drm/nouveau/gem: fix fence_sync race / oops
Due to a race it was possible for a fence to be destroyed while another thread was trying to synchronise with it. If this happened in the fallback non-semaphore path, it lead to the following oops due to fence->channel being NULL. BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<fa9632ce>] nouveau_fence_update+0xe/0xe0 [nouveau] *pde = a649c067 SMP Modules linked in: fuse nouveau(O) ttm(O) drm_kms_helper(O) drm(O) mxm_wmi video wmi netconsole configfs lockd bnep bluetooth rfkill ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ip6table_filter ip6_tables snd_hda_codec_realtek snd_hda_intel snd_hda_cobinfmt_misc uinput ata_generic pata_acpi pata_aet2c_algo_bit i2c_core [last unloaded: wmi] Pid: 2255, comm: gnome-shell Tainted: G O 3.2.0-0.rc5.git0.1.fc17.i686 #1 System manufacturer System Product Name/M2A-VM EIP: 0060:[<fa9632ce>] EFLAGS: 00010296 CPU: 1 EIP is at nouveau_fence_update+0xe/0xe0 [nouveau] EAX: 00000000 EBX: ddfc6dd0 ECX: dd111580 EDX: 00000000 ESI: 00003e80 EDI: dd111580 EBP: dd121d00 ESP: dd121ce8 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 Process gnome-shell (pid: 2255, ti=dd120000 task=dd111580 task.ti=dd120000) Stack: 7dc86c76 00000000 00003e80 ddfc6dd0 00003e80 dd111580 dd121d0c fa96371f 00000000 dd121d3c fa963773 dd111580 01000246 000ec53d 00000000 ddfc6dd0 00001f40 00000000 ddfc6dd0 00000010 dc7df840 dd121d6c fa9639a0 00000000 Call Trace: [<fa96371f>] __nouveau_fence_signalled+0x1f/0x30 [nouveau] [<fa963773>] __nouveau_fence_wait+0x43/0xd0 [nouveau] [<fa9639a0>] nouveau_fence_sync+0x1a0/0x1c0 [nouveau] [<fa964046>] validate_list+0x176/0x300 [nouveau] [<f7d9c9c0>] ? ttm_bo_mem_put+0x30/0x30 [ttm] [<fa964b8a>] nouveau_gem_ioctl_pushbuf+0x48a/0xfd0 [nouveau] [<c0406481>] ? die+0x31/0x80 [<f7c93d98>] drm_ioctl+0x388/0x490 [drm] [<c0406481>] ? die+0x31/0x80 [<fa964700>] ? nouveau_gem_ioctl_new+0x150/0x150 [nouveau] [<c0635c7b>] ? file_has_perm+0xcb/0xe0 [<f7c93a10>] ? drm_copy_field+0x80/0x80 [drm] [<c0564f56>] do_vfs_ioctl+0x86/0x5b0 [<c0406481>] ? die+0x31/0x80 [<c0635f22>] ? selinux_file_ioctl+0x62/0x130 [<c0554f30>] ? fget_light+0x30/0x340 [<c05654ef>] sys_ioctl+0x6f/0x80 [<c099e3a4>] syscall_call+0x7/0xb [<c0406481>] ? die+0x31/0x80 [<c0406481>] ? die+0x31/0x80 Signed-off-by: Ben Skeggs <bskeggs@redhat.com> Cc: stable@vger.kernel.org
This commit is contained in:
parent
1eb8a619b4
commit
525895ba38
|
@ -379,6 +379,25 @@ retry:
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static int
|
||||||
|
validate_sync(struct nouveau_channel *chan, struct nouveau_bo *nvbo)
|
||||||
|
{
|
||||||
|
struct nouveau_fence *fence = NULL;
|
||||||
|
int ret = 0;
|
||||||
|
|
||||||
|
spin_lock(&nvbo->bo.bdev->fence_lock);
|
||||||
|
if (nvbo->bo.sync_obj)
|
||||||
|
fence = nouveau_fence_ref(nvbo->bo.sync_obj);
|
||||||
|
spin_unlock(&nvbo->bo.bdev->fence_lock);
|
||||||
|
|
||||||
|
if (fence) {
|
||||||
|
ret = nouveau_fence_sync(fence, chan);
|
||||||
|
nouveau_fence_unref(&fence);
|
||||||
|
}
|
||||||
|
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
|
||||||
static int
|
static int
|
||||||
validate_list(struct nouveau_channel *chan, struct list_head *list,
|
validate_list(struct nouveau_channel *chan, struct list_head *list,
|
||||||
struct drm_nouveau_gem_pushbuf_bo *pbbo, uint64_t user_pbbo_ptr)
|
struct drm_nouveau_gem_pushbuf_bo *pbbo, uint64_t user_pbbo_ptr)
|
||||||
|
@ -393,7 +412,7 @@ validate_list(struct nouveau_channel *chan, struct list_head *list,
|
||||||
list_for_each_entry(nvbo, list, entry) {
|
list_for_each_entry(nvbo, list, entry) {
|
||||||
struct drm_nouveau_gem_pushbuf_bo *b = &pbbo[nvbo->pbbo_index];
|
struct drm_nouveau_gem_pushbuf_bo *b = &pbbo[nvbo->pbbo_index];
|
||||||
|
|
||||||
ret = nouveau_fence_sync(nvbo->bo.sync_obj, chan);
|
ret = validate_sync(chan, nvbo);
|
||||||
if (unlikely(ret)) {
|
if (unlikely(ret)) {
|
||||||
NV_ERROR(dev, "fail pre-validate sync\n");
|
NV_ERROR(dev, "fail pre-validate sync\n");
|
||||||
return ret;
|
return ret;
|
||||||
|
@ -416,7 +435,7 @@ validate_list(struct nouveau_channel *chan, struct list_head *list,
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
ret = nouveau_fence_sync(nvbo->bo.sync_obj, chan);
|
ret = validate_sync(chan, nvbo);
|
||||||
if (unlikely(ret)) {
|
if (unlikely(ret)) {
|
||||||
NV_ERROR(dev, "fail post-validate sync\n");
|
NV_ERROR(dev, "fail post-validate sync\n");
|
||||||
return ret;
|
return ret;
|
||||||
|
|
Loading…
Reference in a new issue