search for: nouveau_drm_ioctl

https://bugs.freedesktop.org/show_bug.cgi?id=100545 Bug ID: 100545 Summary: BUG: null pointer dereference dma_fence_wait_timeout from nouveau_drm_ioctl (linux 4.10.5) Product: xorg Version: unspecified Hardware: x86-64 (AMD64) OS: Linux (All) Status: NEW Keywords: have-backtrace Severity: major Priority: medium Component: Driver/nouveau Ass...

...0>] (nouveau_fence_done+0x1c/0x38) (nouveau_fence_done) from [<c02c3d00>] (ttm_bo_wait+0xec/0x168) (ttm_bo_wait) from [<c035e334>] (nouveau_gem_ioctl_cpu_prep+0x44/0x100) (nouveau_gem_ioctl_cpu_prep) from [<c02aaa84>] (drm_ioctl+0x1d8/0x4f4) (drm_ioctl) from [<c0355394>] (nouveau_drm_ioctl+0x54/0x80) (nouveau_drm_ioctl) from [<c00ee7b0>] (do_vfs_ioctl+0x3dc/0x5a0) (do_vfs_ioctl) from [<c00ee9a8>] (SyS_ioctl+0x34/0x5c) (SyS_ioctl) from [<c000e6e0>] (ret_fast_syscall+0x0/0x30 The offending nouveau_bo_rd32 is done over an IO-mapped BO, e.g. a BO mapped through the BAR...

...) >> (nouveau_fence_done) from [<c02c3d00>] (ttm_bo_wait+0xec/0x168) >> (ttm_bo_wait) from [<c035e334>] (nouveau_gem_ioctl_cpu_prep+0x44/0x100) >> (nouveau_gem_ioctl_cpu_prep) from [<c02aaa84>] (drm_ioctl+0x1d8/0x4f4) >> (drm_ioctl) from [<c0355394>] (nouveau_drm_ioctl+0x54/0x80) >> (nouveau_drm_ioctl) from [<c00ee7b0>] (do_vfs_ioctl+0x3dc/0x5a0) >> (do_vfs_ioctl) from [<c00ee9a8>] (SyS_ioctl+0x34/0x5c) >> (SyS_ioctl) from [<c000e6e0>] (ret_fast_syscall+0x0/0x30 >> >> The offending nouveau_bo_rd32 is done over an IO...

...;c02da62c>] (drm_gem_handle_create_tail) from [<bf0be138>] (nouveau_gem_ioctl_new+0x90/0x18c [nouveau]) [ 270.609594] [<bf0be138>] (nouveau_gem_ioctl_new [nouveau]) from [<c02db3b8>] (drm_ioctl+0x284/0x440) [ 270.618777] [<c02db3b8>] (drm_ioctl) from [<bf0b6bfc>] (nouveau_drm_ioctl+0x54/0x98 [nouveau]) [ 270.627441] [<bf0b6bfc>] (nouveau_drm_ioctl [nouveau]) from [<c0103860>] (do_vfs_ioctl+0x458/0x6dc) [ 270.636471] [<c0103860>] (do_vfs_ioctl) from [<c0103b18>] (SyS_ioctl+0x34/0x5c) [ 270.643767] [<c0103b18>] (SyS_ioctl) from [<c000f5c0>...

...[drm] drm_atomic_helper_update_plane+0xec/0x150 [drm_kms_helper] __setplane_internal+0x1b4/0x280 [drm] drm_mode_cursor_universal+0x126/0x210 [drm] drm_mode_cursor_common+0x86/0x180 [drm] drm_mode_cursor_ioctl+0x50/0x70 [drm] drm_ioctl+0x21b/0x4c0 [drm] ? drm_mode_setplane+0x1a0/0x1a0 [drm] nouveau_drm_ioctl+0x74/0xc0 [nouveau] do_vfs_ioctl+0xa3/0x5f0 SyS_ioctl+0x79/0x90 entry_SYSCALL_64_fastpath+0x1a/0xa9 ... RIP: dma_fence_wait_timeout+0x36/0xf0 RSP: ffffc1f700723a38 ... ---[ end trace a6bef2d32ed5fbbc ]--- BUG: unable to handle kernel NULL pointer dereference at 0000000000000021 IP: dma_fence_w...

...one) from [<c02c3d00>] (ttm_bo_wait+0xec/0x168) >> >> (ttm_bo_wait) from [<c035e334>] (nouveau_gem_ioctl_cpu_prep+0x44/0x100) >> >> (nouveau_gem_ioctl_cpu_prep) from [<c02aaa84>] (drm_ioctl+0x1d8/0x4f4) >> >> (drm_ioctl) from [<c0355394>] (nouveau_drm_ioctl+0x54/0x80) >> >> (nouveau_drm_ioctl) from [<c00ee7b0>] (do_vfs_ioctl+0x3dc/0x5a0) >> >> (do_vfs_ioctl) from [<c00ee9a8>] (SyS_ioctl+0x34/0x5c) >> >> (SyS_ioctl) from [<c000e6e0>] (ret_fast_syscall+0x0/0x30 >> >> >> >> The...

...0x140 [<000000009cd25861>] drm_gem_handle_create_tail+0xe3/0x160 [<00000000191784d9>] nouveau_gem_ioctl_new+0x6e/0xd0 [<00000000159678df>] drm_ioctl_kernel+0x8c/0xd0 [<00000000fbaa6154>] drm_ioctl+0x1c4/0x360 [<000000006833fe15>] nouveau_drm_ioctl+0x63/0xb0 Wondering if those are real leaks or just false positives. For now I marked `tags' as kmemleak_not_leak(); but most likely it's utterly wrong. Any thoughts? --- drivers/gpu/drm/nouveau/nvkm/core/memory.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/no...

...0x1e0 [<ffffff900113cce0>] nouveau_bo_fence+0x50/0x60 [nouveau] [<ffffff900113d1dc>] validate_fini_no_ticket+0xc4/0x190 [nouveau] [<ffffff900113e1fc>] nouveau_gem_ioctl_pushbuf+0x49c/0x1c78 [nouveau] [<ffffff9000ed84b8>] drm_ioctl+0x280/0x590 [drm] [<ffffff900113200c>] nouveau_drm_ioctl+0x8c/0x100 [nouveau] [<ffffffa1f7f2c910>] do_vfs_ioctl+0x130/0x9a0 [<ffffffa1f7f2d20c>] SyS_ioctl+0x8c/0xa0 [<ffffffa1f7cf3730>] el0_svc_naked+0x24/0x28 """ Enabling KASAN gives some additional information, many reports similar to """ =============...

...[ 17.008456] Call trace: [ 17.011066] nouveau_bo_new+0x450/0x4d0 [nouveau] [ 17.015924] nouveau_gem_new+0xa4/0x148 [nouveau] [ 17.020771] nouveau_gem_ioctl_new+0x48/0xd8 [nouveau] [ 17.025953] drm_ioctl_kernel+0x70/0xd8 [drm] [ 17.030343] drm_ioctl+0x180/0x3e0 [drm] [ 17.034424] nouveau_drm_ioctl+0x6c/0xc8 [nouveau] [ 17.039207] do_vfs_ioctl+0xb0/0x730 [ 17.042771] SyS_ioctl+0x8c/0xa8 [ 17.045991] el0_svc_naked+0x20/0x24 [ 17.049555] ---[ end trace d0b542d40499d1bb ]--- [ 17.252701] nouveau 17000000.gpu: fifo: read fault at 0000011000 engine 06 [HOST0] client 06 [GPC0/L1_2] rea...

...00>] (ttm_bo_wait+0xec/0x168) >>>>>> (ttm_bo_wait) from [<c035e334>] (nouveau_gem_ioctl_cpu_prep+0x44/0x100) >>>>>> (nouveau_gem_ioctl_cpu_prep) from [<c02aaa84>] (drm_ioctl+0x1d8/0x4f4) >>>>>> (drm_ioctl) from [<c0355394>] (nouveau_drm_ioctl+0x54/0x80) >>>>>> (nouveau_drm_ioctl) from [<c00ee7b0>] (do_vfs_ioctl+0x3dc/0x5a0) >>>>>> (do_vfs_ioctl) from [<c00ee9a8>] (SyS_ioctl+0x34/0x5c) >>>>>> (SyS_ioctl) from [<c000e6e0>] (ret_fast_syscall+0x0/0x30 >>>>&g...

.../0xc0 [ +0.000009] drm_ioctl_kernel+0x59/0xb0 [ +0.000008] drm_ioctl+0x2c1/0x350 [ +0.000007] ? nouveau_gem_new+0x100/0x100 [ +0.000012] ? _raw_spin_unlock_irqrestore+0x4d/0x90 [ +0.000006] ? preempt_count_sub+0x9b/0xd0 [ +0.000005] ? _raw_spin_unlock_irqrestore+0x6b/0x90 [ +0.000008] nouveau_drm_ioctl+0x64/0xc0 [ +0.000009] do_vfs_ioctl+0x8e/0x690 [ +0.000007] ? __fget+0x116/0x200 [ +0.000010] SyS_ioctl+0x74/0x80 [ +0.000009] entry_SYSCALL_64_fastpath+0x23/0x9a [ +0.000004] RIP: 0033:0x7f7860c70727 [ +0.000003] RSP: 002b:00007ffcb0d3b088 EFLAGS: 00000246 Uptime is about 14 days now an...

...0x184) [ 78.381915] [<c02b852c>] (ttm_bo_wait) from [<c034c718>] (nouveau_gem_ioctl_cpu_prep+0x40/0xe8) [ 78.396849] [<c034c718>] (nouveau_gem_ioctl_cpu_prep) from [<c029fd5c>] (drm_ioctl+0x404/0x4b8) [ 78.411790] [<c029fd5c>] (drm_ioctl) from [<c0343960>] (nouveau_drm_ioctl+0x54/0x80) [ 78.425805] [<c0343960>] (nouveau_drm_ioctl) from [<c00ea5ec>] (do_vfs_ioctl+0x3f0/0x5bc) [ 78.440277] [<c00ea5ec>] (do_vfs_ioctl) from [<c00ea7ec>] (SyS_ioctl+0x34/0x5c) [ 78.453918] [<c00ea7ec>] (SyS_ioctl) from [<c000e5a0>] (ret_fast_syscall+...

...NULL; - int ret; if (nr < DRM_COMMAND_BASE) return drm_compat_ioctl(filp, cmd, arg); -#if 0 - if (nr < DRM_COMMAND_BASE + DRM_ARRAY_SIZE(mga_compat_ioctls)) - fn = nouveau_compat_ioctls[nr - DRM_COMMAND_BASE]; -#endif - if (fn != NULL) - ret = (*fn)(filp, cmd, arg); - else - ret = nouveau_drm_ioctl(filp, cmd, arg); - - return ret; + return nouveau_drm_ioctl(filp, cmd, arg); } -- 1.8.4

...e_done+0x1c/0x38) > (nouveau_fence_done) from [<c02c3d00>] (ttm_bo_wait+0xec/0x168) > (ttm_bo_wait) from [<c035e334>] (nouveau_gem_ioctl_cpu_prep+0x44/0x100) > (nouveau_gem_ioctl_cpu_prep) from [<c02aaa84>] (drm_ioctl+0x1d8/0x4f4) > (drm_ioctl) from [<c0355394>] (nouveau_drm_ioctl+0x54/0x80) > (nouveau_drm_ioctl) from [<c00ee7b0>] (do_vfs_ioctl+0x3dc/0x5a0) > (do_vfs_ioctl) from [<c00ee9a8>] (SyS_ioctl+0x34/0x5c) > (SyS_ioctl) from [<c000e6e0>] (ret_fast_syscall+0x0/0x30 > > The offending nouveau_bo_rd32 is done over an IO-mapped BO, e.g. a...

...veau_fence_done) from [<c02c3d00>] (ttm_bo_wait+0xec/0x168) > >> (ttm_bo_wait) from [<c035e334>] (nouveau_gem_ioctl_cpu_prep+0x44/0x100) > >> (nouveau_gem_ioctl_cpu_prep) from [<c02aaa84>] (drm_ioctl+0x1d8/0x4f4) > >> (drm_ioctl) from [<c0355394>] (nouveau_drm_ioctl+0x54/0x80) > >> (nouveau_drm_ioctl) from [<c00ee7b0>] (do_vfs_ioctl+0x3dc/0x5a0) > >> (do_vfs_ioctl) from [<c00ee9a8>] (SyS_ioctl+0x34/0x5c) > >> (SyS_ioctl) from [<c000e6e0>] (ret_fast_syscall+0x0/0x30 > >> > >> The offending nouveau_b...

...0x1e0 [<ffffff900113cce0>] nouveau_bo_fence+0x50/0x60 [nouveau] [<ffffff900113d1dc>] validate_fini_no_ticket+0xc4/0x190 [nouveau] [<ffffff900113e1fc>] nouveau_gem_ioctl_pushbuf+0x49c/0x1c78 [nouveau] [<ffffff9000ed84b8>] drm_ioctl+0x280/0x590 [drm] [<ffffff900113200c>] nouveau_drm_ioctl+0x8c/0x100 [nouveau] [<ffffffa1f7f2c910>] do_vfs_ioctl+0x130/0x9a0 [<ffffffa1f7f2d20c>] SyS_ioctl+0x8c/0xa0 [<ffffffa1f7cf3730>] el0_svc_naked+0x24/0x28 """ Enabling KASAN gives some additional information, many reports similar to """ =============...

...c02c3d00>] (ttm_bo_wait+0xec/0x168) > >> >> (ttm_bo_wait) from [<c035e334>] (nouveau_gem_ioctl_cpu_prep+0x44/0x100) > >> >> (nouveau_gem_ioctl_cpu_prep) from [<c02aaa84>] (drm_ioctl+0x1d8/0x4f4) > >> >> (drm_ioctl) from [<c0355394>] (nouveau_drm_ioctl+0x54/0x80) > >> >> (nouveau_drm_ioctl) from [<c00ee7b0>] (do_vfs_ioctl+0x3dc/0x5a0) > >> >> (do_vfs_ioctl) from [<c00ee9a8>] (SyS_ioctl+0x34/0x5c) > >> >> (SyS_ioctl) from [<c000e6e0>] (ret_fast_syscall+0x0/0x30 > >> >> &...

...t;] ? nouveau_abi16_ioctl_setparam+0x10/0x10 [<ffffffff81a85ccb>] drm_ioctl+0x20b/0x6b0 [<ffffffff811bfc66>] ? debug_lockdep_rcu_enabled+0x26/0x40 [<ffffffff81a85ac0>] ? drm_ioctl_permit+0x120/0x120 [<ffffffff8118e23d>] ? trace_hardirqs_on+0xd/0x10 [<ffffffff81fe9f99>] nouveau_drm_ioctl+0x99/0x110 [<ffffffff813342be>] do_vfs_ioctl+0x4ae/0x800 [<ffffffff8180a3d9>] ? selinux_file_ioctl+0x1f9/0x2d0 [<ffffffff81333e10>] ? ioctl_preallocate+0x140/0x140 [<ffffffff8180a1e0>] ? selinux_parse_skb.constprop.42+0x7c0/0x7c0 [<ffffffff811dbdcb>] ? do_setitimer+0x2...

...t;c02b852c>] (ttm_bo_wait) from [<c034c718>] > (nouveau_gem_ioctl_cpu_prep+0x40/0xe8) > [ 78.396849] [<c034c718>] (nouveau_gem_ioctl_cpu_prep) from > [<c029fd5c>] (drm_ioctl+0x404/0x4b8) > [ 78.411790] [<c029fd5c>] (drm_ioctl) from [<c0343960>] > (nouveau_drm_ioctl+0x54/0x80) > [ 78.425805] [<c0343960>] (nouveau_drm_ioctl) from [<c00ea5ec>] > (do_vfs_ioctl+0x3f0/0x5bc) > [ 78.440277] [<c00ea5ec>] (do_vfs_ioctl) from [<c00ea7ec>] > (SyS_ioctl+0x34/0x5c) > [ 78.453918] [<c00ea7ec>] (SyS_ioctl) from [<c000e5a...

...me+0x32/0x60 [<ffffffff817102fd>] ? _raw_spin_unlock_irqrestore+0x5d/0x70 [<ffffffff810df15d>] ? trace_hardirqs_on_caller+0xfd/0x1c0 [<ffffffff810df22d>] ? trace_hardirqs_on+0xd/0x10 [<ffffffff817102e2>] ? _raw_spin_unlock_irqrestore+0x42/0x70 [<ffffffffa0290bd4>] nouveau_drm_ioctl+0x54/0xc0 [nouveau] [<ffffffff812072a0>] do_vfs_ioctl+0x300/0x520 [<ffffffff81211fad>] ? __fget+0xad/0xe0 [<ffffffff81211f05>] ? __fget+0x5/0xe0 [<ffffffff81207541>] SyS_ioctl+0x81/0xa0 [<ffffffff81710ed6>] system_call_fastpath+0x1a/0x1f