From f2bc09e9519181c7ca7ad4778d46b804c5b4c8c9 Mon Sep 17 00:00:00 2001 From: Jason Gunthorpe Date: Mon, 2 Sep 2019 03:01:03 -0300 Subject: drm/radeon: guard against calling an unpaired radeon_mn_unregister() This check was accidently deleted in the below commit. There are cases where the driver will call unregister even though it hasn't registered anything. CPU 0 Unable to handle kernel paging request at virtual address 0000001c, epc == 808de6d4, ra == 804d32ec Call Trace: [<808de6d4>] mutex_lock+0x8/0x44 [<804d32ec>] radeon_mn_unregister+0x3c/0xb0 [<8041583c>] radeon_gem_object_free+0x18/0x2c [<803a451c>] drm_gem_object_release_handle+0x74/0xac [<803a45d0>] drm_gem_handle_delete+0x7c/0x128 [<803a5bf4>] drm_ioctl_kernel+0xb0/0x108 [<803a5e74>] drm_ioctl+0x200/0x3a8 [<803e07b4>] radeon_drm_ioctl+0x54/0xc0 [<801214dc>] do_vfs_ioctl+0x4e8/0x81c [<80121864>] ksys_ioctl+0x54/0xb0 [<8001100c>] syscall_common+0x34/0x58 Link: https://lore.kernel.org/r/2fc7ef14-e89a-1f2d-381d-1c9b05da02d3@gmail.com Fixes: 534e5f84b7a9 ("drm/radeon: use mmu_notifier_get/put for struct radeon_mn") Reported-by: Petr Cvek Signed-off-by: Jason Gunthorpe --- drivers/gpu/drm/radeon/radeon_mn.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'drivers/gpu') diff --git a/drivers/gpu/drm/radeon/radeon_mn.c b/drivers/gpu/drm/radeon/radeon_mn.c index fc8254273a80..1ee20d528a7c 100644 --- a/drivers/gpu/drm/radeon/radeon_mn.c +++ b/drivers/gpu/drm/radeon/radeon_mn.c @@ -234,6 +234,9 @@ void radeon_mn_unregister(struct radeon_bo *bo) struct radeon_mn *rmn = bo->mn; struct list_head *head; + if (!rmn) + return; + mutex_lock(&rmn->lock); /* save the next list entry for later */ head = bo->mn_list.next; -- cgit v1.2.3