[PATCH] drm/radeon: fix rare segfault after gpu lockup on r7xx

[j.gli...@gmail.com]

From: Jerome Glisse 

If GPU reset fails the gart table ptr might be NULL avoid a
kernel segfault in this rare event.

Signed-off-by: Jerome Glisse 
---
 drivers/gpu/drm/radeon/r600.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index cda280d..0e3a68a 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -843,7 +843,9 @@ void r600_pcie_gart_tlb_flush(struct radeon_device *rdev)
 * method for them.
 */
WREG32(HDP_DEBUG1, 0);
-   tmp = readl((void __iomem *)ptr);
+   if (ptr) {
+   tmp = readl((void __iomem *)ptr);
+   }
} else
WREG32(R_005480_HDP_MEM_COHERENCY_FLUSH_CNTL, 0x1);

-- 
1.7.11.7

[PATCH] drm/radeon: fix rare segfault after gpu lockup on r7xx

[j . glisse]

From: Jerome Glisse jgli...@redhat.com

If GPU reset fails the gart table ptr might be NULL avoid a
kernel segfault in this rare event.

Signed-off-by: Jerome Glisse jgli...@redhat.com
---
 drivers/gpu/drm/radeon/r600.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index cda280d..0e3a68a 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -843,7 +843,9 @@ void r600_pcie_gart_tlb_flush(struct radeon_device *rdev)
 * method for them.
 */
WREG32(HDP_DEBUG1, 0);
-   tmp = readl((void __iomem *)ptr);
+   if (ptr) {
+   tmp = readl((void __iomem *)ptr);
+   }
} else
WREG32(R_005480_HDP_MEM_COHERENCY_FLUSH_CNTL, 0x1);
 
-- 
1.7.11.7

___
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel

[PATCH] drm/radeon: fix rare segfault

[Christian König]

On 02.07.2012 18:40, j.glisse at gmail.com wrote:
> From: Jerome Glisse 
>
> In gem idle/busy ioctl the radeon object was derefenced after
> drm_gem_object_unreference_unlocked which in case the object
> have been destroyed lead to use of a possibly free pointer with
> possibly wrong data.
>
> Signed-off-by: Jerome Glisse 

Reviewed-by: Christian K?nig 

> ---
>   drivers/gpu/drm/radeon/radeon_gem.c |   10 ++
>   1 file changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/radeon/radeon_gem.c 
> b/drivers/gpu/drm/radeon/radeon_gem.c
> index 74176c5..c8838fc 100644
> --- a/drivers/gpu/drm/radeon/radeon_gem.c
> +++ b/drivers/gpu/drm/radeon/radeon_gem.c
> @@ -325,6 +325,7 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void 
> *data,
>   int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
> struct drm_file *filp)
>   {
> + struct radeon_device *rdev = dev->dev_private;
>   struct drm_radeon_gem_busy *args = data;
>   struct drm_gem_object *gobj;
>   struct radeon_bo *robj;
> @@ -350,13 +351,14 @@ int radeon_gem_busy_ioctl(struct drm_device *dev, void 
> *data,
>   break;
>   }
>   drm_gem_object_unreference_unlocked(gobj);
> - r = radeon_gem_handle_lockup(robj->rdev, r);
> + r = radeon_gem_handle_lockup(rdev, r);
>   return r;
>   }
>   
>   int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
> struct drm_file *filp)
>   {
> + struct radeon_device *rdev = dev->dev_private;
>   struct drm_radeon_gem_wait_idle *args = data;
>   struct drm_gem_object *gobj;
>   struct radeon_bo *robj;
> @@ -369,10 +371,10 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, 
> void *data,
>   robj = gem_to_radeon_bo(gobj);
>   r = radeon_bo_wait(robj, NULL, false);
>   /* callback hw specific functions if any */
> - if (robj->rdev->asic->ioctl_wait_idle)
> - robj->rdev->asic->ioctl_wait_idle(robj->rdev, robj);
> + if (rdev->asic->ioctl_wait_idle)
> + robj->rdev->asic->ioctl_wait_idle(rdev, robj);
>   drm_gem_object_unreference_unlocked(gobj);
> - r = radeon_gem_handle_lockup(robj->rdev, r);
> + r = radeon_gem_handle_lockup(rdev, r);
>   return r;
>   }
>   

[PATCH] drm/radeon: fix rare segfault

[Alex Deucher]

On Mon, Jul 2, 2012 at 12:40 PM,   wrote:
> From: Jerome Glisse 
>
> In gem idle/busy ioctl the radeon object was derefenced after
> drm_gem_object_unreference_unlocked which in case the object
> have been destroyed lead to use of a possibly free pointer with
> possibly wrong data.
>
> Signed-off-by: Jerome Glisse 

Reviewed-by: Alex Deucher 

> ---
>  drivers/gpu/drm/radeon/radeon_gem.c |   10 ++
>  1 file changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/radeon/radeon_gem.c 
> b/drivers/gpu/drm/radeon/radeon_gem.c
> index 74176c5..c8838fc 100644
> --- a/drivers/gpu/drm/radeon/radeon_gem.c
> +++ b/drivers/gpu/drm/radeon/radeon_gem.c
> @@ -325,6 +325,7 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void 
> *data,
>  int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
>   struct drm_file *filp)
>  {
> +   struct radeon_device *rdev = dev->dev_private;
> struct drm_radeon_gem_busy *args = data;
> struct drm_gem_object *gobj;
> struct radeon_bo *robj;
> @@ -350,13 +351,14 @@ int radeon_gem_busy_ioctl(struct drm_device *dev, void 
> *data,
> break;
> }
> drm_gem_object_unreference_unlocked(gobj);
> -   r = radeon_gem_handle_lockup(robj->rdev, r);
> +   r = radeon_gem_handle_lockup(rdev, r);
> return r;
>  }
>
>  int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
>   struct drm_file *filp)
>  {
> +   struct radeon_device *rdev = dev->dev_private;
> struct drm_radeon_gem_wait_idle *args = data;
> struct drm_gem_object *gobj;
> struct radeon_bo *robj;
> @@ -369,10 +371,10 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, 
> void *data,
> robj = gem_to_radeon_bo(gobj);
> r = radeon_bo_wait(robj, NULL, false);
> /* callback hw specific functions if any */
> -   if (robj->rdev->asic->ioctl_wait_idle)
> -   robj->rdev->asic->ioctl_wait_idle(robj->rdev, robj);
> +   if (rdev->asic->ioctl_wait_idle)
> +   robj->rdev->asic->ioctl_wait_idle(rdev, robj);
> drm_gem_object_unreference_unlocked(gobj);
> -   r = radeon_gem_handle_lockup(robj->rdev, r);
> +   r = radeon_gem_handle_lockup(rdev, r);
> return r;
>  }
>
> --
> 1.7.10.2
>
> ___
> dri-devel mailing list
> dri-devel at lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/dri-devel

[PATCH] drm/radeon: fix rare segfault

[j.gli...@gmail.com]

From: Jerome Glisse 

In gem idle/busy ioctl the radeon object was derefenced after
drm_gem_object_unreference_unlocked which in case the object
have been destroyed lead to use of a possibly free pointer with
possibly wrong data.

Signed-off-by: Jerome Glisse 
---
 drivers/gpu/drm/radeon/radeon_gem.c |   10 ++
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/radeon/radeon_gem.c 
b/drivers/gpu/drm/radeon/radeon_gem.c
index 74176c5..c8838fc 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -325,6 +325,7 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void 
*data,
 int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
  struct drm_file *filp)
 {
+   struct radeon_device *rdev = dev->dev_private;
struct drm_radeon_gem_busy *args = data;
struct drm_gem_object *gobj;
struct radeon_bo *robj;
@@ -350,13 +351,14 @@ int radeon_gem_busy_ioctl(struct drm_device *dev, void 
*data,
break;
}
drm_gem_object_unreference_unlocked(gobj);
-   r = radeon_gem_handle_lockup(robj->rdev, r);
+   r = radeon_gem_handle_lockup(rdev, r);
return r;
 }

 int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
  struct drm_file *filp)
 {
+   struct radeon_device *rdev = dev->dev_private;
struct drm_radeon_gem_wait_idle *args = data;
struct drm_gem_object *gobj;
struct radeon_bo *robj;
@@ -369,10 +371,10 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, 
void *data,
robj = gem_to_radeon_bo(gobj);
r = radeon_bo_wait(robj, NULL, false);
/* callback hw specific functions if any */
-   if (robj->rdev->asic->ioctl_wait_idle)
-   robj->rdev->asic->ioctl_wait_idle(robj->rdev, robj);
+   if (rdev->asic->ioctl_wait_idle)
+   robj->rdev->asic->ioctl_wait_idle(rdev, robj);
drm_gem_object_unreference_unlocked(gobj);
-   r = radeon_gem_handle_lockup(robj->rdev, r);
+   r = radeon_gem_handle_lockup(rdev, r);
return r;
 }

-- 
1.7.10.2

[PATCH] drm/radeon: fix rare segfault

[j . glisse]

From: Jerome Glisse jgli...@redhat.com

In gem idle/busy ioctl the radeon object was derefenced after
drm_gem_object_unreference_unlocked which in case the object
have been destroyed lead to use of a possibly free pointer with
possibly wrong data.

Signed-off-by: Jerome Glisse jgli...@redhat.com
---
 drivers/gpu/drm/radeon/radeon_gem.c |   10 ++
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/radeon/radeon_gem.c 
b/drivers/gpu/drm/radeon/radeon_gem.c
index 74176c5..c8838fc 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -325,6 +325,7 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void 
*data,
 int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
  struct drm_file *filp)
 {
+   struct radeon_device *rdev = dev-dev_private;
struct drm_radeon_gem_busy *args = data;
struct drm_gem_object *gobj;
struct radeon_bo *robj;
@@ -350,13 +351,14 @@ int radeon_gem_busy_ioctl(struct drm_device *dev, void 
*data,
break;
}
drm_gem_object_unreference_unlocked(gobj);
-   r = radeon_gem_handle_lockup(robj-rdev, r);
+   r = radeon_gem_handle_lockup(rdev, r);
return r;
 }
 
 int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
  struct drm_file *filp)
 {
+   struct radeon_device *rdev = dev-dev_private;
struct drm_radeon_gem_wait_idle *args = data;
struct drm_gem_object *gobj;
struct radeon_bo *robj;
@@ -369,10 +371,10 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, 
void *data,
robj = gem_to_radeon_bo(gobj);
r = radeon_bo_wait(robj, NULL, false);
/* callback hw specific functions if any */
-   if (robj-rdev-asic-ioctl_wait_idle)
-   robj-rdev-asic-ioctl_wait_idle(robj-rdev, robj);
+   if (rdev-asic-ioctl_wait_idle)
+   robj-rdev-asic-ioctl_wait_idle(rdev, robj);
drm_gem_object_unreference_unlocked(gobj);
-   r = radeon_gem_handle_lockup(robj-rdev, r);
+   r = radeon_gem_handle_lockup(rdev, r);
return r;
 }
 
-- 
1.7.10.2

___
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH] drm/radeon: fix rare segfault

[Alex Deucher]

On Mon, Jul 2, 2012 at 12:40 PM,  j.gli...@gmail.com wrote:
 From: Jerome Glisse jgli...@redhat.com

 In gem idle/busy ioctl the radeon object was derefenced after
 drm_gem_object_unreference_unlocked which in case the object
 have been destroyed lead to use of a possibly free pointer with
 possibly wrong data.

 Signed-off-by: Jerome Glisse jgli...@redhat.com

Reviewed-by: Alex Deucher alexander.deuc...@amd.com

 ---
  drivers/gpu/drm/radeon/radeon_gem.c |   10 ++
  1 file changed, 6 insertions(+), 4 deletions(-)

 diff --git a/drivers/gpu/drm/radeon/radeon_gem.c 
 b/drivers/gpu/drm/radeon/radeon_gem.c
 index 74176c5..c8838fc 100644
 --- a/drivers/gpu/drm/radeon/radeon_gem.c
 +++ b/drivers/gpu/drm/radeon/radeon_gem.c
 @@ -325,6 +325,7 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void 
 *data,
  int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
   struct drm_file *filp)
  {
 +   struct radeon_device *rdev = dev-dev_private;
 struct drm_radeon_gem_busy *args = data;
 struct drm_gem_object *gobj;
 struct radeon_bo *robj;
 @@ -350,13 +351,14 @@ int radeon_gem_busy_ioctl(struct drm_device *dev, void 
 *data,
 break;
 }
 drm_gem_object_unreference_unlocked(gobj);
 -   r = radeon_gem_handle_lockup(robj-rdev, r);
 +   r = radeon_gem_handle_lockup(rdev, r);
 return r;
  }

  int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
   struct drm_file *filp)
  {
 +   struct radeon_device *rdev = dev-dev_private;
 struct drm_radeon_gem_wait_idle *args = data;
 struct drm_gem_object *gobj;
 struct radeon_bo *robj;
 @@ -369,10 +371,10 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, 
 void *data,
 robj = gem_to_radeon_bo(gobj);
 r = radeon_bo_wait(robj, NULL, false);
 /* callback hw specific functions if any */
 -   if (robj-rdev-asic-ioctl_wait_idle)
 -   robj-rdev-asic-ioctl_wait_idle(robj-rdev, robj);
 +   if (rdev-asic-ioctl_wait_idle)
 +   robj-rdev-asic-ioctl_wait_idle(rdev, robj);
 drm_gem_object_unreference_unlocked(gobj);
 -   r = radeon_gem_handle_lockup(robj-rdev, r);
 +   r = radeon_gem_handle_lockup(rdev, r);
 return r;
  }

 --
 1.7.10.2

 ___
 dri-devel mailing list
 dri-devel@lists.freedesktop.org
 http://lists.freedesktop.org/mailman/listinfo/dri-devel
___
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel