From: "Bhardwaj, Rajneesh" <Rajneesh.Bhardwaj@amd.com>
To: Steven Rostedt <rostedt@goodmis.org>,
LKML <linux-kernel@vger.kernel.org>
Cc: "Kuehling, Felix" <Felix.Kuehling@amd.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
"Koenig, Christian" <Christian.Koenig@amd.com>,
"dri-devel@lists.freedesktop.org"
<dri-devel@lists.freedesktop.org>
Subject: RE: [BUG] BUG: kernel NULL pointer dereference at ttm_device_init+0xb4
Date: Tue, 23 Jan 2024 01:06:54 +0000 [thread overview]
Message-ID: <DS7PR12MB5933AD00B803A227CC197E00FE742@DS7PR12MB5933.namprd12.prod.outlook.com> (raw)
In-Reply-To: <20240122181901.05a3b9ab@gandalf.local.home>
[AMD Official Use Only - General]
-----Original Message-----
From: Steven Rostedt <rostedt@goodmis.org>
Sent: Monday, January 22, 2024 6:19 PM
To: LKML <linux-kernel@vger.kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>; Bhardwaj, Rajneesh <Rajneesh.Bhardwaj@amd.com>; Kuehling, Felix <Felix.Kuehling@amd.com>; Koenig, Christian <Christian.Koenig@amd.com>; dri-devel@lists.freedesktop.org
Subject: Re: [BUG] BUG: kernel NULL pointer dereference at ttm_device_init+0xb4
On Mon, 22 Jan 2024 18:15:47 -0500
Steven Rostedt <rostedt@goodmis.org> wrote:
> > ttm_pool_init(&bdev->pool, dev, dev_to_node(dev), use_dma_alloc, use_dma32); <<<------- BUG!
> >
> > Specifically, it appears that dev is NULL and dev_to_node() doesn't
> > like having a NULL pointer passed to it.
> >
>
> Yeah, that qxl_ttm_init() has:
>
> /* No others user of address space so set it to 0 */
> r = ttm_device_init(&qdev->mman.bdev, &qxl_bo_driver, NULL,
> qdev->ddev.anon_inode->i_mapping,
> qdev->ddev.vma_offset_manager,
> false, false);
>
> Where that NULL is "dev"!
>
> Thus that will never work here.
Perhaps this is the real fix?
I think the fix might be already applied to drm misc. Please see, https://lkml.iu.edu/hypermail/linux/kernel/2401.1/06778.html
-- Steve
diff --git a/drivers/gpu/drm/ttm/ttm_device.c b/drivers/gpu/drm/ttm/ttm_device.c
index f5187b384ae9..bc217b4d6b04 100644
--- a/drivers/gpu/drm/ttm/ttm_device.c
+++ b/drivers/gpu/drm/ttm/ttm_device.c
@@ -215,7 +215,8 @@ int ttm_device_init(struct ttm_device *bdev, const struct ttm_device_funcs *func
ttm_sys_man_init(bdev);
- ttm_pool_init(&bdev->pool, dev, dev_to_node(dev), use_dma_alloc, use_dma32);
+ ttm_pool_init(&bdev->pool, dev, dev ? dev_to_node(dev) : NUMA_NO_NODE,
+ use_dma_alloc, use_dma32);
bdev->vma_manager = vma_manager;
spin_lock_init(&bdev->lru_lock);
WARNING: multiple messages have this Message-ID (diff)
From: "Bhardwaj, Rajneesh" <Rajneesh.Bhardwaj@amd.com>
To: Steven Rostedt <rostedt@goodmis.org>,
LKML <linux-kernel@vger.kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
"Kuehling, Felix" <Felix.Kuehling@amd.com>,
"Koenig, Christian" <Christian.Koenig@amd.com>,
"dri-devel@lists.freedesktop.org"
<dri-devel@lists.freedesktop.org>
Subject: RE: [BUG] BUG: kernel NULL pointer dereference at ttm_device_init+0xb4
Date: Tue, 23 Jan 2024 01:06:54 +0000 [thread overview]
Message-ID: <DS7PR12MB5933AD00B803A227CC197E00FE742@DS7PR12MB5933.namprd12.prod.outlook.com> (raw)
In-Reply-To: <20240122181901.05a3b9ab@gandalf.local.home>
[AMD Official Use Only - General]
-----Original Message-----
From: Steven Rostedt <rostedt@goodmis.org>
Sent: Monday, January 22, 2024 6:19 PM
To: LKML <linux-kernel@vger.kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>; Bhardwaj, Rajneesh <Rajneesh.Bhardwaj@amd.com>; Kuehling, Felix <Felix.Kuehling@amd.com>; Koenig, Christian <Christian.Koenig@amd.com>; dri-devel@lists.freedesktop.org
Subject: Re: [BUG] BUG: kernel NULL pointer dereference at ttm_device_init+0xb4
On Mon, 22 Jan 2024 18:15:47 -0500
Steven Rostedt <rostedt@goodmis.org> wrote:
> > ttm_pool_init(&bdev->pool, dev, dev_to_node(dev), use_dma_alloc, use_dma32); <<<------- BUG!
> >
> > Specifically, it appears that dev is NULL and dev_to_node() doesn't
> > like having a NULL pointer passed to it.
> >
>
> Yeah, that qxl_ttm_init() has:
>
> /* No others user of address space so set it to 0 */
> r = ttm_device_init(&qdev->mman.bdev, &qxl_bo_driver, NULL,
> qdev->ddev.anon_inode->i_mapping,
> qdev->ddev.vma_offset_manager,
> false, false);
>
> Where that NULL is "dev"!
>
> Thus that will never work here.
Perhaps this is the real fix?
I think the fix might be already applied to drm misc. Please see, https://lkml.iu.edu/hypermail/linux/kernel/2401.1/06778.html
-- Steve
diff --git a/drivers/gpu/drm/ttm/ttm_device.c b/drivers/gpu/drm/ttm/ttm_device.c
index f5187b384ae9..bc217b4d6b04 100644
--- a/drivers/gpu/drm/ttm/ttm_device.c
+++ b/drivers/gpu/drm/ttm/ttm_device.c
@@ -215,7 +215,8 @@ int ttm_device_init(struct ttm_device *bdev, const struct ttm_device_funcs *func
ttm_sys_man_init(bdev);
- ttm_pool_init(&bdev->pool, dev, dev_to_node(dev), use_dma_alloc, use_dma32);
+ ttm_pool_init(&bdev->pool, dev, dev ? dev_to_node(dev) : NUMA_NO_NODE,
+ use_dma_alloc, use_dma32);
bdev->vma_manager = vma_manager;
spin_lock_init(&bdev->lru_lock);
next prev parent reply other threads:[~2024-01-23 1:06 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-01-22 23:06 [BUG] BUG: kernel NULL pointer dereference at ttm_device_init+0xb4 Steven Rostedt
2024-01-22 23:06 ` Steven Rostedt
2024-01-22 23:15 ` Steven Rostedt
2024-01-22 23:15 ` Steven Rostedt
2024-01-22 23:19 ` Steven Rostedt
2024-01-22 23:19 ` Steven Rostedt
2024-01-23 0:43 ` Linus Torvalds
2024-01-23 0:43 ` Linus Torvalds
2024-01-23 0:56 ` Bhardwaj, Rajneesh
2024-01-23 1:25 ` Linus Torvalds
2024-01-23 1:25 ` Linus Torvalds
2024-01-23 1:35 ` Steven Rostedt
2024-01-23 1:35 ` Steven Rostedt
2024-01-23 2:21 ` Dave Airlie
2024-01-23 2:21 ` Dave Airlie
2024-01-23 2:32 ` Dave Airlie
2024-01-23 2:32 ` Dave Airlie
2024-01-23 2:52 ` Steven Rostedt
2024-01-23 2:52 ` Steven Rostedt
2024-01-23 9:43 ` Christian König
2024-01-23 9:43 ` Christian König
2024-01-23 14:35 ` Steven Rostedt
2024-01-23 14:35 ` Steven Rostedt
2024-01-23 1:06 ` Bhardwaj, Rajneesh [this message]
2024-01-23 1:06 ` Bhardwaj, Rajneesh
2024-01-23 0:29 ` Bhardwaj, Rajneesh
2024-01-23 0:34 ` Steven Rostedt
2024-01-23 0:34 ` Steven Rostedt
2024-01-23 0:40 ` Bhardwaj, Rajneesh
2024-01-23 0:40 ` Bhardwaj, Rajneesh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DS7PR12MB5933AD00B803A227CC197E00FE742@DS7PR12MB5933.namprd12.prod.outlook.com \
--to=rajneesh.bhardwaj@amd.com \
--cc=Christian.Koenig@amd.com \
--cc=Felix.Kuehling@amd.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rostedt@goodmis.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.