search for: nouveau_abi16_fini

This series fixes a number of use-after-frees in nouveau's postclose() handler. It was discovered by pointing IGT's core_hotunplug tests at a nouveau device, but the steps to reproduce it are simple: 1. Open the device file 2. Unbind the driver or remove the device 3. Close the file opened in step 1. During the device removal, the nouveau_drm structure is de-allocated, but is

...e0 [nouveau] drm_gem_object_free+0x29/0x70 [drm] drm_gem_object_unreference_unlocked+0x34/0x80 [drm] drm_gem_object_handle_unreference_unlocked+0x69/0xc0 [drm] drm_gem_object_release_handle+0x53/0x90 [drm] ? drm_gem_object_handle_unreference_unlocked+0xc0/0xc0 [drm] idr_for_each+0xa4/0x100 ? nouveau_abi16_fini+0x50/0x70 [nouveau] drm_gem_release+0x20/0x30 [drm] drm_release+0x33d/0x390 [drm] __fput+0xdf/0x1e0 ____fput+0xe/0x10 task_work_run+0x76/0x90 do_exit+0x2d0/0xb70 ? __do_page_fault+0x267/0x4c0 do_group_exit+0x47/0xb0 SyS_exit_group+0x14/0x20 entry_SYSCALL_64_fastpath+0x1a/0xa9 RIP: 0033:0x...

...f0 [nouveau] drm_gem_object_free+0x29/0x70 [drm] drm_gem_object_unreference_unlocked+0x3a/0xa0 [drm] drm_gem_object_handle_unreference_unlocked+0x65/0xb0 [drm] drm_gem_object_release_handle+0x53/0x90 [drm] idr_for_each+0xb0/0x110 ? drm_gem_object_handle_unreference_unlocked+0xb0/0xb0 [drm] ? nouveau_abi16_fini+0x50/0x70 [nouveau] drm_gem_release+0x20/0x30 [drm] drm_release+0x34c/0x3a0 [drm] __fput+0xdf/0x1e0 ____fput+0xe/0x10 task_work_run+0x80/0xa0 do_exit+0x2c8/0xb80 ? __do_page_fault+0x266/0x4e0 do_group_exit+0x47/0xb0 SyS_exit_group+0x14/0x20 entry_SYSCALL_64_fastpath+0x1a/0xa9 ... ---[ end...

Again no apparent explanation for the split except hysterical raisins. Merging them also makes it a bit more obviuos what's going on wrt the runtime pm refdancing. Cc: Ben Skeggs <bskeggs at redhat.com> Cc: nouveau at lists.freedesktop.org Signed-off-by: Daniel Vetter <daniel.vetter at intel.com> --- drivers/gpu/drm/nouveau/nouveau_drm.c | 9 +-------- 1 file changed, 1

...ni+0x19/0x20 [10380.560406] nvkm_object_fini+0xbc/0x150 [10380.560408] nvkm_ioctl_del+0x2f/0x50 [10380.560409] nvkm_ioctl+0xdf/0x177 [10380.560410] nvif_object_fini+0x49/0x60 [10380.560412] nouveau_channel_del+0x89/0x110 [10380.560413] nouveau_abi16_chan_fini.isra.0+0xa0/0x110 [10380.560414] nouveau_abi16_fini+0x2d/0x60 [10380.560416] nouveau_drm_postclose+0x4c/0xe0 [10380.560418] drm_file_free.part.0+0x1e0/0x290 [10380.560420] drm_release+0xa7/0xe0 [10380.591300] __fput+0xc7/0x250 [10380.592291] task_work_run+0x90/0xc0 [10380.593271] do_exit+0x286/0xb10 [10380.594306] do_group_exit+0x33/0xa0 [103...

...08 bicoid.molgen.mpg.de kernel: nvif_object_fini+0x49/0x60 [nouveau] Apr 14 02:19:08 bicoid.molgen.mpg.de kernel: nouveau_channel_del+0x6e/0x110 [nouveau] Apr 14 02:19:08 bicoid.molgen.mpg.de kernel: nouveau_abi16_chan_fini.isra.0+0xa1/0xe0 [nouveau] Apr 14 02:19:08 bicoid.molgen.mpg.de kernel: nouveau_abi16_fini+0x2d/0x70 [nouveau] Apr 14 02:19:08 bicoid.molgen.mpg.de kernel: nouveau_drm_postclose+0x4b/0xd0 [nouveau] Apr 14 02:19:08 bicoid.molgen.mpg.de kernel: drm_release+0x264/0x380 [drm] Apr 14 02:19:08 bicoid.molgen.mpg.de kernel: __fput+0xa6/0x1e0 Apr 14 02:19:08 bicoid.molgen.mpg.de kernel: task_...

Not holding the mutex potentially causes corruption of the kernel channel when page flipping. Cc: stable at vger.kernel.org #3.13 Signed-off-by: Maarten Lankhorst <maarten.lankhorst at canonical.com> --- diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c index 29c3efdfc7dd..76e3cf025c10 100644 --- a/drivers/gpu/drm/nouveau/nouveau_display.c

5.2.0-rc4-next-20190613 dmesg nouveau 0000:01:00.0: DRM: GPU lockup - switching to software fbcon nouveau 0000:01:00.0: fifo: SCHED_ERROR 0a [CTXSW_TIMEOUT] nouveau 0000:01:00.0: fifo: runlist 0: scheduled for recovery nouveau 0000:01:00.0: fifo: channel 5: killed nouveau 0000:01:00.0: fifo: engine 6: scheduled for recovery nouveau 0000:01:00.0: fifo: engine 0: scheduled for recovery

...fffffa01c311a>] nouveau_bo_vma_del+0x9a/0xa0 [nouveau] 2013-06-14T04:23:09.916374+02:00 linux-zxd7 kernel: [305129.599601] [<ffffffffa01c5040>] nouveau_abi16_chan_fini.isra.1+0xa0/0x170 [nouveau] 2013-06-14T04:23:09.916375+02:00 linux-zxd7 kernel: [305129.599747] [<ffffffffa01c5310>] nouveau_abi16_fini+0x30/0x80 [nouveau] 2013-06-14T04:23:09.916376+02:00 linux-zxd7 kernel: [305129.599889] [<ffffffffa01bc0d7>] nouveau_drm_preclose+0x27/0x90 [nouveau] 2013-06-14T04:23:09.916377+02:00 linux-zxd7 kernel: [305129.600006] [<ffffffffa00fe7fe>] drm_release+0x6e/0x620 [drm] 2013-06-14T04:23:09...

...1052.699105] nvkm_ioctl+0x10a/0x240 [nouveau] [ 1052.699116] nvif_object_fini+0x59/0x80 [nouveau] [ 1052.699135] nouveau_channel_del+0x87/0x120 [nouveau] [ 1052.699152] ? nouveau_channel_idle+0x84/0xc0 [nouveau] [ 1052.699169] nouveau_abi16_chan_fini.isra.3+0x9c/0xe0 [nouveau] [ 1052.699186] nouveau_abi16_fini+0x2d/0x70 [nouveau] [ 1052.699203] nouveau_drm_postclose+0x4b/0xe0 [nouveau] [ 1052.699212] drm_release+0x264/0x380 [drm] [ 1052.699216] __fput+0xca/0x1d0 [ 1052.699218] task_work_run+0x84/0xa0 [ 1052.699220] do_exit+0x2ca/0xaf0 [ 1052.699227] ? drm_ioctl+0x254/0x350 [drm] [ 1052.699228] do_...

https://bugs.freedesktop.org/show_bug.cgi?id=97462 Bug ID: 97462 Summary: Graphics deadlock "ILLEGAL_MTHD" in nouveau with mesa version 11.2.2 when visiting Google Maps with firefox 49.0b5 Product: xorg Version: unspecified Hardware: x86-64 (AMD64) OS: Linux (All)