Skip to contentSkip to conversation

i915 Oops at intel_fbdev_invalidate()

REGRESSION 4.12 Takashi Iwai 2 participants 3 messages Jun 30, 2017

Subsystems (2)
DRM drivers Intel i915
lore
Share & tools
lore

Takashi Iwai

author
#0 lore raw

Hi,

I hit an Oops with the latest Linus tree (4.12-rc7+) on a HSW machine like the following at boot:

 BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0
 IP: intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
 Oops: 0000 [#1] PREEMPT SMP
 CPU: 2 PID: 833 Comm: X Not tainted 4.10.0-rc5-btest9+ #15
 Hardware name: Hewlett-Packard HP ProBook 430 G1/1946, BIOS L73 Ver. 08.05 2013/03/15
 task: ffff917313db8000 task.stack: ffffb6e70379c000
 RIP: 0010:intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
 RSP: 0018:ffffb6e70379fde0 EFLAGS: 00010246
 RAX: 0000000000000000 RBX: ffff9172f70e1c00 RCX: 0000000000000000
 RDX: ffff917313db8000 RSI: 0000000000000000 RDI: ffff91731934d040
 RBP: ffffb6e70379fdf0 R08: 0000000000000002 R09: ffff91731934ead0
 R10: ffff9173192f0368 R11: 0000000000000001 R12: ffff9173192f0000
 R13: ffff9172f71016e8 R14: ffff9173227c8480 R15: ffff9172f71016c8
 FS:  00007f8cc8c3fa00(0000) GS:ffff9173c0a80000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00000000000000b0 CR3: 000000006273b000 CR4: 00000000001406e0
 Call Trace:
  ? intel_fbdev_restore_mode+0x4e/0x70 [i915]
  i915_driver_lastclose+0xe/0x20 [i915]
  drm_lastclose+0x3b/0xf0 [drm]
  drm_release+0x2b8/0x360 [drm]
  __fput+0xd9/0x1e0
  ____fput+0xe/0x10
  task_work_run+0x83/0xa0
  exit_to_usermode_loop+0x59/0x85
  do_syscall_64+0xb3/0xd0
  entry_SYSCALL64_slow_path+0x25/0x25

And git bisection leaded to the commit fabef825626d7bd05a321e4427fdf31a169b5173
drm/i915: Drop struct_mutex around frontbuffer flushes

The band-aid patch below seems fixing it.

thanks,

Takashi

-- 8< --
From: Takashi Iwai <[email protected]>
Subject: [PATCH] drm/i915: Fix NULL-dereference at intel_fbdev_invalidate()

The commit fabef825626d ("drm/i915: Drop struct_mutex around frontbuffer flushes") caused an Oops at boot on a HSW machine like:

 BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0
 IP: intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
 Oops: 0000 [#1] PREEMPT SMP
 CPU: 2 PID: 833 Comm: X Not tainted 4.10.0-rc5-btest9+ #15
 Hardware name: Hewlett-Packard HP ProBook 430 G1/1946, BIOS L73 Ver. 08.05 2013/03/15
 Call Trace:
  ? intel_fbdev_restore_mode+0x4e/0x70 [i915]
  i915_driver_lastclose+0xe/0x20 [i915]
  drm_lastclose+0x3b/0xf0 [drm]
  drm_release+0x2b8/0x360 [drm]
  __fput+0xd9/0x1e0
  ____fput+0xe/0x10
  task_work_run+0x83/0xa0
  exit_to_usermode_loop+0x59/0x85
  do_syscall_64+0xb3/0xd0
  entry_SYSCALL64_slow_path+0x25/0x25

As this is a simple NULL dereference, check it before reference as a band-aid fix.

Fixes fabef825626d ("drm/i915: Drop struct_mutex around frontbuffer flushes")
Signed-off-by Takashi Iwai <[email protected]>
---
 drivers/gpu/drm/i915/intel_fbdev.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/intel_fbdev.c +3 -1
index 332254a8eebe..fdefe6941912 100644
@@ -48,8 +48,10 @@
 static void intel_fbdev_invalidate(struct intel_fbdev *ifbdev)
 {
 	struct drm_i915_gem_object *obj = ifbdev->fb->obj;
-	unsigned int origin = ifbdev->vma->fence ? ORIGIN_GTT : ORIGIN_CPU;
+	unsigned int origin = ORIGIN_GTT;
 
+	if (ifbdev->vma && !ifbdev->vma->fence)
+		origin = ORIGIN_CPU;
 	intel_fb_obj_invalidate(obj, origin);
 }
Signature · 6 lines
2.13.2

_______________________________________________
Intel-gfx mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
#1 lore raw

Quoting Takashi Iwai (2017-06-30 16:38:46)

Quoted 33 lines

Hi,

I hit an Oops with the latest Linus tree (4.12-rc7+) on a HSW machine like the following at boot:

 BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0
 IP: intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
 Oops: 0000 [#1] PREEMPT SMP
 CPU: 2 PID: 833 Comm: X Not tainted 4.10.0-rc5-btest9+ #15
 Hardware name: Hewlett-Packard HP ProBook 430 G1/1946, BIOS L73 Ver. 08.05 2013/03/15
 task: ffff917313db8000 task.stack: ffffb6e70379c000
 RIP: 0010:intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
 RSP: 0018:ffffb6e70379fde0 EFLAGS: 00010246
 RAX: 0000000000000000 RBX: ffff9172f70e1c00 RCX: 0000000000000000
 RDX: ffff917313db8000 RSI: 0000000000000000 RDI: ffff91731934d040
 RBP: ffffb6e70379fdf0 R08: 0000000000000002 R09: ffff91731934ead0
 R10: ffff9173192f0368 R11: 0000000000000001 R12: ffff9173192f0000
 R13: ffff9172f71016e8 R14: ffff9173227c8480 R15: ffff9172f71016c8
 FS:  00007f8cc8c3fa00(0000) GS:ffff9173c0a80000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00000000000000b0 CR3: 000000006273b000 CR4: 00000000001406e0
 Call Trace:
  ? intel_fbdev_restore_mode+0x4e/0x70 [i915]
  i915_driver_lastclose+0xe/0x20 [i915]
  drm_lastclose+0x3b/0xf0 [drm]
  drm_release+0x2b8/0x360 [drm]
  __fput+0xd9/0x1e0
  ____fput+0xe/0x10
  task_work_run+0x83/0xa0
  exit_to_usermode_loop+0x59/0x85
  do_syscall_64+0xb3/0xd0
  entry_SYSCALL64_slow_path+0x25/0x25
Quoted 5 lines

And git bisection leaded to the commit fabef825626d7bd05a321e4427fdf31a169b5173
drm/i915: Drop struct_mutex around frontbuffer flushes

The band-aid patch below seems fixing it.

See https://patchwork.freedesktop.org/patch/163261/
-Chris

author Tested-by
#2 lore raw
Quoted 35 lines · Chris Wilson

Quoting Takashi Iwai (2017-06-30 16:38:46)

Quoted 33 lines

Hi,

I hit an Oops with the latest Linus tree (4.12-rc7+) on a HSW machine like the following at boot:

 BUG: unable to handle kernel NULL pointer dereference at 00000000000000b0
 IP: intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
 Oops: 0000 [#1] PREEMPT SMP
 CPU: 2 PID: 833 Comm: X Not tainted 4.10.0-rc5-btest9+ #15
 Hardware name: Hewlett-Packard HP ProBook 430 G1/1946, BIOS L73 Ver. 08.05 2013/03/15
 task: ffff917313db8000 task.stack: ffffb6e70379c000
 RIP: 0010:intel_fbdev_invalidate.isra.3+0xc/0x40 [i915]
 RSP: 0018:ffffb6e70379fde0 EFLAGS: 00010246
 RAX: 0000000000000000 RBX: ffff9172f70e1c00 RCX: 0000000000000000
 RDX: ffff917313db8000 RSI: 0000000000000000 RDI: ffff91731934d040
 RBP: ffffb6e70379fdf0 R08: 0000000000000002 R09: ffff91731934ead0
 R10: ffff9173192f0368 R11: 0000000000000001 R12: ffff9173192f0000
 R13: ffff9172f71016e8 R14: ffff9173227c8480 R15: ffff9172f71016c8
 FS:  00007f8cc8c3fa00(0000) GS:ffff9173c0a80000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 CR2: 00000000000000b0 CR3: 000000006273b000 CR4: 00000000001406e0
 Call Trace:
  ? intel_fbdev_restore_mode+0x4e/0x70 [i915]
  i915_driver_lastclose+0xe/0x20 [i915]
  drm_lastclose+0x3b/0xf0 [drm]
  drm_release+0x2b8/0x360 [drm]
  __fput+0xd9/0x1e0
  ____fput+0xe/0x10
  task_work_run+0x83/0xa0
  exit_to_usermode_loop+0x59/0x85
  do_syscall_64+0xb3/0xd0
  entry_SYSCALL64_slow_path+0x25/0x25
Quoted 7 lines
Quoted 5 lines

And git bisection leaded to the commit fabef825626d7bd05a321e4427fdf31a169b5173
drm/i915: Drop struct_mutex around frontbuffer flushes

The band-aid patch below seems fixing it.

See https://patchwork.freedesktop.org/patch/163261/

Thanks, it worked.

Tested-by Takashi Iwai <[email protected]>

Could you guys pick it up to for-linus? For 4.12 it's likely too late, but there might be a miracle.

Takashi
_______________________________________________
Intel-gfx mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/intel-gfx