Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Vince Weaver <vincent.weaver@maine.edu>
Date:   Fri, 13 Dec 2019 14:53:48 -0500 (EST)
To:     Dave Hansen <dave.hansen@intel.com>
cc:     Jani Nikula <jani.nikula@linux.intel.com>,
        Vince Weaver <vincent.weaver@maine.edu>,
        linux-kernel@vger.kernel.org,
        Peter Zijlstra <peterz@infradead.org>,
        Ingo Molnar <mingo@redhat.com>,
        Arnaldo Carvalho de Melo <acme@kernel.org>,
        Mark Rutland <mark.rutland@arm.com>,
        Alexander Shishkin <alexander.shishkin@linux.intel.com>,
        Jiri Olsa <jolsa@redhat.com>,
        Namhyung Kim <namhyung@kernel.org>,
        Joonas Lahtinen <joonas.lahtinen@linux.intel.com>,
        Rodrigo Vivi <rodrigo.vivi@intel.com>
Subject: Re: [perf] perf_fuzzer triggers NULL pointer derefernce in i915
 driver
In-Reply-To: <f2c6502a-f13e-a663-f1f5-c441964d77ac@intel.com>
Message-ID: <alpine.DEB.2.21.1912131452170.19748@macbook-air>
References: <alpine.DEB.2.21.1912121032420.15237@macbook-air> <87tv641z20.fsf@intel.com> <f2c6502a-f13e-a663-f1f5-c441964d77ac@intel.com>
User-Agent: Alpine 2.21 (DEB 202 2017-01-01)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Fri, 13 Dec 2019, Dave Hansen wrote:

> On 12/12/19 11:09 PM, Jani Nikula wrote:
> > On Thu, 12 Dec 2019, Vince Weaver <vincent.weaver@maine.edu> wrote:
> >> with current git the perf_fuzzer was able to trigger this NULL pointer
> >> de-reference in the i915 driver.
> > Please file a bug.
> > 
> > https://gitlab.freedesktop.org/drm/intel/wikis/How-to-file-i915-bugs
> 
> I'm seeing the same thing.  It's annoyingly and immediately reproducible
> for me:
> 
> 	https://gitlab.freedesktop.org/drm/intel/issues/826
> 
> Let me know if you want anything fancier done like a bisect.  Looking
> back through my kernel logs, it appears to also have happened with
> 5.4.0-rc4.

This patch was sent out in response to my report (but not as a direct 
reply).


>From chris@chris-wilson.co.uk Thu Dec 12 10:42:36 2019
>Date: Thu, 12 Dec 2019 15:42:24 +0000
>From: Chris Wilson <chris@chris-wilson.co.uk>
>To: intel-gfx@lists.freedesktop.org
>Cc: Chris Wilson <chris@chris-wilson.co.uk>, Vince Weaver <vincent.weaver@maine.edu>, Matthew Auld <matthew.auld@intel.com>
>Subject: [PATCH] drm/i915: Set fence_work.ops before dma_fence_init

Since dma_fence_init may call ops (because of a meaningless
trace_dma_fence), we need to set the worker ops prior to that call.

Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Fixes: 8e458fe2ee05 ("drm/i915: Generalise the clflush dma-worker")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: Vince Weaver <vincent.weaver@maine.edu>
---
 drivers/gpu/drm/i915/i915_sw_fence_work.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_sw_fence_work.c b/drivers/gpu/drm/i915/i915_sw_fence_work.c
index 07552cd544f2..8538ee7a521d 100644
--- a/drivers/gpu/drm/i915/i915_sw_fence_work.c
+++ b/drivers/gpu/drm/i915/i915_sw_fence_work.c
@@ -78,12 +78,11 @@ static const struct dma_fence_ops fence_ops = {
 void dma_fence_work_init(struct dma_fence_work *f,
 			 const struct dma_fence_work_ops *ops)
 {
+	f->ops = ops;
 	spin_lock_init(&f->lock);
 	dma_fence_init(&f->dma, &fence_ops, &f->lock, 0, 0);
 	i915_sw_fence_init(&f->chain, fence_notify);
 	INIT_WORK(&f->work, fence_work);
-
-	f->ops = ops;
 }
 
 int dma_fence_work_chain(struct dma_fence_work *f, struct dma_fence *signal)
-- 
2.24.0