From patchwork Sun Sep 25 20:34:46 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Grazvydas Ignotas X-Patchwork-Id: 9349913 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 96FEC607F0 for ; Sun, 25 Sep 2016 20:35:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 890022885B for ; Sun, 25 Sep 2016 20:35:01 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7B9F428C7B; Sun, 25 Sep 2016 20:35:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 21C812885B for ; Sun, 25 Sep 2016 20:35:01 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 5239F6E264; Sun, 25 Sep 2016 20:35:00 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-wm0-x244.google.com (mail-wm0-x244.google.com [IPv6:2a00:1450:400c:c09::244]) by gabe.freedesktop.org (Postfix) with ESMTPS id DA1CD6E263; Sun, 25 Sep 2016 20:34:58 +0000 (UTC) Received: by mail-wm0-x244.google.com with SMTP id b184so11210291wma.3; Sun, 25 Sep 2016 13:34:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=qE7aZyxBEP3ljVvSXOkrkAfcozB7Fj5mGOXNsrihdGY=; b=0wd24o5wGz/z4g1skVauNrITz8sR/tEiDZEiVQ2QZluW6Jfe20GqQsel43QKOChKoU 7KWaXN+AwNcggkEK8PstDpBGJ8ANltz+7YVUPO35sB3SC8Z1bgH2qLZGXWHMs9W0berL cmL1DSv17WWzwimCU6B1eVGqgzqvww5oNT8cNmy5ng2+FWEpY823y424GhE0+Jzj4JyZ zix3B8Q3kHh9goEi4JaS3B9jWlqPU+UkjsGLD+k6ZcrusXxNVnoQlXAzcKKnwg15jVZj wNPmVmuk0PSE0WQYcgwvHjzY6IYq8S5Edqc/emA8uo64wJMp08heHvVZzxeLdUiJu/6C Xx2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=qE7aZyxBEP3ljVvSXOkrkAfcozB7Fj5mGOXNsrihdGY=; b=BhZTX/Fsa5h+Nmhv1XfKFwvvuMlSpVvZ23WvuGfs3tuLxJ+pagO2Tk9JRAAOyacsEw cGoz2UpzU4N+ULlhhiJhkdoGOiTV/M5y8ygengbCj4QNDfCOq6CcS06RUqlS3Ttj9kdi UM7cl5wXi32+WTlyg47zDrX3eRFzLBJTQFU3A9HfaSfQAeT3aSC8efTRYky4oc7FIth2 IgHAHBtrFyhKHmOqFmFAwcIYzpHYpk8z3mT6NFmNYvOk8YJcDgezK/JxCgIDALN6803K 3pn8CcFxDtOVs3GtzdPo4bMpV0l8ctUxtfRYbHvuH4gM9eBn8tIRqDD4HKAZ/nuwMBA4 bG6g== X-Gm-Message-State: AA6/9RlfbNulNd24E/fhARHaNIpy91mbYqkVEsADYXIaT0Na0RwzjDZ+8M56lu9875XmyQ== X-Received: by 10.28.133.12 with SMTP id h12mr12337561wmd.74.1474835697308; Sun, 25 Sep 2016 13:34:57 -0700 (PDT) Received: from localhost.localdomain ([5.20.238.37]) by smtp.gmail.com with ESMTPSA id a1sm18673649wju.41.2016.09.25.13.34.56 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 25 Sep 2016 13:34:56 -0700 (PDT) From: Grazvydas Ignotas To: dri-devel@lists.freedesktop.org, amd-gfx@lists.freedesktop.org Subject: [PATCH] drm/amdgpu: don't leave dangling pointers around Date: Sun, 25 Sep 2016 23:34:46 +0300 Message-Id: <1474835690-2621-1-git-send-email-notasas@gmail.com> X-Mailer: git-send-email 2.7.4 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP Right now it's possible to trigger fence_drv.fences[] dereference after the array has been freed. While the real problem is elsewhere, this still results in confusing errors that depend on how the freed memory was reused (I've seen "kernel tried to execute NX-protected page"), it's better to clear them and get NULL dereference so that it's obvious what's going wrong. Signed-off-by: Grazvydas Ignotas --- drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c | 2 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 1 + 2 files changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c index 17e1362..e203e55 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ctx.c @@ -60,6 +60,7 @@ static int amdgpu_ctx_init(struct amdgpu_device *adev, struct amdgpu_ctx *ctx) amd_sched_entity_fini(&adev->rings[j]->sched, &ctx->rings[j].entity); kfree(ctx->fences); + ctx->fences = NULL; return r; } return 0; @@ -77,6 +78,7 @@ static void amdgpu_ctx_fini(struct amdgpu_ctx *ctx) for (j = 0; j < amdgpu_sched_jobs; ++j) fence_put(ctx->rings[i].fences[j]); kfree(ctx->fences); + ctx->fences = NULL; for (i = 0; i < adev->num_rings; i++) amd_sched_entity_fini(&adev->rings[i]->sched, diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c index 0b109ae..3a2e42f 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c @@ -454,6 +454,7 @@ void amdgpu_fence_driver_fini(struct amdgpu_device *adev) for (j = 0; j <= ring->fence_drv.num_fences_mask; ++j) fence_put(ring->fence_drv.fences[j]); kfree(ring->fence_drv.fences); + ring->fence_drv.fences = NULL; ring->fence_drv.initialized = false; } }