num_zones in the ttm_mem_global structure was never reset after calling ttm_mem_global_release(). Consequently, when multiple GPU drivers are loaded, and the first one fails to load its firmware, the second driver will attempt to load its own firmware. Initializing the second driver invokes ttm_mem_global_init where ttm_mem_global.num_zones is eventually incremented beyond TTM_MEM_MAX_ZONES. ttm_mem_global.num_zones is then used to dereference a ttm_mem_zone beyond the amount of ttm_mem_zones allocated, resulting in a crash.
Signed-off-by: Brian Yip <[email protected]> --- drivers/gpu/drm/ttm/ttm_memory.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/ttm/ttm_memory.c b/drivers/gpu/drm/ttm/ttm_memory.c index 699fed9e08ee..55ccb9800893 100644 --- a/drivers/gpu/drm/ttm/ttm_memory.c +++ b/drivers/gpu/drm/ttm/ttm_memory.c @@ -478,6 +478,9 @@ void ttm_mem_global_release(struct ttm_mem_global *glob) } kobject_del(&glob->kobj); kobject_put(&glob->kobj); + + if (!kref_read(&glob->kobj.kref)) + glob->num_zones = 0; } static void ttm_check_swapping(struct ttm_mem_global *glob) -- 2.20.1 _______________________________________________ dri-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/dri-devel
