Skip to content
  1. Jul 08, 2021
  2. Jul 07, 2021
  3. Jul 06, 2021
  4. Jul 05, 2021
  5. Jul 02, 2021
  6. Jul 01, 2021
  7. Jun 30, 2021
    • Mikel Rychliski's avatar
      drm/radeon: Fix NULL dereference when updating memory stats · 60f3c604
      Mikel Rychliski authored
      radeon_ttm_bo_destroy() is attempting to access the resource object to
      update memory counters. However, the resource object is already freed when
      ttm calls this function via the destroy callback. This causes an oops when
      a bo is freed:
      
      	BUG: kernel NULL pointer dereference, address: 0000000000000010
      	RIP: 0010:radeon_ttm_bo_destroy+0x2c/0x100 [radeon]
      	Call Trace:
      	 radeon_bo_unref+0x1a/0x30 [radeon]
      	 radeon_gem_object_free+0x33/0x50 [radeon]
      	 drm_gem_object_release_handle+0x69/0x70 [drm]
      	 drm_gem_handle_delete+0x62/0xa0 [drm]
      	 ? drm_mode_destroy_dumb+0x40/0x40 [drm]
      	 drm_ioctl_kernel+0xb2/0xf0 [drm]
      	 drm_ioctl+0x30a/0x3c0 [drm]
      	 ? drm_mode_destroy_dumb+0x40/0x40 [drm]
      	 radeon_drm_ioctl+0x49/0x80 [radeon]
      	 __x64_sys_ioctl+0x8e/0xd0
      
      Avoid the issue by updating the counters in the delete_mem_notify callback
      instead. Also, fix memory statistic updating in radeon_bo_move() to
      identify the source type correctly. The source type needs to be saved
      before the move, because the moved from object may be altered by the move.
      
      Fixes: bfa3357e
      
       ("drm/ttm: allocate resource object instead of embedding it v2")
      Signed-off-by: default avatarMikel Rychliski <mikel@mikelr.com>
      Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarChristian König <christian.koenig@amd.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20210624045121.15643-1-mikel@mikelr.com
      60f3c604
  8. Jun 29, 2021