Ben Skeggs
e1cf4ad959
drm/nouveau/gem: fix fence_sync race / oops
commit 525895ba388c949aa906f26e3ec5cb1ab041f56b upstream.
Due to a race it was possible for a fence to be destroyed while another
thread was trying to synchronise with it. If this happened in the fallback
non-semaphore path, it lead to the following oops due to fence->channel
being NULL.
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<fa9632ce>] nouveau_fence_update+0xe/0xe0 [nouveau]
*pde = a649c067
SMP
Modules linked in: fuse nouveau(O) ttm(O) drm_kms_helper(O) drm(O) mxm_wmi video wmi netconsole configfs lockd bnep bluetooth rfkill ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ip6table_filter ip6_tables snd_hda_codec_realtek snd_hda_intel snd_hda_cobinfmt_misc uinput ata_generic pata_acpi pata_aet2c_algo_bit i2c_core [last unloaded: wmi]
Pid: 2255, comm: gnome-shell Tainted: G O 3.2.0-0.rc5.git0.1.fc17.i686 #1 System manufacturer System Product Name/M2A-VM
EIP: 0060:[<fa9632ce>] EFLAGS: 00010296 CPU: 1
EIP is at nouveau_fence_update+0xe/0xe0 [nouveau]
EAX: 00000000 EBX: ddfc6dd0 ECX: dd111580 EDX: 00000000
ESI: 00003e80 EDI: dd111580 EBP: dd121d00 ESP: dd121ce8
DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process gnome-shell (pid: 2255, ti=dd120000 task=dd111580 task.ti=dd120000)
Stack:
7dc86c76 00000000 00003e80 ddfc6dd0 00003e80 dd111580 dd121d0c fa96371f
00000000 dd121d3c fa963773 dd111580 01000246 000ec53d 00000000 ddfc6dd0
00001f40 00000000 ddfc6dd0 00000010 dc7df840 dd121d6c fa9639a0 00000000
Call Trace:
[<fa96371f>] __nouveau_fence_signalled+0x1f/0x30 [nouveau]
[<fa963773>] __nouveau_fence_wait+0x43/0xd0 [nouveau]
[<fa9639a0>] nouveau_fence_sync+0x1a0/0x1c0 [nouveau]
[<fa964046>] validate_list+0x176/0x300 [nouveau]
[<f7d9c9c0>] ? ttm_bo_mem_put+0x30/0x30 [ttm]
[<fa964b8a>] nouveau_gem_ioctl_pushbuf+0x48a/0xfd0 [nouveau]
[<c0406481>] ? die+0x31/0x80
[<f7c93d98>] drm_ioctl+0x388/0x490 [drm]
[<c0406481>] ? die+0x31/0x80
[<fa964700>] ? nouveau_gem_ioctl_new+0x150/0x150 [nouveau]
[<c0635c7b>] ? file_has_perm+0xcb/0xe0
[<f7c93a10>] ? drm_copy_field+0x80/0x80 [drm]
[<c0564f56>] do_vfs_ioctl+0x86/0x5b0
[<c0406481>] ? die+0x31/0x80
[<c0635f22>] ? selinux_file_ioctl+0x62/0x130
[<c0554f30>] ? fget_light+0x30/0x340
[<c05654ef>] sys_ioctl+0x6f/0x80
[<c099e3a4>] syscall_call+0x7/0xb
[<c0406481>] ? die+0x31/0x80
[<c0406481>] ? die+0x31/0x80
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2012-02-13 11:06:07 -08:00
..
2011-05-16 11:57:20 +10:00
2011-05-16 10:49:04 +10:00
2011-06-20 15:27:18 +10:00
2011-03-22 17:43:59 -07:00
2011-05-16 10:50:13 +10:00
2011-05-16 10:50:13 +10:00
2011-03-14 14:15:13 +10:00
2011-11-21 14:31:16 -08:00
2011-05-16 10:50:13 +10:00
2011-05-16 10:48:45 +10:00
2011-04-20 08:51:34 +10:00
2011-02-25 06:45:34 +10:00
2011-02-25 06:44:22 +10:00
2011-05-16 10:48:45 +10:00
2011-05-16 10:50:59 +10:00
2011-02-25 06:45:08 +10:00
2011-04-20 08:51:31 +10:00
2010-12-21 17:18:39 +10:00
2011-11-21 14:31:16 -08:00
2012-02-13 11:06:07 -08:00
2011-05-16 10:47:25 +10:00
2011-06-07 09:22:29 +10:00
2011-06-07 09:23:03 +10:00
2011-03-08 07:03:01 +10:00
2011-02-25 06:45:55 +10:00
2011-04-20 08:51:23 +10:00
2011-05-16 10:48:45 +10:00
2011-06-18 14:38:38 +10:00
2011-05-16 10:50:30 +10:00
2011-02-25 06:44:48 +10:00
2011-05-16 10:47:25 +10:00
2011-10-03 11:40:14 -07:00
2011-07-02 07:10:20 +10:00
2011-02-25 06:44:33 +10:00
2011-03-14 16:31:50 +10:00
2011-03-14 16:31:50 +10:00
2011-06-07 09:22:48 +10:00
2011-05-16 10:48:06 +10:00
2011-05-16 10:47:47 +10:00
2011-06-07 09:22:29 +10:00
2010-12-08 03:00:36 +01:00
2011-04-05 11:07:05 +10:00
2010-12-08 03:00:35 +01:00
2011-03-14 16:32:30 +10:00
2011-05-16 10:48:27 +10:00
2011-05-16 10:49:58 +10:00
2010-12-08 03:00:34 +01:00
2011-05-16 10:48:33 +10:00
2011-02-23 11:13:11 +10:00
2011-02-23 11:13:11 +10:00
2011-02-23 11:13:11 +10:00
2011-05-16 10:48:45 +10:00
2011-02-25 06:44:04 +10:00
2011-05-16 10:48:56 +10:00
2011-05-16 10:49:47 +10:00
2011-01-17 11:28:31 +10:00
2011-01-17 11:28:43 +10:00
2011-05-16 10:48:56 +10:00
2011-05-16 10:50:59 +10:00
2011-05-16 10:51:05 +10:00
2011-02-25 06:44:42 +10:00
2011-02-25 06:44:42 +10:00
2011-06-18 14:38:45 +10:00
2011-02-25 06:45:11 +10:00
2011-04-05 11:07:16 +10:00
2011-02-25 06:45:11 +10:00
2011-03-14 16:32:30 +10:00
2010-12-21 06:14:37 +10:00
2011-02-25 06:44:30 +10:00
2011-02-25 06:44:36 +10:00
2011-05-16 10:48:48 +10:00
2011-05-16 10:47:19 +10:00
2011-04-20 08:50:14 +10:00
2011-05-16 10:49:08 +10:00
2011-05-16 10:49:41 +10:00
2011-02-25 06:44:42 +10:00
2011-05-16 10:48:06 +10:00
2011-02-25 06:46:07 +10:00
2011-05-16 10:48:01 +10:00
2011-05-16 10:48:48 +10:00
2011-05-16 10:48:48 +10:00
2011-05-16 10:48:48 +10:00
2011-05-16 10:50:59 +10:00
2011-05-16 10:48:53 +10:00
2011-05-16 10:48:53 +10:00
2010-12-29 10:51:34 +10:00
2011-05-16 10:49:30 +10:00
2011-05-16 10:50:22 +10:00
2011-05-16 10:50:22 +10:00
2011-05-16 10:48:09 +10:00
2011-02-23 10:18:20 +10:00
2011-04-20 08:50:14 +10:00
2011-02-25 06:46:07 +10:00
2011-06-07 09:22:29 +10:00