All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 01/25] drm/i915: Protect context while grabbing its name for the request
@ 2019-11-10 18:57 ` Chris Wilson
  0 siblings, 0 replies; 88+ messages in thread
From: Chris Wilson @ 2019-11-10 18:57 UTC (permalink / raw)
  To: intel-gfx

Inside print_request(), we query the context/timeline name. Nothing
immediately protects the context from being freed if the request is
complete -- we rely on serialisation by the caller to keep the name
valid until they finish using it. Inside intel_engine_dump(), we
generally only print the requsts in the execution queue protected by the
engine->active.lock, but we also show the pending execlists ports which
are not protected and so require an rcu_read_lock to keep the pointer
valid.

[ 1695.700883] BUG: KASAN: use-after-free in i915_fence_get_timeline_name+0x53/0x90 [i915]
[ 1695.700981] Read of size 8 at addr ffff8887344f4d50 by task gem_ctx_persist/2968
[ 1695.701068]
[ 1695.701156] CPU: 1 PID: 2968 Comm: gem_ctx_persist Tainted: G     U            5.4.0-rc6+ #331
[ 1695.701246] Hardware name: Intel Corporation NUC7i5BNK/NUC7i5BNB, BIOS BNKBL357.86A.0052.2017.0918.1346 09/18/2017
[ 1695.701334] Call Trace:
[ 1695.701424]  dump_stack+0x5b/0x90
[ 1695.701870]  ? i915_fence_get_timeline_name+0x53/0x90 [i915]
[ 1695.701964]  print_address_description.constprop.7+0x36/0x50
[ 1695.702408]  ? i915_fence_get_timeline_name+0x53/0x90 [i915]
[ 1695.702856]  ? i915_fence_get_timeline_name+0x53/0x90 [i915]
[ 1695.702947]  __kasan_report.cold.10+0x1a/0x3a
[ 1695.703390]  ? i915_fence_get_timeline_name+0x53/0x90 [i915]
[ 1695.703836]  i915_fence_get_timeline_name+0x53/0x90 [i915]
[ 1695.704241]  print_request+0x82/0x2e0 [i915]
[ 1695.704638]  ? fwtable_read32+0x133/0x360 [i915]
[ 1695.705042]  ? write_timestamp+0x110/0x110 [i915]
[ 1695.705133]  ? _raw_spin_lock_irqsave+0x79/0xc0
[ 1695.705221]  ? refcount_inc_not_zero_checked+0x91/0x110
[ 1695.705306]  ? refcount_dec_and_mutex_lock+0x50/0x50
[ 1695.705709]  ? intel_engine_find_active_request+0x202/0x230 [i915]
[ 1695.706115]  intel_engine_dump+0x2c9/0x900 [i915]

Fixes: c36eebd9ba5d ("drm/i915/gt: execlists->active is serialised by the tasklet")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
---
 drivers/gpu/drm/i915/gt/intel_engine_cs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/i915/gt/intel_engine_cs.c b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
index bf20305a1083..b9613d044393 100644
--- a/drivers/gpu/drm/i915/gt/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/gt/intel_engine_cs.c
@@ -1373,6 +1373,7 @@ static void intel_engine_print_registers(struct intel_engine_cs *engine,
 		}
 
 		execlists_active_lock_bh(execlists);
+		rcu_read_lock();
 		for (port = execlists->active; (rq = *port); port++) {
 			char hdr[80];
 			int len;
@@ -1410,6 +1411,7 @@ static void intel_engine_print_registers(struct intel_engine_cs *engine,
 			if (tl)
 				intel_timeline_put(tl);
 		}
+		rcu_read_unlock();
 		execlists_active_unlock_bh(execlists);
 	} else if (INTEL_GEN(dev_priv) > 6) {
 		drm_printf(m, "\tPP_DIR_BASE: 0x%08x\n",
-- 
2.24.0

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

^ permalink raw reply related	[flat|nested] 88+ messages in thread

end of thread, other threads:[~2019-11-11 17:21 UTC | newest]

Thread overview: 88+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-10 18:57 [PATCH 01/25] drm/i915: Protect context while grabbing its name for the request Chris Wilson
2019-11-10 18:57 ` [Intel-gfx] " Chris Wilson
2019-11-10 18:57 ` [PATCH 02/25] drm/i915/gem: Embed context/timeline name inside the GEM context Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-11 11:20   ` Mika Kuoppala
2019-11-11 11:20     ` [Intel-gfx] " Mika Kuoppala
2019-11-10 18:57 ` [PATCH 03/25] drm/i915/gem: Update context name on closing Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-11 10:47   ` Mika Kuoppala
2019-11-11 10:47     ` [Intel-gfx] " Mika Kuoppala
2019-11-11 10:58     ` Chris Wilson
2019-11-11 10:58       ` [Intel-gfx] " Chris Wilson
2019-11-10 18:57 ` [PATCH 04/25] drm/i915/execlists: Move reset_active() from schedule-out to schedule-in Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-10 18:57 ` [PATCH 05/25] drm/i915/pmu: "Frequency" is reported as accumulated cycles Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-10 18:57 ` [PATCH 06/25] drm/i915/userptr: Handle unlocked gup retries Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-10 18:57 ` [PATCH 07/25] drm/i915: Cancel context if it hangs after it is closed Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-11 10:54   ` Mika Kuoppala
2019-11-11 10:54     ` [Intel-gfx] " Mika Kuoppala
2019-11-11 11:04     ` Chris Wilson
2019-11-11 11:04       ` [Intel-gfx] " Chris Wilson
2019-11-11 11:25       ` Mika Kuoppala
2019-11-11 11:25         ` [Intel-gfx] " Mika Kuoppala
2019-11-10 18:57 ` [PATCH 08/25] drm/i915: Show guilty context name on GPU reset Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-11 11:26   ` Mika Kuoppala
2019-11-11 11:26     ` [Intel-gfx] " Mika Kuoppala
2019-11-10 18:57 ` [PATCH 09/25] drm/i915/icl: Refine PG_HYSTERESIS Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-11 10:59   ` Mika Kuoppala
2019-11-11 10:59     ` [Intel-gfx] " Mika Kuoppala
2019-11-10 18:57 ` [PATCH 10/25] drm/i915/execlists: Reduce barrier on context switch to a wmb() Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-11 13:19   ` Joonas Lahtinen
2019-11-11 13:19     ` [Intel-gfx] " Joonas Lahtinen
2019-11-10 18:57 ` [PATCH 11/25] drm/i915/gem: Silence sparse for RCU protection inside the constructor Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-10 18:57 ` [PATCH 12/25] drm/i915/userptr: Try to acquire the page lock around set_page_dirty() Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-10 18:57 ` [PATCH 13/25] drm/i915: Taint the kernel on dumping the GEM ftrace buffer Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-11 12:44   ` Joonas Lahtinen
2019-11-11 12:44     ` [Intel-gfx] " Joonas Lahtinen
2019-11-10 18:57 ` [PATCH 14/25] drm/i915/selftests: Exercise parallel blit operations on a single ctx Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-11 12:10   ` Matthew Auld
2019-11-11 12:10     ` [Intel-gfx] " Matthew Auld
2019-11-10 18:57 ` [PATCH 15/25] drm/i915/selftests: Perform some basic cycle counting of MI ops Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-11 17:10   ` Matthew Auld
2019-11-11 17:10     ` [Intel-gfx] " Matthew Auld
2019-11-11 17:16     ` Chris Wilson
2019-11-11 17:16       ` [Intel-gfx] " Chris Wilson
2019-11-11 17:20       ` Matthew Auld
2019-11-11 17:20         ` [Intel-gfx] " Matthew Auld
2019-11-10 18:57 ` [PATCH 16/25] drm/i915/selftests: Mock the engine sorting for easy validation Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-10 18:57 ` [PATCH 17/25] drm/i915/selftests: Fill all the drm_vma_manager holes Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-11 12:01   ` Matthew Auld
2019-11-11 12:01     ` [Intel-gfx] " Matthew Auld
2019-11-11 12:09     ` Chris Wilson
2019-11-11 12:09       ` [Intel-gfx] " Chris Wilson
2019-11-10 18:57 ` [PATCH 18/25] Revert "drm/i915: use a separate context for gpu relocs" Chris Wilson
2019-11-10 18:57   ` [Intel-gfx] " Chris Wilson
2019-11-10 18:58 ` [PATCH 19/25] drm/i915: Use a ctor for TYPESAFE_BY_RCU i915_request Chris Wilson
2019-11-10 18:58   ` [Intel-gfx] " Chris Wilson
2019-11-10 18:58 ` [PATCH 20/25] drm/i915: Drop GEM context as a direct link from i915_request Chris Wilson
2019-11-10 18:58   ` [Intel-gfx] " Chris Wilson
2019-11-10 18:58 ` [PATCH 21/25] drm/i915: Push the use-semaphore marker onto the intel_context Chris Wilson
2019-11-10 18:58   ` [Intel-gfx] " Chris Wilson
2019-11-10 18:58 ` [PATCH 22/25] drm/i915: Remove i915->kernel_context Chris Wilson
2019-11-10 18:58   ` [Intel-gfx] " Chris Wilson
2019-11-10 18:58 ` [PATCH 23/25] drm/i915: Move i915_gem_init_contexts() earlier Chris Wilson
2019-11-10 18:58   ` [Intel-gfx] " Chris Wilson
2019-11-10 18:58 ` [PATCH 24/25] drm/i915/uc: Use an internal buffer for firmware images Chris Wilson
2019-11-10 18:58   ` [Intel-gfx] " Chris Wilson
2019-11-10 18:58 ` [PATCH 25/25] drm/i915/gt: Pull GT initialisation under intel_gt_init() Chris Wilson
2019-11-10 18:58   ` [Intel-gfx] " Chris Wilson
2019-11-10 19:20 ` ✗ Fi.CI.CHECKPATCH: warning for series starting with [01/25] drm/i915: Protect context while grabbing its name for the request Patchwork
2019-11-10 19:20   ` [Intel-gfx] " Patchwork
2019-11-10 19:40 ` ✓ Fi.CI.BAT: success " Patchwork
2019-11-10 19:40   ` [Intel-gfx] " Patchwork
2019-11-11 15:34 ` ✗ Fi.CI.IGT: failure " Patchwork
2019-11-11 15:34   ` [Intel-gfx] " Patchwork

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.