| Summary: | [BAT][SKL][GVT-d] igt@drv_module_reload@basic-reload-inject produces a general protection fault | ||
|---|---|---|---|
| Product: | DRI | Reporter: | Martin Peres <martin.peres> |
| Component: | DRM/Intel | Assignee: | Daniel Vetter <daniel> |
| Status: | CLOSED FIXED | QA Contact: | Intel GFX Bugs mailing list <intel-gfx-bugs> |
| Severity: | critical | ||
| Priority: | highest | CC: | intel-gfx-bugs |
| Version: | DRI git | ||
| Hardware: | Other | ||
| OS: | All | ||
| Whiteboard: | ReadyForDev | ||
| i915 platform: | SKL | i915 features: | power/Other |
|
Description
Martin Peres
2017-07-14 14:48:58 UTC
It's a use after free (kasan where are you!) in the async fbdev paths. CI_DRM_2726 was: mmit 346fb4e0b9660e2fe888f870608d287e1980f665 Author: Daniel Vetter <daniel.vetter@ffwll.ch> Date: Thu Jul 6 15:00:20 2017 +0200 drm/i915: Protect against deferred fbdev setup We could probably hit this already with our current async fbdev init, but it's much easier to hit this with the new deferred fbdev setup that I'm working on polishing. Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reported-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Link: http://patchwork.freedesktop.org/patch/msgid/20170706130023.28417-2-daniel.vetter@ffwll.ch commit 88be58be886f1215cc73dc8c273c985eecd7385c Author: Daniel Vetter <daniel.vetter@ffwll.ch> Date: Thu Jul 6 15:00:19 2017 +0200 drm/i915/fbdev: Always forward hotplug events With deferred fbdev setup we always need to forward hotplug events, even if fbdev isn't fully set up yet. Otherwise the deferred setup will neer happen. Originally this check was added in commit c45eb4fed12d278d3619f1904885bd0d7bcbf036 (tag: drm-intel-next-fixes-2016-08-05) Author: Chris Wilson <chris@chris-wilson.co.uk> Date: Wed Jul 13 18:34:45 2016 +0100 drm/i915/fbdev: Check for the framebuffer before use But the specific case of the hotplug function blowing up was fixed in commit 50c3dc970a09b3b60422a58934cc27a413288bab Author: Daniel Vetter <daniel.vetter@ffwll.ch> Date: Fri Jun 27 17:19:22 2014 +0200 drm/fb-helper: Fix hpd vs. initial config races Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Mika Kuoppala <mika.kuoppala@intel.com> Cc: Chris Wilson <chris@chris-wilson.co.uk> Reviewed-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Link: http://patchwork.freedesktop.org/patch/msgid/20170706130023.28417-1-daniel.vetter@ffwll.ch drm_setup_crtcs+0x144 any way to decode that into a line in a source somewhere? Hm, unload kills the fbdev before we stop the poll work. That's not going to end well. Pretty sure this was broken in commit 2013bfc0238b9a77f7e9223aed03b1cef1b5cc34 Author: Ville Syrjälä <ville.syrjala@linux.intel.com> Date: Fri Nov 6 15:08:32 2015 +0200 drm/i915: Do fbdev fini first during unload There's full comments explaining even why this is not a good idea. I'll fix this up properly by unregistering first and cleanup later on. Looking at that patch again, it is essentially saying it wants the async_synchronize_full() first (now intel_fbdev_sync()). And indeed, calling fini before unregister is prone to disappoints like this. https://patchwork.freedesktop.org/series/27327/ This shold fix it. Daniel re-sent an updated patchset: https://patchwork.freedesktop.org/series/27337/ The tests are passing now, waiting for the review to happen. Should be fixed with commit 4f256d8219f230cb11b49343931dc0b2fa8bd149 Author: Daniel Vetter <daniel.vetter@ffwll.ch> Date: Sat Jul 15 00:46:55 2017 +0200 drm/i915: Fix fbdev unload sequence Thanks, looks good! |
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.