dma-buf and ->dev refcount fun

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



So I've got a reproducable oops with udl sharing from i915,

start X, connect UDL, randr it into position, rip out udl device, kill X,

we get an oops when dma_unmap_sg in i915_gem_unmap_dma_buf gets
called, attachment->dev is pointing to a freed structure, now the drm
+ udl driver points dev->dev at the USB interface device, however when
the device is unplugged, the USB interface device disappears in a poof
of smoke, and we just keep a fake shell of the drm device around to
keep userspace happy.

So I'm wondering if should be using a different device to create
dma-buf objects or whether dma-buf objects need to be keeping a
reference on the interface device,

Dave.

[  147.162846] [drm:i915_gem_unmap_dma_buf] *ERROR* attachment is
ffff88002a9f2ab8 ffff880030b1e238 ffff88002a90cf00
[  147.164228] [drm:i915_gem_unmap_dma_buf] *ERROR* obj is ffff88002a90cf00
[  147.165641] [drm:i915_gem_unmap_dma_buf] *ERROR* sg is
ffff88002a9ef2d0 ffff88002da0ca40 33
[  147.167089] [drm:i915_gem_unmap_dma_buf] *ERROR* ops is
ffff880030829c08 6b6b6b6b6b6b6b6b
[  147.168988] general protection fault: 0000 [#1] SMP
[  147.169379] Modules linked in: udl syscopyarea sysfillrect
sysimgblt drm_usb rfcomm fuse ip6table_filter ip6_tables
iptable_mangle bnep arc4 iwldvm mac80211 btusb iwlwifi bluetooth
snd_hda_codec_conexant snd_hda_codec_generic cfg80211 snd_hda_intel
snd_hda_codec snd_hwdep snd_seq e1000e snd_seq_device sdhci_pci sdhci
coretemp kvm_intel mmc_core snd_pcm kvm microcode 6lowpan_iphc
i2c_i801 thinkpad_acpi snd_timer snd lpc_ich mfd_core rfkill soundcore
ptp pps_core wmi firewire_ohci firewire_core crc_itu_t yenta_socket
i915 i2c_algo_bit drm_kms_helper drm i2c_core video
[  147.169379] CPU: 0 PID: 481 Comm: Xorg Not tainted 3.14.0-rc7+ #28
[  147.169379] Hardware name: LENOVO 406334M/406334M, BIOS 6FET79WW
(3.09 ) 10/02/2009
[  147.169379] task: ffff880070ba29d0 ti: ffff88005df74000 task.ti:
ffff88005df74000
[  147.169379] RIP: 0010:[<ffffffffa00ff27e>]  [<ffffffffa00ff27e>]
i915_gem_unmap_dma_buf+0x10e/0x1a0 [i915]
[  147.169379] RSP: 0018:ffff88005df75c58  EFLAGS: 00010246
[  147.169379] RAX: 0000000000000000 RBX: ffff88002a9ef2d0 RCX: 00000000831a8319
[  147.169379] RDX: 00000000000000a0 RSI: 0000000000000001 RDI: ffff88002da0cf40
[  147.169379] RBP: ffff88005df75c90 R08: 0000000000000000 R09: 0000000000000000
[  147.169379] R10: 0000000000000000 R11: 0000000000000000 R12: ffff880030829c08
[  147.169379] R13: ffff88002a90cf00 R14: 0000000000000000 R15: 6b6b6b6b6b6b6b6b
[  147.169379] FS:  00007f5e18ef89c0(0000) GS:ffff880078c00000(0000)
knlGS:0000000000000000
[  147.169379] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[  147.169379] CR2: 000000000042fa60 CR3: 000000003f5e7000 CR4: 00000000000007f0
[  147.169379] Stack:
[  147.169379]  000000212a9f2ab8 ffff88002da0ca40 ffff88002a9f2ab8
ffff88002a9ef2d0
[  147.169379]  0000000000000000 ffff88003fd413b0 ffff88005df75d70
ffff88005df75cb8
[  147.169379]  ffffffff81487851 ffff88002a9f2ab8 ffff88004446e818
ffff88004446e7b0
[  147.169379] Call Trace:
[  147.169379]  [<ffffffff81487851>] dma_buf_unmap_attachment+0x51/0x80
[  147.169379]  [<ffffffffa00392b2>] drm_prime_gem_destroy+0x22/0x40 [drm]
[  147.169379]  [<ffffffffa061e8f5>] udl_gem_free_object+0x35/0x60 [udl]
[  147.169379]  [<ffffffffa002241a>] drm_gem_object_free+0x2a/0x30 [drm]
[  147.169379]  [<ffffffffa0022a74>]
drm_gem_object_handle_unreference_unlocked+0xe4/0x120 [drm]
[  147.169379]  [<ffffffffa0022cfc>]
drm_gem_object_release_handle+0x5c/0x80 [drm]
[  147.169379]  [<ffffffff8136fcc4>] idr_for_each+0x104/0x1a0
[  147.169379]  [<ffffffffa0022ca0>] ? drm_gem_dumb_destroy+0x20/0x20 [drm]
[  147.169379]  [<ffffffff8172b5fe>] ? mutex_unlock+0xe/0x10
[  147.169379]  [<ffffffffa0023750>] drm_gem_release+0x20/0x30 [drm]
[  147.169379]  [<ffffffffa00222a3>] drm_release+0x533/0x5c0 [drm]
[  147.169379]  [<ffffffff811eb2f5>] __fput+0xf5/0x2c0
[  147.169379]  [<ffffffff811eb50e>] ____fput+0xe/0x10
[  147.169379]  [<ffffffff81099874>] task_work_run+0xb4/0xe0
[  147.169379]  [<ffffffff81072d4c>] do_exit+0x2ec/0xcd0
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/dri-devel




[Index of Archives]     [Linux DRI Users]     [Linux Intel Graphics]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [XFree86]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux