Bug 101534 - [HSW] NULL pointer dereference in intel_fbdev_invalidate
Summary: [HSW] NULL pointer dereference in intel_fbdev_invalidate
Status: CLOSED FIXED
Alias: None
Product: DRI
Classification: Unclassified
Component: DRM/Intel (show other bugs)
Version: unspecified
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Intel GFX Bugs mailing list
QA Contact: Intel GFX Bugs mailing list
URL:
Whiteboard: PatchMerged
Keywords:
Depends on:
Blocks:
 
Reported: 2017-06-21 10:49 UTC by eryngion
Modified: 2017-07-27 16:55 UTC (History)
1 user (show)

See Also:
i915 platform: HSW
i915 features: display/Other


Attachments
dmesg.log (124.59 KB, text/x-log)
2017-06-21 10:49 UTC, eryngion
no flags Details
Xorg.log (3.24 KB, text/x-log)
2017-06-21 10:51 UTC, eryngion
no flags Details
dmesg with drm.debug=0x1e (157.99 KB, text/x-log)
2017-06-21 11:07 UTC, eryngion
no flags Details

Description eryngion 2017-06-21 10:49:41 UTC
Created attachment 132111 [details]
dmesg.log

With no additional options I'm hitting this bug every fifth or so boot on the start of X. And with acpi_osi=!Darwin acpi_osi='Windows 2012' I'm NOT hitting it in only one boot in five. Full dmesg with drm.debug=0xe attached.

kernel version: 4.12.0-rc6
distribution: Gentoo
Machine model: MacBookPro11,2
Comment 1 eryngion 2017-06-21 10:51:26 UTC
Created attachment 132112 [details]
Xorg.log
Comment 2 eryngion 2017-06-21 11:07:05 UTC
Created attachment 132113 [details]
dmesg with drm.debug=0x1e
Comment 3 Elizabeth 2017-06-22 15:41:49 UTC
Adding tag into "Whiteboard" field - ReadyForDev
*Status is correct
*Platform is included
*Feature is included
*Priority and Severity correctly set
*Logs included
Comment 4 Chris Wilson 2017-06-22 15:53:02 UTC
diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
index 03347c6ae599..7ffbd17fa692 100644
--- a/drivers/gpu/drm/i915/intel_fbdev.c
+++ b/drivers/gpu/drm/i915/intel_fbdev.c
@@ -765,7 +765,7 @@ void intel_fbdev_set_suspend(struct drm_device *dev, int state, bool synchronous
        struct intel_fbdev *ifbdev = dev_priv->fbdev;
        struct fb_info *info;
 
-       if (!ifbdev || !ifbdev->fb)
+       if (!ifbdev || !ifbdev->vma)
                return;
 
        info = ifbdev->helper.fbdev;
@@ -812,7 +812,7 @@ void intel_fbdev_output_poll_changed(struct drm_device *dev)
 {
        struct intel_fbdev *ifbdev = to_i915(dev)->fbdev;
 
-       if (ifbdev && ifbdev->fb)
+       if (ifbdev && ifbdev->vma)
                drm_fb_helper_hotplug_event(&ifbdev->helper);
 }
 
@@ -824,7 +824,7 @@ void intel_fbdev_restore_mode(struct drm_device *dev)
                return;
 
        intel_fbdev_sync(ifbdev);
-       if (!ifbdev->fb)
+       if (!ifbdev->vma)
                return;
 
        if (drm_fb_helper_restore_fbdev_mode_unlocked(&ifbdev->helper) == 0)
Comment 5 eryngion 2017-06-24 13:00:06 UTC
Yep, that helps. Thanks!
Comment 6 Elizabeth 2017-06-28 15:59:07 UTC
(In reply to eryngion from comment #5)
> Yep, that helps. Thanks!

Hello Chris,
(In reply to Chris Wilson from comment #4)
> diff --git a/drivers/gpu/drm/i915/intel_fbdev.c
> 
This seems to fix the problem, what should be the next step in this case? Thank you.
Comment 7 Chris Wilson 2017-07-04 12:18:38 UTC
commit 15727ed0d944ce1dec8b9e1082dd3df29a0fdf44
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Thu Jun 22 17:02:11 2017 +0100

    drm/i915/fbdev: Check for existence of ifbdev->vma before operations
    
    Commit fabef825626d ("drm/i915: Drop struct_mutex around frontbuffer
    flushes") adds a dependency to ifbdev->vma when flushing the framebufer,
    but the checks are only against the existence of the ifbdev->fb and not
    against ifbdev->vma. This leaves a window of opportunity where we may
    try to operate on the fbdev prior to it being probed (thanks to
    asynchronous booting).
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101534
    Fixes: fabef825626d ("drm/i915: Drop struct_mutex around frontbuffer flushes")
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
    Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
    Cc: Daniel Vetter <daniel.vetter@intel.com>
    Link: http://patchwork.freedesktop.org/patch/msgid/20170622160211.783-1-chris@chris-wilson.co.uk
    Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
    Cc: stable@vger.kernel.org


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.