ 18.089262] fb20: ffff800033fbfb60 ffff000000ac07c8 [ 18.095081] fb40: ffff80003082bf00 ffff800030b5fc90 ffff800030b5fc00 ffff000000abf4a0 [ 18.102893] fb60: ffff800033fbfba0 ffff000000ac16b0 ffff800030b5fc00 ffff8000338ff870 [ 18.110706] fb80: ffff8000338ff800 ffff800030b5fc00 ffff800030b5fda8 ffff800033fbfd80 [ 18.118518] fba0: ffff800033fbfbe0 ffff0000009d4244 ffff800030b5fc00 ffff800030b5f038 [ 18.126332] fbc0: ffff800033fbfbd0 ffff800030b5fc00 ffff800030b5f038 ffff0000009d4840 [ 18.134144] fbe0: ffff800033fbfbf0 ffff0000009d4858 ffff800033fbfc10 ffff0000009d48e4 [ 18.141955] fc00: ffff800030b5fc00 ffff8000338ffd98 ffff800033fbfc30 ffff0000009d49a4 [ 18.149768] fc20: ffff800030b5fc00 ffff800030b5f000 ffff800033fbfc60 ffff0000009d4a4c [ 18.157581] fc40: ffff800030b5f050 ffff800030b5f000 0000000000000001 ffff800030b5fc00 [ 18.165394] fc60: ffff800033fbfca0 ffff0000009d4ab0 0000000000000018 ffff800030b5f000 [ 18.173206] fc80: ffff0000009efd28 ffff800033fbfd80 ffff8000338ff800 ffff0000009d56a8 [ 18.181019] fca0: ffff800033fbfcb0 ffff0000009efd54 ffff800033fbfcc0 ffff0000009d56c8 [ 18.188831] fcc0: ffff800033fbfd00 ffff0000009d58e0 ffff0000009fa6e0 00000000c00464b4 [ 18.196643] fce0: 0000000000000004 ffff80003082b400 0000ffffea1f0e00 0000000000000000 [ 18.204456] fd00: ffff800033fbfe00 ffff000008206f0c ffff80000335caf8 ffff80003082b400 [ 18.212269] fd20: 0000ffffea1f0e00 ffff80003082b400 00000000c00464b4 0000ffffea1f0e00 [ 18.220081] fd40: 0000000000000124 000000000000001d ffff0000089d2000 ffff800031236c00 [ 18.227894] fd60: ffff800033fbfd80 0000000000000004 ffff0000009efd28 ffff800033fbfd80 [ 18.235706] fd80: 0000000100000001 0000008000000001 0000001800000020 0000000000000001 [ 18.243518] fda0: 0000000100000000 0000000100000001 0000ffff00000000 0000ffff00000000 [ 18.251331] fdc0: 0000000000000124 0000000000000038 ffff0000089d2000 ffff800031236c00 [ 18.259144] fde0: ffff800033fbfe40 ffff000008214124 ffff800033fbfe30 ffff000008203290 [ 18.266956] fe00: ffff800033fbfe80 ffff0000082076b4 0000000000000000 ffff800030d8a000 [ 18.274768] fe20: ffff80003082b400 0000000000000016 ffff800033fbfe50 ffff0000081f0488 [ 18.282581] fe40: ffff800033fbfe80 ffff000008207678 0000000000000000 ffff80003082b400 [ 18.290393] fe60: ffff800033fbfe70 ffff0000082138b0 ffff800033fbfe80 ffff000008207658 [ 18.298207] fe80: 0000000000000000 ffff000008082f84 0000000000000000 0000800034a16000 [ 18.306017] fea0: ffffffffffffffff 0000ffffb3347e7c 0000000000000000 0000000000000015 [ 18.313832] fec0: 0000000000000016 00000000c00464b4 0000ffffea1f0e00 0000000000000001 [ 18.321643] fee0: 0000000000000020 0000000000000080 0000000000000001 0000000000000000 [ 18.329456] ff00: 000000000000001d 000000012692c5b0 0101010101010101 7f7f7f7f7f7f7f7f [ 18.337269] ff20: 0101010101010101 0000000000000038 0000000000000000 0000000000000053 [ 18.345082] ff40: 0000ffffb368b2b8 0000ffffb3347e70 0000000000000000 0000ffffb3847000 [ 18.352894] ff60: 0000ffffea1f0e00 00000000c00464b4 0000000000000016 0000ffffea1f0edc [ 18.360705] ff80: 000000012692ad20 0000000000000003 00000001214282e4 0000000121428388 [ 18.368518] ffa0: 0000000000000000 0000ffffea1f0da0 0000ffffb367185c 0000ffffea1f0da0 [ 18.376332] ffc0: 0000ffffb3347e7c 0000000000000000 0000000000000016 000000000000001d [ 18.384142] ffe0: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 18.391953] Call trace: [ 18.399760] Exception stack(0xffff800033fbf950 to 0xffff800033fbfa80) [ 18.402023] f940: ffff80003082bf00 0001000000000000 [ 18.408622] f960: ffff800033fbfb30 ffff000000ac2d58 0000000020000145 ffff8000338ffa78 [ 18.416435] f980: 0000000000000000 0000000000000000 ffff800033fbf9e0 ffff0000089afcf0 [ 18.424248] f9a0: ffff80000348f230 ffff8000338ffa78 0000000000000000 0000000000000000 [ 18.432060] f9c0: ffff8000338ffaa8 0000000000000001 ffff800033fbfb80 ffff0000009e8f38 [ 18.439872] f9e0: ffff800033fbfa10 ffff0000089a9ff8 0000000000000027 ffff80003082b918 [ 18.447684] fa00: 0000000000000000 ffff80003082bf00 ffff8000337bf300 0000000000000000 [ 18.455497] fa20: 00000000b5c01000 0000000000000000 0000000000000000 ffff800031657b78 [ 18.463310] fa40: ffff800031657b50 ffff800030b5f038 0000000000000040 7f7f7f7f7f7f7f7f [ 18.471122] fa60: 0101010101010101 0000000000000038 0000000000000000 0000000000000053 [ 18.479062] [<ffff000000ac2d58>] msm_gem_unmap_vma+0x20/0x80 [msm] [ 18.486862] [<ffff000000ac07c8>] put_iova+0x60/0xb8 [msm] [ 18.492938] [<ffff000000ac16b0>] msm_gem_free_object+0x60/0x198 [msm] [ 18.498432] [<ffff0000009d4244>] drm_gem_object_free+0x1c/0x58 [drm] [ 18.504854] [<ffff0000009d4858>] drm_gem_object_put_unlocked+0x90/0xa0 [drm] [ 18.511273] [<ffff0000009d48e4>] drm_gem_object_handle_put_unlocked+0x64/0xd0 [drm] [ 18.518300] [<ffff0000009d49a4>] drm_gem_object_release_handle+0x54/0x98 [drm] [ 18.525679] [<ffff0000009d4a4c>] drm_gem_handle_delete+0x64/0xb8 [drm] [ 18.532968] [<ffff0000009d4ab0>] drm_gem_dumb_destroy+0x10/0x18 [drm] [ 18.539479] [<ffff0000009efd54>] drm_mode_destroy_dumb_ioctl+0x2c/0x40 [drm] [ 18.545992] [<ffff0000009d56c8>] drm_ioctl_kernel+0x68/0xe0 [drm] [ 18.553105] [<ffff0000009d58e0>] drm_ioctl+0x178/0x3b0 [drm] [ 18.558970] [<ffff000008206f0c>] do_vfs_ioctl+0xa4/0x7d0 [ 18.564694] [<ffff0000082076b4>] SyS_ioctl+0x7c/0x98 [ 18.569992] [<ffff000008082f84>] el0_svc_naked+0x38/0x3c [ 18.574941] Code: a90153f3 aa0003f4 f90013f5 aa0103f3 (f9407400) [ 18.580502] ---[ end trace b1ac6888ec40b0be ]--- It turns out that the aspace argument in msm_gem_unmap_vma() is NULL. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> [Note: this case gets hit with !IOMMU config] Signed-off-by: Rob Clark <robdclark@gmail.com>		2017-08-01 18:41:16 -04:00
..
amd	drm/amd/powerplay: fix AVFS voltage offset for Vega10	2017-07-25 16:38:31 -04:00
arc	drm/arcgpu: Drop drm_vblank_cleanup	2017-05-31 10:57:08 +02:00
arm	drm/arm: hdlcd: remove unused variables	2017-06-21 10:51:26 +01:00
armada	main drm pull for v4.13	2017-07-09 18:48:37 -07:00
ast	drm/ast: fix include notation and remove -Iinclude/drm flag	2017-05-16 17:17:51 +02:00
atmel-hlcdc	Merge tag 'drm-misc-next-2017-06-15' of git://anongit.freedesktop.org/git/drm-misc into drm-next	2017-06-16 09:33:43 +10:00
bochs	drm/bochs: fix include notation and remove -Iinclude/drm flag	2017-05-16 17:18:23 +02:00
bridge	i915, amd and some core fixes + mediatek color support	2017-07-13 11:26:18 -07:00
cirrus	drm/cirrus: fix include notation and remove -Iinclude/drm flag	2017-05-16 17:18:56 +02:00
etnaviv	main drm pull for v4.13	2017-07-09 18:48:37 -07:00
exynos	drm: exynos: mark pm functions as __maybe_unused	2017-07-27 09:24:03 +09:00
fsl-dcu	drm/fsl-dcu: use new drm_atomic_helper_shutdown	2017-06-08 14:59:14 -07:00
gma500	Linux 4.12-rc3	2017-05-30 15:54:15 +10:00
hisilicon	Linux 4.12-rc5	2017-06-16 13:58:27 +10:00
i2c	drm/i2c: remove unneeded -Iinclude/drm compiler flag	2017-05-18 07:13:04 +02:00
i810	drm/i810: remove unneeded -Iinclude/drm compiler flag	2017-05-18 07:12:57 +02:00
i915	Merge tag 'gvt-fixes-2017-07-26' of https://github.com/01org/gvt-linux into drm-intel-fixes	2017-07-27 22:07:53 +02:00
imx	imx-drm: fix parallel display regression and typo in plane format list	2017-07-21 14:04:44 +10:00
lib
mediatek	drm/mediatek: separate color module to fixup error memory reallocation	2017-06-27 17:34:53 +08:00
meson	Linux 4.12-rc5	2017-06-16 13:58:27 +10:00
mga	main drm pull for v4.13	2017-07-09 18:48:37 -07:00
mgag200	Linux 4.12-rc7	2017-06-27 08:28:30 +10:00
msm	drm/msm: NULL pointer dereference in drivers/gpu/drm/msm/msm_gem_vma.c	2017-08-01 18:41:16 -04:00
mxsfb	drm: mxsfb_crtc: Reset the eLCDIF controller	2017-06-15 14:26:24 -04:00
nouveau	drm/nouveau/bar/gf100: fix access to upper half of BAR2	2017-07-25 15:30:27 +10:00
omapdrm	drm/omap: fix tiled buffer stride calculations	2017-06-02 11:09:34 +03:00
panel	drm/panel: s6e3ha2: Add support for s6e3hf2 panel on TM2e board	2017-06-14 20:18:22 +02:00
pl111	drm/pl111: Fix offset calculation for the primary plane.	2017-06-07 11:50:00 -07:00
qxl	Linux 4.12-rc3	2017-05-30 15:54:15 +10:00
r128	drm/r128: remove unneeded -Iinclude/drm compiler flag	2017-05-18 07:13:23 +02:00
radeon	drm/radeon: Remove initialization of shared_resources.num_mec	2017-07-13 20:21:55 -05:00
rcar-du	drm: rcar-du: Map memory through the VSP device	2017-06-09 12:25:38 +01:00
rockchip	drm/rockchip: fix Kconfig dependencies	2017-07-24 09:53:09 +08:00
savage	drm/savage: remove unneeded -Iinclude/drm compiler flag	2017-05-18 07:13:34 +02:00
selftests	drm/mm: Split up long running selftests with cond_resched()	2017-05-04 08:11:46 +02:00
shmobile
sis	drm/sis: remove unneeded -Iinclude/drm compiler flag	2017-05-18 07:13:40 +02:00
sti	Merge remote-tracking branch 'airlied/drm-next' into drm-misc-next	2017-05-18 09:24:30 -04:00
stm	drm/stm: Drop drm_vblank_cleanup	2017-05-31 10:48:58 +02:00
sun4i	sun4i-drm changes for 4.13	2017-06-16 10:02:35 +10:00
tdfx	drm/tdfx: remove unneeded -Iinclude/drm compiler flag	2017-05-18 07:13:47 +02:00
tegra	Linux 4.12-rc7	2017-06-27 08:28:30 +10:00
tilcdc	drm/tilcdc: fix include notation and remove -Iinclude/drm flag	2017-05-17 14:36:49 +02:00
tinydrm	drm: Use vsnprintf extension %ph	2017-05-31 10:30:38 +02:00
ttm	drm/ttm: Fix use-after-free in ttm_bo_clean_mm	2017-07-03 16:25:43 -04:00
udl	drm: drop drm_[cm]alloc* helpers	2017-05-18 17:22:39 +02:00
vc4	drm/vc4: Fix VBLANK handling in crtc->enable() path	2017-07-14 13:19:48 -07:00
vgem	drm/vgem: Fix return value check in vgem_init()	2017-05-22 09:47:34 +02:00
via	drm/via: remove unneeded -Iinclude/drm compiler flag	2017-05-18 07:14:05 +02:00
virtio	drm: Remove drm_device->virtdev	2017-05-29 20:57:25 +02:00
vmwgfx	Merge branch 'drm-vmwgfx-fixes' of git://people.freedesktop.org/~syeh/repos_linux into drm-fixes	2017-07-24 15:57:28 +10:00
zte	drm: zte: use devm_of_platform_populate()	2017-06-05 09:57:14 +08:00
ati_pcigart.c
drm_agpsupport.c
drm_atomic_helper.c	Linux 4.12-rc5	2017-06-16 13:58:27 +10:00
drm_atomic.c	drm: Reduce scope of 'state' variable	2017-06-15 14:26:02 -04:00
drm_auth.c
drm_blend.c	drm: Add DRM_MODE_ROTATE_ and DRM_MODE_REFLECT_ to UAPI	2017-05-22 09:49:48 +02:00
drm_bridge.c	drm: Introduce drm_bridge_mode_valid()	2017-05-30 08:37:50 +02:00
drm_bufs.c	switch compat_drm_mapbufs() to drm_ioctl_kernel()	2017-07-04 13:16:26 -04:00
drm_cache.c
drm_color_mgmt.c	drm/doc: Interlink color manager docs better	2017-04-18 08:56:29 +02:00
drm_connector.c	Linux 4.12-rc7	2017-06-27 08:28:30 +10:00
drm_context.c
drm_crtc_helper_internal.h	drm: Add drm_{crtc/encoder/connector}_mode_valid()	2017-05-30 08:37:24 +02:00
drm_crtc_helper.c
drm_crtc_internal.h	drm: extract legacy framebuffer remove	2017-04-06 10:22:43 +02:00
drm_crtc.c	drm: Take mode_config.mutex in setcrtc ioctl	2017-04-06 22:49:50 +02:00
drm_debugfs_crc.c	Revert "drm: Don't allow interruptions when opening debugfs/crc"	2017-04-07 16:18:28 -04:00
drm_debugfs.c
drm_dma.c
drm_dp_aux_dev.c	drm_dp_aux_dev: switch to read_iter/write_iter	2017-07-08 20:51:46 -04:00
drm_dp_dual_mode_helper.c
drm_dp_helper.c	drm/dp: Don't trust drm_dp_downstream_id()	2017-07-21 17:45:26 +03:00
drm_dp_mst_topology.c	drm/mst: Avoid processing partially received up/down message transactions	2017-07-20 10:20:31 +02:00
drm_drv.c	drm: Fix oops + Xserver hang when unplugging USB drm devices	2017-06-02 11:09:35 -04:00
drm_dumb_buffers.c
drm_edid_load.c
drm_edid.c	drm/edid: Add 10 bpc quirk for LGD 764 panel in HP zBook 17 G2	2017-05-02 10:37:45 +02:00
drm_encoder_slave.c
drm_encoder.c
drm_fb_cma_helper.c	drm/cma-helper: Return ENOENT for "no such gem obj"	2017-04-18 17:57:37 +02:00
drm_fb_helper.c	drm: Add DRM_MODE_ROTATE_ and DRM_MODE_REFLECT_ to UAPI	2017-05-22 09:49:48 +02:00
drm_file.c	drm: introduce sync objects (v4)	2017-06-14 12:10:22 +10:00
drm_flip_work.c
drm_fourcc.c
drm_framebuffer.c	drm/atomic: Add missing drm_atomic_state_clear to atomic_remove_fb	2017-07-03 10:31:37 +02:00
drm_gem_cma_helper.c
drm_gem.c	drm: drop drm_[cm]alloc* helpers	2017-05-18 17:22:39 +02:00
drm_global.c
drm_hashtab.c
drm_info.c
drm_internal.h	main drm pull for v4.13	2017-07-09 18:48:37 -07:00
drm_ioc32.c	drm: Add missing field copy in compat_drm_version	2017-07-13 11:25:04 -07:00
drm_ioctl.c	main drm pull for v4.13	2017-07-09 18:48:37 -07:00
drm_irq.c	drm/doc: Polish irq helper documentation	2017-06-01 08:02:14 +02:00
drm_kms_helper_common.c
drm_legacy.h	switch compat_drm_mapbufs() to drm_ioctl_kernel()	2017-07-04 13:16:26 -04:00
drm_lock.c
drm_memory.c
drm_mipi_dsi.c
drm_mm.c
drm_mode_config.c
drm_mode_object.c
drm_modes.c
drm_modeset_helper.c
drm_modeset_lock.c	drm: Remove drm_modeset_legacy_acquire_ctx and crtc->acquire_ctx	2017-04-05 09:26:45 +02:00
drm_of.c	drm: of: introduce drm_of_find_panel_or_bridge	2017-04-06 17:00:27 -04:00
drm_panel.c
drm_pci.c
drm_plane_helper.c	drm: Add DRM_MODE_ROTATE_ and DRM_MODE_REFLECT_ to UAPI	2017-05-22 09:49:48 +02:00
drm_plane.c	drm: Fix deadlock retry loop in page_flip_ioctl	2017-05-23 09:39:14 +02:00
drm_prime.c	drm/prime: Introduce drm_gem_prime_import_dev	2017-05-08 09:39:13 +02:00
drm_print.c
drm_probe_helper.c	drm: Use new mode_valid() helpers in connector probe helper	2017-05-30 08:37:50 +02:00
drm_property.c	drm: Fix get_property logic fumble	2017-04-12 18:11:32 +02:00
drm_rect.c	drm: Add DRM_MODE_ROTATE_ and DRM_MODE_REFLECT_ to UAPI	2017-05-22 09:49:48 +02:00
drm_scatter.c
drm_scdc_helper.c
drm_simple_kms_helper.c	drm: Clarify the role of plane_state argument to drm_simple update().	2017-03-30 12:02:00 -07:00
drm_syncobj.c	drm: Remove unused drm_file parameter to drm_syncobj_replace_fence()	2017-07-06 15:53:00 +10:00
drm_sysfs.c	drm: Consolidate and document sysfs support	2017-04-04 20:47:54 +02:00
drm_trace_points.c
drm_trace.h
drm_vblank.c	drm: vblank: Fix vblank timestamp update	2017-06-29 14:40:47 +02:00
drm_vm.c
drm_vma_manager.c
Kconfig	drm/pl111: Initial drm/kms driver for pl111	2017-05-08 12:24:06 -07:00
Makefile	Merge tag 'drm-misc-next-2017-06-15' of git://anongit.freedesktop.org/git/drm-misc into drm-next	2017-06-16 09:33:43 +10:00