Skip to content

Commit

Permalink
drm/msm: Fix devfreq NULL pointer dereference on a3xx
Browse files Browse the repository at this point in the history
There is no devfreq on a3xx at the moment since gpu_busy is not
implemented. This means that msm_devfreq_init() will return early
and the entire devfreq setup is skipped.

However, msm_devfreq_active() and msm_devfreq_idle() are still called
unconditionally later, causing a NULL pointer dereference:

  Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
  Internal error: Oops: 96000004 [#1] PREEMPT SMP
  CPU: 0 PID: 133 Comm: ring0 Not tainted 5.15.0-rc1 #4
  Hardware name: Longcheer L8150 (DT)
  pc : mutex_lock_io+0x2bc/0x2f0
  lr : msm_devfreq_active+0x3c/0xe0 [msm]
  Call trace:
   mutex_lock_io+0x2bc/0x2f0
   msm_gpu_submit+0x164/0x180 [msm]
   msm_job_run+0x54/0xe0 [msm]
   drm_sched_main+0x2b0/0x4a0 [gpu_sched]
   kthread+0x154/0x160
   ret_from_fork+0x10/0x20

Fix this by adding a check in msm_devfreq_active/idle() which ensures
that devfreq was actually initialized earlier.

Fixes: 9bc9557 ("drm/msm: Devfreq tuning")
Reported-by: Nikita Travkin <[email protected]>
Tested-by: Nikita Travkin <[email protected]>
Signed-off-by: Stephan Gerhold <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Rob Clark <[email protected]>
  • Loading branch information
stephan-gh authored and robclark committed Oct 12, 2021
1 parent 9463b64 commit efb8a17
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions drivers/gpu/drm/msm/msm_gpu_devfreq.c
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,9 @@ void msm_devfreq_active(struct msm_gpu *gpu)
unsigned int idle_time;
unsigned long target_freq = df->idle_freq;

if (!df->devfreq)
return;

/*
* Hold devfreq lock to synchronize with get_dev_status()/
* target() callbacks
Expand Down Expand Up @@ -186,6 +189,9 @@ void msm_devfreq_idle(struct msm_gpu *gpu)
struct msm_gpu_devfreq *df = &gpu->devfreq;
unsigned long idle_freq, target_freq = 0;

if (!df->devfreq)
return;

/*
* Hold devfreq lock to synchronize with get_dev_status()/
* target() callbacks
Expand Down

0 comments on commit efb8a17

Please sign in to comment.