Skip to content

Commit

Permalink
drm/i915/gt: fix empty workaround list access issue
Browse files Browse the repository at this point in the history
Occasionally i915 workaround list might be empty, for example, it
might be empty when i915 is in virtualization. In this case, count
in i915 workaround list is zero, and gt pointer is NULL. Function
should not access gt pointer.

This change fix a kernel panic which tries to access gt pointer
of struct i915_wa_list when list is empty:

[    2.391840] BUG: kernel NULL pointer dereference, address: 0000000000000018
[    2.392165] #PF: supervisor read access in kernel mode
[    2.392404] #PF: error_code(0x0000) - not-present page
[    2.392643] PGD 0 P4D 0
[    2.392798] Oops: 0000 [intel#1] PREEMPT SMP NOPTI
[    2.393004] CPU: 3 PID: 608 Comm: systemd-modules Tainted: G U 6.1.12-intel-ese-standard-lts #5
[    2.393493] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
[    2.393877] RIP: 0010:wa_list_apply+0x3a/0x18a [i915]
[    2.394238] Code: c0 41 56 41 55 41 54 55 53 48 89 fb 48 83 ec 18 4c 8b 27 48 c7 c7 5f 75 99
[    2.395105] RSP: 0018:ffffb74100b47a58 EFLAGS: 00010246
[    2.395349] RAX: 0000000000000000 RBX: ffff9141c89a3608 RCX: 0000000000000017
[    2.395678] RDX: ffff9141c89a3608 RSI: ffffffffc091ee28 RDI: ffffffffc099755f
[    2.396039] RBP: ffff9141c89a1f38 R08: 0000001b714c2676 R09: ffff9141c89a3668
[    2.396370] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[    2.396700] R13: ffff9141c89a0000 R14: ffff9141d79d6780 R15: 0000000000000000
[    2.397058] FS:  00007fd92d4d0c40(0000) GS:ffff9141fbd80000(0000) knlGS:0000000000000000
[    2.397431] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    2.397697] CR2: 0000000000000018 CR3: 0000000103f4c006 CR4: 0000000000770ee0
[    2.398111] PKRU: 55555554
[    2.398242] Call Trace:
[    2.398362]  <TASK>
[    2.398465]  ? kvm_clock_get_cycles+0x14/0x30
[    2.398674]  ? ktime_get+0x35/0xa0
[    2.398842]  intel_gt_init_hw+0x7f/0x220 [i915]
[    2.399158]  intel_gt_resume+0xfe/0x220 [i915]
[    2.399435]  intel_gt_init+0x14d/0x350 [i915]
[    2.399703]  i915_gem_init+0x193/0x200 [i915]
[    2.400000]  i915_driver_probe+0x6bd/0xce0 [i915]

Fixes: 0957e93 ("drm/i915: Add GT support for multiple types of multicast steering")
Signed-off-by: Junxiao Chang <[email protected]>
Signed-off-by: Kris Pan <[email protected]>
  • Loading branch information
junxiaoc authored and bbaa-bbaa committed Jan 3, 2025
1 parent c88d25e commit 39a1ead
Showing 1 changed file with 3 additions and 1 deletion.
4 changes: 3 additions & 1 deletion drivers/gpu/drm/i915/gt/intel_workarounds.c
Original file line number Diff line number Diff line change
Expand Up @@ -1731,7 +1731,7 @@ wa_verify(struct intel_gt *gt, const struct i915_wa *wa, u32 cur,
static void wa_list_apply(const struct i915_wa_list *wal)
{
struct intel_gt *gt = wal->gt;
struct intel_uncore *uncore = gt->uncore;
struct intel_uncore *uncore;
enum forcewake_domains fw;
unsigned long flags;
struct i915_wa *wa;
Expand All @@ -1740,6 +1740,8 @@ static void wa_list_apply(const struct i915_wa_list *wal)
if (!wal->count)
return;

uncore = gt->uncore;

fw = wal_get_fw_for_rmw(uncore, wal);

intel_gt_mcr_lock(gt, &flags);
Expand Down

0 comments on commit 39a1ead

Please sign in to comment.