search for: nouveau_gpuobj_create_

https://bugs.freedesktop.org/show_bug.cgi?id=73607 Priority: medium Bug ID: 73607 Assignee: nouveau at lists.freedesktop.org Summary: [v3.13-rc8][regression] NULL pointer dereference in nouveau_gpuobj_create_ QA Contact: xorg-team at lists.x.org Severity: normal Classification: Unclassified OS: All Reporter: ronald645 at gmail.com Hardware: Other Status: NEW Version: git Component: Driver/nouveau Product...

...au/core/core/gpuobj.c @@ -40,7 +40,7 @@ nouveau_gpuobj_destroy(struct nouveau_gpuobj *gpuobj) } if (gpuobj->heap.block_size) - nouveau_mm_fini(&gpuobj->heap); + WARN_ON(nouveau_mm_fini(&gpuobj->heap)); nouveau_object_destroy(&gpuobj->base); } @@ -113,7 +113,7 @@ nouveau_gpuobj_create_(struct nouveau_object *parent, ret = nouveau_mm_head(heap, 1, size, size, max(align, (u32)1), &gpuobj->node); if (ret) - return ret; + goto err; gpuobj->addr += gpuobj->node->offset; } @@ -121,7 +121,7 @@ nouveau_gpuobj_create_(struct nouveau_object *pare...

...00); } + if (gpuobj->node) + nouveau_mm_free(gpuobj->node_heap, &gpuobj->node); + if (gpuobj->heap.block_size) - nouveau_mm_fini(&gpuobj->heap); + WARN_ON(nouveau_mm_fini(&gpuobj->heap)); nouveau_object_destroy(&gpuobj->base); } @@ -114,6 +117,7 @@ nouveau_gpuobj_create_(struct nouveau_object *parent, max(align, (u32)1), &gpuobj->node); if (ret) return ret; + gpuobj->node_heap = heap; gpuobj->addr += gpuobj->node->offset; } diff --git a/drivers/gpu/drm/nouveau/core/include/core/gpuobj.h b/drivers/gpu/drm/nouveau/core/inc...

...bj.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/gpu/drm/nouveau/core/core/gpuobj.c b/drivers/gpu/drm/nouveau/core/core/gpuobj.c index 7595506..7bcae1d 100644 --- a/drivers/gpu/drm/nouveau/core/core/gpuobj.c +++ b/drivers/gpu/drm/nouveau/core/core/gpuobj.c @@ -65,6 +65,14 @@ nouveau_gpuobj_create_(struct nouveau_object *parent, int ret, i; u64 addr; + /* + * There are a lot of places that allocate multiples of 1000, + * but do not set alignment correctly and still require this + * alignment implicitly or explicitly. + */ + if (size >= 0x1000 && align < 0x1000) + alig...

...08:30:27 brouette kernel: Call Trace: May 16 08:30:27 brouette kernel: [<ffffffffa047ee3f>] ? nouveau_barobj_wr32+0xf/0x20 [nouveau] May 16 08:30:27 brouette kernel: [<ffffffffa047bf25>] _nouveau_gpuobj_wr32+0x25/0x30 [nouveau] May 16 08:30:27 brouette kernel: [<ffffffffa047c1c6>] nouveau_gpuobj_create_+0x1c6/0x2c0 [nouveau] May 16 08:30:27 brouette kernel: [<ffffffffa047b48f>] nouveau_engctx_create_+0x24f/0x2a0 [nouveau] May 16 08:30:27 brouette kernel: [<ffffffffa04f0c3c>] nv50_graph_context_ctor+0x3c/0x80 [nouveau] May 16 08:30:27 brouette kernel: [<ffffffffa047d8ad>] nouveau_...

...nd a slightly different backtrace, although both eventually try to create a gpuobj: [235255.701381] [<ffffffffa02455d0>] ? nouveau_barobj_wr32+0x14/0x16 [nouveau] [235255.701400] [<ffffffffa0242d28>] _nouveau_gpuobj_wr32+0x2a/0x2c [nouveau] [235255.701418] [<ffffffffa0242fe8>] nouveau_gpuobj_create_+0x1f7/0x247 [nouveau] [235255.701437] [<ffffffffa0243075>] _nouveau_gpuobj_ctor+0x3d/0x4b [nouveau] [235255.701457] [<ffffffffa02442c6>] nouveau_object_ctor+0x32/0xaf [nouveau] [235255.701475] [<ffffffffa02430d1>] nouveau_gpuobj_new+0x4e/0x50 [nouveau] [235255.701504] [<fff...

...nged, 8 insertions(+) > > diff --git a/drivers/gpu/drm/nouveau/core/core/gpuobj.c b/drivers/gpu/drm/nouveau/core/core/gpuobj.c > index 7595506..7bcae1d 100644 > --- a/drivers/gpu/drm/nouveau/core/core/gpuobj.c > +++ b/drivers/gpu/drm/nouveau/core/core/gpuobj.c > @@ -65,6 +65,14 @@ nouveau_gpuobj_create_(struct nouveau_object *parent, > int ret, i; > u64 addr; > > + /* > + * There are a lot of places that allocate multiples of 1000, > + * but do not set alignment correctly and still require this > + * alignment implicitly or explicitly...

.../0x1b0 [nouveau] [ 40.864179] [<ffffffff8107126a>] ? finish_task_switch+0x3a/0x110 [ 40.864179] [<ffffffffa02fc103>] nouveau_object_ctor+0x33/0xe0 [nouveau] [ 40.864179] [<ffffffffa0334cbf>] nv50_instmem_alloc+0x2f/0x40 [nouveau] [ 40.864179] [<ffffffffa02fa34d>] nouveau_gpuobj_create_+0x38d/0x4c0 [nouveau] [ 40.864179] [<ffffffffa02f74ac>] nouveau_engctx_create_+0x17c/0x3d0 [nouveau] [ 40.864179] [<ffffffffa0346891>] nv50_disp_data_ctor+0x131/0x160 [nouveau] [ 40.864179] [<ffffffffa02fe3f2>] ? nouveau_subdev_reset+0x72/0xb0 [nouveau] [ 40.864179] [&...

https://bugs.freedesktop.org/show_bug.cgi?id=60007 Priority: medium Bug ID: 60007 Assignee: nouveau at lists.freedesktop.org Summary: BUG: nouveau crashes in various ways in 32-bits Fedora 18 QA Contact: xorg-team at lists.x.org Severity: critical Classification: Unclassified OS: Linux (All)

...20:01:36 brouette kernel: Call Trace: May 17 20:01:36 brouette kernel: [<ffffffffa036be6f>] ? nouveau_barobj_wr32+0xf/0x20 [nouveau] May 17 20:01:36 brouette kernel: [<ffffffffa0368f25>] _nouveau_gpuobj_wr32+0x25/0x30 [nouveau] May 17 20:01:36 brouette kernel: [<ffffffffa03691c6>] nouveau_gpuobj_create_+0x1c6/0x2c0 [nouveau] May 17 20:01:36 brouette kernel: [<ffffffffa036848f>] nouveau_engctx_create_+0x24f/0x2a0 [nouveau] May 17 20:01:36 brouette kernel: [<ffffffffa03daddc>] nv50_graph_context_ctor+0x3c/0x80 [nouveau] May 17 20:01:36 brouette kernel: [<ffffffffa036a8ad>] nouveau_...

...[<ffffffffa016c323>] nouveau_instobj_create_+0x43/0x90 [nouveau] [<ffffffffa016cf8c>] nv50_instobj_ctor+0x4c/0xf0 [nouveau] [<ffffffffa0152163>] nouveau_object_ctor+0x33/0xc0 [nouveau] [<ffffffffa016cd51>] nv50_instmem_alloc+0x21/0x30 [nouveau] [<ffffffffa0150917>] nouveau_gpuobj_create_+0x247/0x2f0 [nouveau] [<ffffffff8155b35a>] ? _raw_spin_unlock_irqrestore+0x3a/0x70 [<ffffffff810921fd>] ? trace_hardirqs_on_caller+0x10d/0x1a0 [<ffffffffa014f4bc>] nouveau_engctx_create_+0x25c/0x2a0 [nouveau] [<ffffffffa0176791>] nv50_disp_data_ctor+0xc1/0xd0 [nouveau]...

...[<ffffffffa016c323>] nouveau_instobj_create_+0x43/0x90 [nouveau] [<ffffffffa016cf8c>] nv50_instobj_ctor+0x4c/0xf0 [nouveau] [<ffffffffa0152163>] nouveau_object_ctor+0x33/0xc0 [nouveau] [<ffffffffa016cd51>] nv50_instmem_alloc+0x21/0x30 [nouveau] [<ffffffffa0150917>] nouveau_gpuobj_create_+0x247/0x2f0 [nouveau] [<ffffffff8155b35a>] ? _raw_spin_unlock_irqrestore+0x3a/0x70 [<ffffffff810921fd>] ? trace_hardirqs_on_caller+0x10d/0x1a0 [<ffffffffa014f4bc>] nouveau_engctx_create_+0x25c/0x2a0 [nouveau] [<ffffffffa0176791>] nv50_disp_data_ctor+0xc1/0xd0 [nouveau]...

...ffa0153db4 ffffff0000000000 ffffffffa0220080 ffff880230fdca80 [12394.824248] 000000001de88000 ffff8801b88cfec0 0000000000000000 0000000000000000 [12394.824257] ffff88012f92db90 ffff88012da30018 ffffffffa0220080 ffffffffa02200c0 [12394.824267] Call Trace: [12394.824284] [<ffffffffa0153db4>] nouveau_gpuobj_create_+0x1d4/0x2e0 [nouveau] [12394.824300] [<ffffffffa0153ef5>] _nouveau_gpuobj_ctor+0x35/0x50 [nouveau] [12394.824314] [<ffffffffa0155524>] nouveau_object_ctor+0x34/0xc0 [nouveau] [12394.824328] [<ffffffffa0153f58>] nouveau_gpuobj_new+0x48/0x50 [nouveau] [12394.824344] [<fffffff...