UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity
OpenCloudOS-Kernel/drivers
History
John Brooks 8046e19554 drm/ttm: Fix use-after-free in ttm_bo_clean_mm 
We unref the man->move fence in ttm_bo_clean_mm() and then call
ttm_bo_force_list_clean() which waits on it, except the refcount is now
zero so a warning is generated (or worse):

[149492.279301] refcount_t: increment on 0; use-after-free.
[149492.279309] ------------[ cut here ]------------
[149492.279315] WARNING: CPU: 3 PID: 18726 at lib/refcount.c:150 refcount_inc+0x2b/0x30
[149492.279315] Modules linked in: vhost_net vhost tun x86_pkg_temp_thermal crc32_pclmul ghash_clmulni_intel efivarfs amdgpu(
-) i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm drm
[149492.279326] CPU: 3 PID: 18726 Comm: rmmod Not tainted 4.12.0-rc5-drm-next-4.13-ttmpatch+ #1
[149492.279326] Hardware name: Gigabyte Technology Co., Ltd. Z97X-UD3H-BK/Z97X-UD3H-BK-CF, BIOS F6 06/17/2014
[149492.279327] task: ffff8804ddfedcc0 task.stack: ffffc90008d20000
[149492.279329] RIP: 0010:refcount_inc+0x2b/0x30
[149492.279330] RSP: 0018:ffffc90008d23c30 EFLAGS: 00010286
[149492.279331] RAX: 000000000000002b RBX: 0000000000000170 RCX: 0000000000000000
[149492.279331] RDX: 0000000000000000 RSI: ffff88051ecccbe8 RDI: ffff88051ecccbe8
[149492.279332] RBP: ffffc90008d23c30 R08: 0000000000000001 R09: 00000000000003ee
[149492.279333] R10: ffffc90008d23bb0 R11: 00000000000003ee R12: ffff88043aaac960
[149492.279333] R13: ffff8805005e28a8 R14: 0000000000000002 R15: ffff88050115e178
[149492.279334] FS:  00007fc540168700(0000) GS:ffff88051ecc0000(0000) knlGS:0000000000000000
[149492.279335] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[149492.279336] CR2: 00007fc3e8654140 CR3: 000000027ba77000 CR4: 00000000001426e0
[149492.279337] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[149492.279337] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[149492.279338] Call Trace:
[149492.279345]  ttm_bo_force_list_clean+0xb9/0x110 [ttm]
[149492.279348]  ttm_bo_clean_mm+0x7a/0xe0 [ttm]
[149492.279375]  amdgpu_ttm_fini+0xc9/0x1f0 [amdgpu]
[149492.279392]  amdgpu_bo_fini+0x12/0x40 [amdgpu]
[149492.279415]  gmc_v7_0_sw_fini+0x32/0x40 [amdgpu]
[149492.279430]  amdgpu_fini+0x2c9/0x490 [amdgpu]
[149492.279445]  amdgpu_device_fini+0x58/0x1b0 [amdgpu]
[149492.279461]  amdgpu_driver_unload_kms+0x4f/0xa0 [amdgpu]
[149492.279470]  drm_dev_unregister+0x3c/0xe0 [drm]
[149492.279485]  amdgpu_pci_remove+0x19/0x30 [amdgpu]
[149492.279487]  pci_device_remove+0x39/0xc0
[149492.279490]  device_release_driver_internal+0x155/0x210
[149492.279491]  driver_detach+0x38/0x70
[149492.279493]  bus_remove_driver+0x4c/0xa0
[149492.279494]  driver_unregister+0x2c/0x40
[149492.279496]  pci_unregister_driver+0x21/0x90
[149492.279520]  amdgpu_exit+0x15/0x406 [amdgpu]
[149492.279523]  SyS_delete_module+0x1a8/0x270
[149492.279525]  ? exit_to_usermode_loop+0x92/0xa0
[149492.279528]  entry_SYSCALL_64_fastpath+0x13/0x94
[149492.279529] RIP: 0033:0x7fc53fcb68e7
[149492.279529] RSP: 002b:00007ffcfbfaabb8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
[149492.279531] RAX: ffffffffffffffda RBX: 0000563117adb200 RCX: 00007fc53fcb68e7
[149492.279531] RDX: 000000000000000a RSI: 0000000000000800 RDI: 0000563117adb268
[149492.279532] RBP: 0000000000000003 R08: 0000000000000000 R09: 1999999999999999
[149492.279533] R10: 0000000000000883 R11: 0000000000000206 R12: 00007ffcfbfa9ba0
[149492.279533] R13: 0000000000000000 R14: 0000000000000000 R15: 0000563117adb200
[149492.279534] Code: 55 48 89 e5 e8 77 fe ff ff 84 c0 74 02 5d c3 80 3d 40 f2 a4 00 00 75 f5 48 c7 c7 20 3c ca 81 c6 05 30 f2 a4 00 01 e8 91 f0 d7 ff <0f> ff 5d c3 90 55 48 89 fe bf 01 00 00 00 48 89 e5 e8 9f fe ff
[149492.279557] ---[ end trace 2d4e0ffcb66a1016 ]---

Unref the fence *after* waiting for it.

v2: Set man->move to NULL after dropping the last ref (Christian König)

Fixes: aff98ba1fd (drm/ttm: wait for eviction in ttm_bo_force_list_clean)
Signed-off-by: John Brooks <john@fastquake.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
 		2017-07-03 16:25:43 -04:00
..
accessibility
…
acpi ACPI / scan: Fix enumeration for special SPI and I2C devices 2017-06-21 23:14:55 +02:00
amba
…
android
…
ata libata: fix error checking in in ata_parse_force_one() 2017-05-31 14:26:26 -04:00
atm
…
auxdisplay Merge branch 'for-4.11/libnvdimm' into for-4.12/dax 2017-04-12 21:59:01 -07:00
base Merge branches 'intel_pstate' and 'pm-sleep' 2017-06-09 01:25:16 +02:00
bcma
…
block Merge branch 'stable/for-jens-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen into for-linus 2017-06-20 07:09:27 -06:00
bluetooth Bluetooth: hci_ldisc: Add protocol check to hci_uart_tx_wakeup() 2017-04-30 12:22:14 +02:00
bus bus: SIMPLE_PM_BUS does not depend on ARCH_RENESAS 2017-06-17 08:03:08 -04:00
cdrom scsi: introduce a result field in struct scsi_request 2017-04-20 12:16:10 -06:00
char Fix some locking and gcc optimization issues from the most recent 2017-06-23 17:33:46 -07:00
clk Allwinner clock fixes for 4.12 2017-06-14 16:48:03 -07:00
clocksource clocksource: Explicitly include linux/clocksource.h when needed 2017-06-13 17:57:16 +02:00
connector
…
cpufreq Merge branches 'pm-cpufreq', 'pm-cpuidle' and 'pm-devfreq' 2017-06-15 01:51:33 +02:00
cpuidle Merge branches 'pm-cpufreq', 'pm-cpuidle' and 'pm-devfreq' 2017-06-15 01:51:33 +02:00
crypto virtio: fixes, cleanups, performance 2017-05-10 11:33:08 -07:00
dax device-dax: fix 'dax' device filesystem inode destruction crash 2017-06-09 08:50:49 -07:00
dca
…
devfreq PM / devfreq: exynos-ppmu: Staticize event list 2017-06-12 10:12:07 +09:00
dio
…
dma dmaengine: pl330: fix warning in pl330_remove 2017-06-02 11:49:44 +05:30
dma-buf dma-buf/sync-file: Defer creation of sync_file->name 2017-05-24 13:08:29 -03:00
edac EDAC, amd64: Fix reporting of Chip Select sizes on Fam17h 2017-05-03 16:27:36 +02:00
eisa
…
extcon extcon: Use BIT() macro for the left-shift operation 2017-04-06 11:12:45 +09:00
firewire
…
firmware Merge branch 'dmi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging 2017-06-16 17:13:06 +09:00
fmc
…
fpga fpga fr br: update supported version numbers 2017-04-26 11:38:56 +02:00
fsi
…
gpio gpio: mvebu: change compatible string for PWM support 2017-06-20 13:42:20 +02:00
gpu drm/ttm: Fix use-after-free in ttm_bo_clean_mm 2017-07-03 16:25:43 -04:00
hid Merge branch 'for-4.12/upstream-fixes' into for-linus 2017-06-20 10:52:46 +02:00
hsi hsi: Fix build regression due to netdev destructor fix. 2017-06-08 10:16:05 -04:00
hv char/misc patches for 4.12-rc1 2017-05-04 19:15:35 -07:00
hwmon hwmon: (aspeed-pwm-tacho) make fan/pwm names start with index 1 2017-06-03 03:55:43 -07:00
hwspinlock
…
hwtracing drivers/hwtracing/intel_th/msu.c: use set_memory.h header 2017-05-08 17:15:14 -07:00
i2c i2c: imx: Use correct function to write to register 2017-06-22 10:52:02 +02:00
ide ide: don't call memcpy with the same source and destination 2017-05-08 17:36:39 -04:00
idle x86/intel_idle: add Gemini Lake support 2017-05-01 23:17:37 +02:00
iio iio: buffer-dmaengine: Add missing header buffer_impl.h 2017-06-13 20:56:05 +01:00
infiniband Fixes #2 for 4.12-rc 2017-06-16 17:38:23 +09:00
input Input: synaptics-rmi4 - only read the F54 query registers which are used 2017-06-23 00:08:48 -07:00
iommu iommu/of: Ignore all errors except EPROBE_DEFER 2017-05-30 11:31:32 +02:00
ipack
…
irqchip irqchip/mips-gic: Mark count and compare accessors notrace 2017-06-20 21:41:58 +02:00
isdn mISDN: Fix a sleep-in-atomic bug 2017-06-01 14:49:47 -04:00
leds LED fixes for 4.12-rc6 2017-06-18 08:51:35 +09:00
lguest
…
lightnvm lightnvm: fix bad back free on error path 2017-05-04 07:53:04 -06:00
macintosh DeviceTree for 4.12: 2017-05-05 19:33:07 -07:00
mailbox mailbox: handle empty message in tx_tick 2017-04-27 16:20:04 +05:30
mcb
…
md dm io: fix duplicate bio completion due to missing ref count 2017-06-21 12:04:50 -04:00
media Linux 4.12-rc7 2017-06-27 08:28:30 +10:00
memory Merge tag 'at91-4.12-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux into fixes 2017-06-01 17:07:31 -07:00
memstick
…
message scsi: mpt: Move scsi_remove_host() out of mptscsih_remove_host() 2017-04-24 18:21:17 -04:00
mfd mfd: arizona: Fix typo using hard-coded register 2017-06-06 10:17:42 +01:00
misc Char/Misc driver fixes for 4.12-rc5 2017-06-11 11:29:15 -07:00
mmc mmc: meson-gx: work around broken SDIO with certain WiFi chips 2017-06-12 08:58:16 +02:00
mtd mtd: nand: make nand_ooblayout_lp_hamming_ops static 2017-05-22 09:42:29 +02:00
net wireless-drivers fixes for 4.12 2017-06-20 15:41:56 -04:00
nfc nfc: fix get_unaligned_...() misuses 2017-04-17 00:42:22 +02:00
ntb ntb: no sleep in ntb_async_tx_submit 2017-06-19 14:24:41 -04:00
nubus nubus: Clean up whitespace 2017-04-20 09:54:24 +02:00
nvdimm Merge branch 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm 2017-05-12 15:43:10 -07:00
nvme nvme: relax APST default max latency to 100ms 2017-06-07 11:08:55 +02:00
nvmem ARM: SoC driver updates 2017-05-09 10:01:15 -07:00
of iommu/of: Ignore all errors except EPROBE_DEFER 2017-05-30 11:31:32 +02:00
oprofile
…
parisc
…
parport Annotate hardware config module parameters in drivers/parport/ 2017-04-20 12:02:32 +01:00
pci PCI: endpoint: Select CRC32 to fix test build error 2017-06-12 15:46:13 -05:00
pcmcia Annotation of module parameters that specify device settings 2017-05-10 19:13:03 -07:00
perf drivers/perf: arm_pmu_acpi: avoid perf IRQ init when guest PMU is off 2017-05-30 12:40:03 +01:00
phy phy: qualcomm: phy-qcom-qmp: fix application of sizeof to pointer 2017-06-01 15:03:41 +05:30
pinctrl pinctrl: stm32: Fix bad function call 2017-06-09 10:51:54 +02:00
platform platform-drivers-x86 for v4.12-2 2017-06-16 17:30:44 +09:00
pnp
…
power power supply and reset changes for the v4.12 series (part 2) 2017-05-12 12:02:21 -07:00
powercap PowerCap: Fix an error code in powercap_register_zone() 2017-05-14 13:30:05 +02:00
pps
…
ps3
…
ptp Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2017-05-01 16:15:18 -07:00
pwm Merge branch 'for-4.12/drivers' into for-next 2017-04-13 17:41:50 +02:00
rapidio char/misc patches for 4.12-rc1 2017-05-04 19:15:35 -07:00
ras
…
regulator Merge remote-tracking branch 'regulator/topic/vctrl' into regulator-next 2017-04-30 22:17:44 +09:00
remoteproc virtio: fixes, cleanups, performance 2017-05-10 11:33:08 -07:00
reset reset: hi6220: Set module license so that it can be loaded 2017-05-24 10:53:41 +02:00
rpmsg virtio: fixes, cleanups, performance 2017-05-10 11:33:08 -07:00
rtc Merge branches 'pm-sleep' and 'powercap' 2017-05-22 20:32:05 +02:00
s390 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-06-15 18:09:47 +09:00
sbus
…
scsi SCSI fixes on 20170622 2017-06-23 12:25:37 -07:00
sfi
…
sh
…
sn
…
soc ARM: SoC fixes (and a cross-arch dt-include fix) 2017-05-19 13:36:56 -07:00
spi Merge remote-tracking branches 'spi/topic/ti-qspi' and 'spi/topic/xlp' into spi-next 2017-04-26 15:58:22 +01:00
spmi
…
ssb
…
staging Staging/IIO fixes for 4.12-rc6 2017-06-18 08:36:30 +09:00
target iscsi-target: Reject immediate data underflow larger than SCSI transfer length 2017-06-08 22:25:29 -07:00
tc
…
tee Linux 4.12-rc1 2017-05-18 23:54:47 -07:00
thermal thermal: broadcom: ns-thermal: default on iProc SoCs 2017-05-23 20:09:34 -07:00
thunderbolt
…
tty Revert "tty: fix port buffer locking" 2017-06-04 10:23:25 +02:00
uio uio: fix incorrect memory leak cleanup 2017-05-16 23:06:41 +02:00
usb USB fixes for 4.12-rc6 2017-06-18 08:39:54 +09:00
uwb uwb: fix device quirk on big-endian hosts 2017-05-17 11:27:41 +02:00
vfio powerpc updates for 4.12 part 1. 2017-05-05 11:36:44 -07:00
vhost mm: support __GFP_REPEAT in kvmalloc_node for >32kB 2017-05-08 17:15:12 -07:00
video Linux 4.12-rc7 2017-06-27 08:28:30 +10:00
virt drivers/virt/fsl_hypervisor.c: use get_user_pages_unlocked() 2017-05-08 17:15:10 -07:00
virtio virtio_balloon: disable VIOMMU support 2017-06-18 23:13:35 +03:00
vlynq
…
vme
…
w1 w1: Remove unneeded use of assert() and remove w1_log.h 2017-04-08 18:20:57 +02:00
watchdog watchdog: bcm281xx: Fix use of uninitialized spinlock. 2017-05-19 10:42:25 +02:00
xen xen: fix for 4.12 rc5 2017-06-09 09:59:51 -07:00
zorro
…
Kconfig
…
Makefile Merge branch 'tee/initial-merge' into fixes 2017-05-10 21:03:31 +02:00