From patchwork Tue Jun 9 09:19:26 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chris Wilson X-Patchwork-Id: 6570561 Return-Path: X-Original-To: patchwork-intel-gfx@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 8D5849F2F4 for ; Tue, 9 Jun 2015 09:20:07 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id A0A452049E for ; Tue, 9 Jun 2015 09:20:06 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) by mail.kernel.org (Postfix) with ESMTP id 1350420497 for ; Tue, 9 Jun 2015 09:20:05 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 1D5416E1E6; Tue, 9 Jun 2015 02:20:04 -0700 (PDT) X-Original-To: intel-gfx@lists.freedesktop.org Delivered-To: intel-gfx@lists.freedesktop.org Received: from fireflyinternet.com (mail.fireflyinternet.com [87.106.93.118]) by gabe.freedesktop.org (Postfix) with ESMTP id DAE8B6E1E6 for ; Tue, 9 Jun 2015 02:20:01 -0700 (PDT) X-Default-Received-SPF: pass (skip=forwardok (res=PASS)) x-ip-name=78.156.65.138; Received: from haswell.alporthouse.com (unverified [78.156.65.138]) by fireflyinternet.com (Firefly Internet (M1)) with ESMTP id 40882241-1500048 for multiple; Tue, 09 Jun 2015 10:19:37 +0100 Received: by haswell.alporthouse.com (sSMTP sendmail emulation); Tue, 09 Jun 2015 10:19:27 +0100 From: Chris Wilson To: intel-gfx@lists.freedesktop.org Date: Tue, 9 Jun 2015 10:19:26 +0100 Message-Id: <1433841566-1957-1-git-send-email-chris@chris-wilson.co.uk> X-Mailer: git-send-email 2.1.4 X-Originating-IP: 78.156.65.138 X-Country: code=GB country="United Kingdom" ip=78.156.65.138 Cc: stable@vger.kernel.org Subject: [Intel-gfx] [PATCH] drm/i915: Mark the final obj->pages sg entry as last X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" X-Spam-Status: No, score=-4.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_MED, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Currently we may mark the subsequent sg entry as the last, instead of the actual last element we used. If a later iterator only used sg_is_last() (such as sg_next()) then we may access the NULL page stored in the elements beyond the contracted table. This may explain the occasional NULL dereference we see in insert pages, such as https://bugzilla.redhat.com/show_bug.cgi?id=1227892 Signed-off-by: Chris Wilson Cc: Imre Deak Cc: stable@vger.kernel.org --- drivers/gpu/drm/i915/i915_gem.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index be35f0486202..f3b66461dc68 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -2195,7 +2195,7 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj) int page_count, i; struct address_space *mapping; struct sg_table *st; - struct scatterlist *sg; + struct scatterlist *sg, *end; struct sg_page_iter sg_iter; struct page *page; unsigned long last_pfn = 0; /* suppress gcc warning */ @@ -2227,7 +2227,7 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj) gfp = mapping_gfp_mask(mapping); gfp |= __GFP_NORETRY | __GFP_NOWARN | __GFP_NO_KSWAPD; gfp &= ~(__GFP_IO | __GFP_WAIT); - sg = st->sgl; + end = sg = st->sgl; st->nents = 0; for (i = 0; i < page_count; i++) { page = shmem_read_mapping_page_gfp(mapping, i, gfp); @@ -2253,13 +2253,13 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj) if (swiotlb_nr_tbl()) { st->nents++; sg_set_page(sg, page, PAGE_SIZE, 0); - sg = sg_next(sg); + sg = sg_next(end = sg); continue; } #endif if (!i || page_to_pfn(page) != last_pfn + 1) { if (i) - sg = sg_next(sg); + sg = sg_next(end = sg); st->nents++; sg_set_page(sg, page, PAGE_SIZE, 0); } else { @@ -2273,7 +2273,7 @@ i915_gem_object_get_pages_gtt(struct drm_i915_gem_object *obj) #ifdef CONFIG_SWIOTLB if (!swiotlb_nr_tbl()) #endif - sg_mark_end(sg); + sg_mark_end(end); obj->pages = st; if (i915_gem_object_needs_bit17_swizzle(obj))