diff options
| author | Guenter Roeck <linux@roeck-us.net> | 2022-06-01 01:29:51 +0300 |
|---|---|---|
| committer | akpm <akpm@linux-foundation.org> | 2022-06-17 05:58:20 +0300 |
| commit | 0cc011c576aaa4de505046f7a6c90933d7c749a9 (patch) | |
| tree | 8ca5e4ecd17087ab745b2e65cef0973ad749c351 /lib/flex_proportions.c | |
| parent | 53fd5ffbb5197b8cc2d73d2bbc0f688afd45736c (diff) | |
| download | linux-0cc011c576aaa4de505046f7a6c90933d7c749a9.tar.xz | |
lib/list_debug.c: Detect uninitialized lists
In some circumstances, attempts are made to add entries to or to remove
entries from an uninitialized list. A prime example is
amdgpu_bo_vm_destroy(): It is indirectly called from
ttm_bo_init_reserved() if that function fails, and tries to remove an
entry from a list. However, that list is only initialized in
amdgpu_bo_create_vm() after the call to ttm_bo_init_reserved() returned
success. This results in crashes such as
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 1 PID: 1479 Comm: chrome Not tainted 5.10.110-15768-g29a72e65dae5
Hardware name: Google Grunt/Grunt, BIOS Google_Grunt.11031.149.0 07/15/2020
RIP: 0010:__list_del_entry_valid+0x26/0x7d
...
Call Trace:
amdgpu_bo_vm_destroy+0x48/0x8b
ttm_bo_init_reserved+0x1d7/0x1e0
amdgpu_bo_create+0x212/0x476
? amdgpu_bo_user_destroy+0x23/0x23
? kmem_cache_alloc+0x60/0x271
amdgpu_bo_create_vm+0x40/0x7d
amdgpu_vm_pt_create+0xe8/0x24b
...
Check if the list's prev and next pointers are NULL to catch such problems.
Link: https://lkml.kernel.org/r/20220531222951.92073-1-linux@roeck-us.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Cc: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Diffstat (limited to 'lib/flex_proportions.c')
0 files changed, 0 insertions, 0 deletions