* [PATCH] drm/syncobj: Fix use-after-free @ 2021-01-19 13:03 ` Daniel Vetter 0 siblings, 0 replies; 12+ messages in thread From: Daniel Vetter @ 2021-01-19 13:03 UTC (permalink / raw) To: DRI Development Cc: Intel Graphics Development, Daniel Vetter, Daniel Vetter, Christian König, Lionel Landwerlin, Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie, Daniel Vetter, stable While reviewing Christian's annotation patch I noticed that we have a user-after-free for the WAIT_FOR_SUBMIT case: We drop the syncobj reference before we've completed the waiting. Of course usually there's nothing bad happening here since userspace keeps the reference, but we can't rely on userspace to play nice here! Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Fixes: bc9c80fe01a2 ("drm/syncobj: use the timeline point in drm_syncobj_find_fence v4") Cc: Christian König <christian.koenig@amd.com> Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Maxime Ripard <mripard@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: David Airlie <airlied@linux.ie> Cc: Daniel Vetter <daniel@ffwll.ch> Cc: dri-devel@lists.freedesktop.org Cc: <stable@vger.kernel.org> # v5.2+ --- drivers/gpu/drm/drm_syncobj.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c index 6e74e6745eca..349146049849 100644 --- a/drivers/gpu/drm/drm_syncobj.c +++ b/drivers/gpu/drm/drm_syncobj.c @@ -388,19 +388,18 @@ int drm_syncobj_find_fence(struct drm_file *file_private, return -ENOENT; *fence = drm_syncobj_fence_get(syncobj); - drm_syncobj_put(syncobj); if (*fence) { ret = dma_fence_chain_find_seqno(fence, point); if (!ret) - return 0; + goto out; dma_fence_put(*fence); } else { ret = -EINVAL; } if (!(flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)) - return ret; + goto out; memset(&wait, 0, sizeof(wait)); wait.task = current; @@ -432,6 +431,9 @@ int drm_syncobj_find_fence(struct drm_file *file_private, if (wait.node.next) drm_syncobj_remove_wait(syncobj, &wait); +out: + drm_syncobj_put(syncobj); + return ret; } EXPORT_SYMBOL(drm_syncobj_find_fence); -- 2.30.0 ^ permalink raw reply related [flat|nested] 12+ messages in thread
* [Intel-gfx] [PATCH] drm/syncobj: Fix use-after-free @ 2021-01-19 13:03 ` Daniel Vetter 0 siblings, 0 replies; 12+ messages in thread From: Daniel Vetter @ 2021-01-19 13:03 UTC (permalink / raw) To: DRI Development Cc: David Airlie, Daniel Vetter, Intel Graphics Development, Maxime Ripard, Thomas Zimmermann, Daniel Vetter, stable, Christian König While reviewing Christian's annotation patch I noticed that we have a user-after-free for the WAIT_FOR_SUBMIT case: We drop the syncobj reference before we've completed the waiting. Of course usually there's nothing bad happening here since userspace keeps the reference, but we can't rely on userspace to play nice here! Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Fixes: bc9c80fe01a2 ("drm/syncobj: use the timeline point in drm_syncobj_find_fence v4") Cc: Christian König <christian.koenig@amd.com> Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Maxime Ripard <mripard@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: David Airlie <airlied@linux.ie> Cc: Daniel Vetter <daniel@ffwll.ch> Cc: dri-devel@lists.freedesktop.org Cc: <stable@vger.kernel.org> # v5.2+ --- drivers/gpu/drm/drm_syncobj.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c index 6e74e6745eca..349146049849 100644 --- a/drivers/gpu/drm/drm_syncobj.c +++ b/drivers/gpu/drm/drm_syncobj.c @@ -388,19 +388,18 @@ int drm_syncobj_find_fence(struct drm_file *file_private, return -ENOENT; *fence = drm_syncobj_fence_get(syncobj); - drm_syncobj_put(syncobj); if (*fence) { ret = dma_fence_chain_find_seqno(fence, point); if (!ret) - return 0; + goto out; dma_fence_put(*fence); } else { ret = -EINVAL; } if (!(flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)) - return ret; + goto out; memset(&wait, 0, sizeof(wait)); wait.task = current; @@ -432,6 +431,9 @@ int drm_syncobj_find_fence(struct drm_file *file_private, if (wait.node.next) drm_syncobj_remove_wait(syncobj, &wait); +out: + drm_syncobj_put(syncobj); + return ret; } EXPORT_SYMBOL(drm_syncobj_find_fence); -- 2.30.0 _______________________________________________ Intel-gfx mailing list Intel-gfx@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/intel-gfx ^ permalink raw reply related [flat|nested] 12+ messages in thread
* [PATCH] drm/syncobj: Fix use-after-free @ 2021-01-19 13:03 ` Daniel Vetter 0 siblings, 0 replies; 12+ messages in thread From: Daniel Vetter @ 2021-01-19 13:03 UTC (permalink / raw) To: DRI Development Cc: David Airlie, Daniel Vetter, Intel Graphics Development, Thomas Zimmermann, Daniel Vetter, stable, Christian König While reviewing Christian's annotation patch I noticed that we have a user-after-free for the WAIT_FOR_SUBMIT case: We drop the syncobj reference before we've completed the waiting. Of course usually there's nothing bad happening here since userspace keeps the reference, but we can't rely on userspace to play nice here! Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> Fixes: bc9c80fe01a2 ("drm/syncobj: use the timeline point in drm_syncobj_find_fence v4") Cc: Christian König <christian.koenig@amd.com> Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com> Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Cc: Maxime Ripard <mripard@kernel.org> Cc: Thomas Zimmermann <tzimmermann@suse.de> Cc: David Airlie <airlied@linux.ie> Cc: Daniel Vetter <daniel@ffwll.ch> Cc: dri-devel@lists.freedesktop.org Cc: <stable@vger.kernel.org> # v5.2+ --- drivers/gpu/drm/drm_syncobj.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c index 6e74e6745eca..349146049849 100644 --- a/drivers/gpu/drm/drm_syncobj.c +++ b/drivers/gpu/drm/drm_syncobj.c @@ -388,19 +388,18 @@ int drm_syncobj_find_fence(struct drm_file *file_private, return -ENOENT; *fence = drm_syncobj_fence_get(syncobj); - drm_syncobj_put(syncobj); if (*fence) { ret = dma_fence_chain_find_seqno(fence, point); if (!ret) - return 0; + goto out; dma_fence_put(*fence); } else { ret = -EINVAL; } if (!(flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)) - return ret; + goto out; memset(&wait, 0, sizeof(wait)); wait.task = current; @@ -432,6 +431,9 @@ int drm_syncobj_find_fence(struct drm_file *file_private, if (wait.node.next) drm_syncobj_remove_wait(syncobj, &wait); +out: + drm_syncobj_put(syncobj); + return ret; } EXPORT_SYMBOL(drm_syncobj_find_fence); -- 2.30.0 _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel ^ permalink raw reply related [flat|nested] 12+ messages in thread
* Re: [PATCH] drm/syncobj: Fix use-after-free 2021-01-19 13:03 ` Daniel Vetter (?) @ 2021-01-19 13:08 ` Christian König -1 siblings, 0 replies; 12+ messages in thread From: Christian König @ 2021-01-19 13:08 UTC (permalink / raw) To: Daniel Vetter, DRI Development Cc: Intel Graphics Development, Daniel Vetter, Lionel Landwerlin, Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie, Daniel Vetter, stable Am 19.01.21 um 14:03 schrieb Daniel Vetter: > While reviewing Christian's annotation patch I noticed that we have a > user-after-free for the WAIT_FOR_SUBMIT case: We drop the syncobj > reference before we've completed the waiting. > > Of course usually there's nothing bad happening here since userspace > keeps the reference, but we can't rely on userspace to play nice here! > > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> > Fixes: bc9c80fe01a2 ("drm/syncobj: use the timeline point in drm_syncobj_find_fence v4") > Cc: Christian König <christian.koenig@amd.com> > Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com> > Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> > Cc: Maxime Ripard <mripard@kernel.org> > Cc: Thomas Zimmermann <tzimmermann@suse.de> > Cc: David Airlie <airlied@linux.ie> > Cc: Daniel Vetter <daniel@ffwll.ch> > Cc: dri-devel@lists.freedesktop.org > Cc: <stable@vger.kernel.org> # v5.2+ Reviewed-by: Christian König <christian.koenig@amd.com> > --- > drivers/gpu/drm/drm_syncobj.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c > index 6e74e6745eca..349146049849 100644 > --- a/drivers/gpu/drm/drm_syncobj.c > +++ b/drivers/gpu/drm/drm_syncobj.c > @@ -388,19 +388,18 @@ int drm_syncobj_find_fence(struct drm_file *file_private, > return -ENOENT; > > *fence = drm_syncobj_fence_get(syncobj); > - drm_syncobj_put(syncobj); > > if (*fence) { > ret = dma_fence_chain_find_seqno(fence, point); > if (!ret) > - return 0; > + goto out; > dma_fence_put(*fence); > } else { > ret = -EINVAL; > } > > if (!(flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)) > - return ret; > + goto out; > > memset(&wait, 0, sizeof(wait)); > wait.task = current; > @@ -432,6 +431,9 @@ int drm_syncobj_find_fence(struct drm_file *file_private, > if (wait.node.next) > drm_syncobj_remove_wait(syncobj, &wait); > > +out: > + drm_syncobj_put(syncobj); > + > return ret; > } > EXPORT_SYMBOL(drm_syncobj_find_fence); ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [Intel-gfx] [PATCH] drm/syncobj: Fix use-after-free @ 2021-01-19 13:08 ` Christian König 0 siblings, 0 replies; 12+ messages in thread From: Christian König @ 2021-01-19 13:08 UTC (permalink / raw) To: Daniel Vetter, DRI Development Cc: David Airlie, Intel Graphics Development, Maxime Ripard, Thomas Zimmermann, Daniel Vetter, stable Am 19.01.21 um 14:03 schrieb Daniel Vetter: > While reviewing Christian's annotation patch I noticed that we have a > user-after-free for the WAIT_FOR_SUBMIT case: We drop the syncobj > reference before we've completed the waiting. > > Of course usually there's nothing bad happening here since userspace > keeps the reference, but we can't rely on userspace to play nice here! > > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> > Fixes: bc9c80fe01a2 ("drm/syncobj: use the timeline point in drm_syncobj_find_fence v4") > Cc: Christian König <christian.koenig@amd.com> > Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com> > Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> > Cc: Maxime Ripard <mripard@kernel.org> > Cc: Thomas Zimmermann <tzimmermann@suse.de> > Cc: David Airlie <airlied@linux.ie> > Cc: Daniel Vetter <daniel@ffwll.ch> > Cc: dri-devel@lists.freedesktop.org > Cc: <stable@vger.kernel.org> # v5.2+ Reviewed-by: Christian König <christian.koenig@amd.com> > --- > drivers/gpu/drm/drm_syncobj.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c > index 6e74e6745eca..349146049849 100644 > --- a/drivers/gpu/drm/drm_syncobj.c > +++ b/drivers/gpu/drm/drm_syncobj.c > @@ -388,19 +388,18 @@ int drm_syncobj_find_fence(struct drm_file *file_private, > return -ENOENT; > > *fence = drm_syncobj_fence_get(syncobj); > - drm_syncobj_put(syncobj); > > if (*fence) { > ret = dma_fence_chain_find_seqno(fence, point); > if (!ret) > - return 0; > + goto out; > dma_fence_put(*fence); > } else { > ret = -EINVAL; > } > > if (!(flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)) > - return ret; > + goto out; > > memset(&wait, 0, sizeof(wait)); > wait.task = current; > @@ -432,6 +431,9 @@ int drm_syncobj_find_fence(struct drm_file *file_private, > if (wait.node.next) > drm_syncobj_remove_wait(syncobj, &wait); > > +out: > + drm_syncobj_put(syncobj); > + > return ret; > } > EXPORT_SYMBOL(drm_syncobj_find_fence); _______________________________________________ Intel-gfx mailing list Intel-gfx@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/intel-gfx ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH] drm/syncobj: Fix use-after-free @ 2021-01-19 13:08 ` Christian König 0 siblings, 0 replies; 12+ messages in thread From: Christian König @ 2021-01-19 13:08 UTC (permalink / raw) To: Daniel Vetter, DRI Development Cc: David Airlie, Intel Graphics Development, Thomas Zimmermann, Daniel Vetter, stable Am 19.01.21 um 14:03 schrieb Daniel Vetter: > While reviewing Christian's annotation patch I noticed that we have a > user-after-free for the WAIT_FOR_SUBMIT case: We drop the syncobj > reference before we've completed the waiting. > > Of course usually there's nothing bad happening here since userspace > keeps the reference, but we can't rely on userspace to play nice here! > > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> > Fixes: bc9c80fe01a2 ("drm/syncobj: use the timeline point in drm_syncobj_find_fence v4") > Cc: Christian König <christian.koenig@amd.com> > Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com> > Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> > Cc: Maxime Ripard <mripard@kernel.org> > Cc: Thomas Zimmermann <tzimmermann@suse.de> > Cc: David Airlie <airlied@linux.ie> > Cc: Daniel Vetter <daniel@ffwll.ch> > Cc: dri-devel@lists.freedesktop.org > Cc: <stable@vger.kernel.org> # v5.2+ Reviewed-by: Christian König <christian.koenig@amd.com> > --- > drivers/gpu/drm/drm_syncobj.c | 8 +++++--- > 1 file changed, 5 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c > index 6e74e6745eca..349146049849 100644 > --- a/drivers/gpu/drm/drm_syncobj.c > +++ b/drivers/gpu/drm/drm_syncobj.c > @@ -388,19 +388,18 @@ int drm_syncobj_find_fence(struct drm_file *file_private, > return -ENOENT; > > *fence = drm_syncobj_fence_get(syncobj); > - drm_syncobj_put(syncobj); > > if (*fence) { > ret = dma_fence_chain_find_seqno(fence, point); > if (!ret) > - return 0; > + goto out; > dma_fence_put(*fence); > } else { > ret = -EINVAL; > } > > if (!(flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)) > - return ret; > + goto out; > > memset(&wait, 0, sizeof(wait)); > wait.task = current; > @@ -432,6 +431,9 @@ int drm_syncobj_find_fence(struct drm_file *file_private, > if (wait.node.next) > drm_syncobj_remove_wait(syncobj, &wait); > > +out: > + drm_syncobj_put(syncobj); > + > return ret; > } > EXPORT_SYMBOL(drm_syncobj_find_fence); _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH] drm/syncobj: Fix use-after-free 2021-01-19 13:08 ` Christian König (?) @ 2021-01-20 9:28 ` Daniel Vetter -1 siblings, 0 replies; 12+ messages in thread From: Daniel Vetter @ 2021-01-20 9:28 UTC (permalink / raw) To: Christian König Cc: Daniel Vetter, DRI Development, Intel Graphics Development, Daniel Vetter, Lionel Landwerlin, Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie, Daniel Vetter, stable On Tue, Jan 19, 2021 at 02:08:12PM +0100, Christian König wrote: > Am 19.01.21 um 14:03 schrieb Daniel Vetter: > > While reviewing Christian's annotation patch I noticed that we have a > > user-after-free for the WAIT_FOR_SUBMIT case: We drop the syncobj > > reference before we've completed the waiting. > > > > Of course usually there's nothing bad happening here since userspace > > keeps the reference, but we can't rely on userspace to play nice here! > > > > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> > > Fixes: bc9c80fe01a2 ("drm/syncobj: use the timeline point in drm_syncobj_find_fence v4") > > Cc: Christian König <christian.koenig@amd.com> > > Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com> > > Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> > > Cc: Maxime Ripard <mripard@kernel.org> > > Cc: Thomas Zimmermann <tzimmermann@suse.de> > > Cc: David Airlie <airlied@linux.ie> > > Cc: Daniel Vetter <daniel@ffwll.ch> > > Cc: dri-devel@lists.freedesktop.org > > Cc: <stable@vger.kernel.org> # v5.2+ > > Reviewed-by: Christian König <christian.koenig@amd.com> Pushed to drm-misc-fixes, thanks for reviewing. -Daniel > > > --- > > drivers/gpu/drm/drm_syncobj.c | 8 +++++--- > > 1 file changed, 5 insertions(+), 3 deletions(-) > > > > diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c > > index 6e74e6745eca..349146049849 100644 > > --- a/drivers/gpu/drm/drm_syncobj.c > > +++ b/drivers/gpu/drm/drm_syncobj.c > > @@ -388,19 +388,18 @@ int drm_syncobj_find_fence(struct drm_file *file_private, > > return -ENOENT; > > *fence = drm_syncobj_fence_get(syncobj); > > - drm_syncobj_put(syncobj); > > if (*fence) { > > ret = dma_fence_chain_find_seqno(fence, point); > > if (!ret) > > - return 0; > > + goto out; > > dma_fence_put(*fence); > > } else { > > ret = -EINVAL; > > } > > if (!(flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)) > > - return ret; > > + goto out; > > memset(&wait, 0, sizeof(wait)); > > wait.task = current; > > @@ -432,6 +431,9 @@ int drm_syncobj_find_fence(struct drm_file *file_private, > > if (wait.node.next) > > drm_syncobj_remove_wait(syncobj, &wait); > > +out: > > + drm_syncobj_put(syncobj); > > + > > return ret; > > } > > EXPORT_SYMBOL(drm_syncobj_find_fence); > -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [Intel-gfx] [PATCH] drm/syncobj: Fix use-after-free @ 2021-01-20 9:28 ` Daniel Vetter 0 siblings, 0 replies; 12+ messages in thread From: Daniel Vetter @ 2021-01-20 9:28 UTC (permalink / raw) To: Christian König Cc: Maxime Ripard, David Airlie, Daniel Vetter, Intel Graphics Development, DRI Development, Thomas Zimmermann, Daniel Vetter, stable On Tue, Jan 19, 2021 at 02:08:12PM +0100, Christian König wrote: > Am 19.01.21 um 14:03 schrieb Daniel Vetter: > > While reviewing Christian's annotation patch I noticed that we have a > > user-after-free for the WAIT_FOR_SUBMIT case: We drop the syncobj > > reference before we've completed the waiting. > > > > Of course usually there's nothing bad happening here since userspace > > keeps the reference, but we can't rely on userspace to play nice here! > > > > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> > > Fixes: bc9c80fe01a2 ("drm/syncobj: use the timeline point in drm_syncobj_find_fence v4") > > Cc: Christian König <christian.koenig@amd.com> > > Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com> > > Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> > > Cc: Maxime Ripard <mripard@kernel.org> > > Cc: Thomas Zimmermann <tzimmermann@suse.de> > > Cc: David Airlie <airlied@linux.ie> > > Cc: Daniel Vetter <daniel@ffwll.ch> > > Cc: dri-devel@lists.freedesktop.org > > Cc: <stable@vger.kernel.org> # v5.2+ > > Reviewed-by: Christian König <christian.koenig@amd.com> Pushed to drm-misc-fixes, thanks for reviewing. -Daniel > > > --- > > drivers/gpu/drm/drm_syncobj.c | 8 +++++--- > > 1 file changed, 5 insertions(+), 3 deletions(-) > > > > diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c > > index 6e74e6745eca..349146049849 100644 > > --- a/drivers/gpu/drm/drm_syncobj.c > > +++ b/drivers/gpu/drm/drm_syncobj.c > > @@ -388,19 +388,18 @@ int drm_syncobj_find_fence(struct drm_file *file_private, > > return -ENOENT; > > *fence = drm_syncobj_fence_get(syncobj); > > - drm_syncobj_put(syncobj); > > if (*fence) { > > ret = dma_fence_chain_find_seqno(fence, point); > > if (!ret) > > - return 0; > > + goto out; > > dma_fence_put(*fence); > > } else { > > ret = -EINVAL; > > } > > if (!(flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)) > > - return ret; > > + goto out; > > memset(&wait, 0, sizeof(wait)); > > wait.task = current; > > @@ -432,6 +431,9 @@ int drm_syncobj_find_fence(struct drm_file *file_private, > > if (wait.node.next) > > drm_syncobj_remove_wait(syncobj, &wait); > > +out: > > + drm_syncobj_put(syncobj); > > + > > return ret; > > } > > EXPORT_SYMBOL(drm_syncobj_find_fence); > -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch _______________________________________________ Intel-gfx mailing list Intel-gfx@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/intel-gfx ^ permalink raw reply [flat|nested] 12+ messages in thread
* Re: [PATCH] drm/syncobj: Fix use-after-free @ 2021-01-20 9:28 ` Daniel Vetter 0 siblings, 0 replies; 12+ messages in thread From: Daniel Vetter @ 2021-01-20 9:28 UTC (permalink / raw) To: Christian König Cc: David Airlie, Daniel Vetter, Intel Graphics Development, DRI Development, Thomas Zimmermann, Daniel Vetter, stable On Tue, Jan 19, 2021 at 02:08:12PM +0100, Christian König wrote: > Am 19.01.21 um 14:03 schrieb Daniel Vetter: > > While reviewing Christian's annotation patch I noticed that we have a > > user-after-free for the WAIT_FOR_SUBMIT case: We drop the syncobj > > reference before we've completed the waiting. > > > > Of course usually there's nothing bad happening here since userspace > > keeps the reference, but we can't rely on userspace to play nice here! > > > > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> > > Fixes: bc9c80fe01a2 ("drm/syncobj: use the timeline point in drm_syncobj_find_fence v4") > > Cc: Christian König <christian.koenig@amd.com> > > Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com> > > Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> > > Cc: Maxime Ripard <mripard@kernel.org> > > Cc: Thomas Zimmermann <tzimmermann@suse.de> > > Cc: David Airlie <airlied@linux.ie> > > Cc: Daniel Vetter <daniel@ffwll.ch> > > Cc: dri-devel@lists.freedesktop.org > > Cc: <stable@vger.kernel.org> # v5.2+ > > Reviewed-by: Christian König <christian.koenig@amd.com> Pushed to drm-misc-fixes, thanks for reviewing. -Daniel > > > --- > > drivers/gpu/drm/drm_syncobj.c | 8 +++++--- > > 1 file changed, 5 insertions(+), 3 deletions(-) > > > > diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c > > index 6e74e6745eca..349146049849 100644 > > --- a/drivers/gpu/drm/drm_syncobj.c > > +++ b/drivers/gpu/drm/drm_syncobj.c > > @@ -388,19 +388,18 @@ int drm_syncobj_find_fence(struct drm_file *file_private, > > return -ENOENT; > > *fence = drm_syncobj_fence_get(syncobj); > > - drm_syncobj_put(syncobj); > > if (*fence) { > > ret = dma_fence_chain_find_seqno(fence, point); > > if (!ret) > > - return 0; > > + goto out; > > dma_fence_put(*fence); > > } else { > > ret = -EINVAL; > > } > > if (!(flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)) > > - return ret; > > + goto out; > > memset(&wait, 0, sizeof(wait)); > > wait.task = current; > > @@ -432,6 +431,9 @@ int drm_syncobj_find_fence(struct drm_file *file_private, > > if (wait.node.next) > > drm_syncobj_remove_wait(syncobj, &wait); > > +out: > > + drm_syncobj_put(syncobj); > > + > > return ret; > > } > > EXPORT_SYMBOL(drm_syncobj_find_fence); > -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel ^ permalink raw reply [flat|nested] 12+ messages in thread
* [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for drm/syncobj: Fix use-after-free 2021-01-19 13:03 ` Daniel Vetter ` (2 preceding siblings ...) (?) @ 2021-01-19 16:34 ` Patchwork -1 siblings, 0 replies; 12+ messages in thread From: Patchwork @ 2021-01-19 16:34 UTC (permalink / raw) To: Daniel Vetter; +Cc: intel-gfx == Series Details == Series: drm/syncobj: Fix use-after-free URL : https://patchwork.freedesktop.org/series/86043/ State : warning == Summary == $ dim checkpatch origin/drm-tip 9ced0389047e drm/syncobj: Fix use-after-free -:64: WARNING:FROM_SIGN_OFF_MISMATCH: From:/Signed-off-by: email address mismatch: 'From: Daniel Vetter <daniel.vetter@ffwll.ch>' != 'Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>' total: 0 errors, 1 warnings, 0 checks, 30 lines checked _______________________________________________ Intel-gfx mailing list Intel-gfx@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/intel-gfx ^ permalink raw reply [flat|nested] 12+ messages in thread
* [Intel-gfx] ✓ Fi.CI.BAT: success for drm/syncobj: Fix use-after-free 2021-01-19 13:03 ` Daniel Vetter ` (3 preceding siblings ...) (?) @ 2021-01-19 17:03 ` Patchwork -1 siblings, 0 replies; 12+ messages in thread From: Patchwork @ 2021-01-19 17:03 UTC (permalink / raw) To: Daniel Vetter; +Cc: intel-gfx [-- Attachment #1.1: Type: text/plain, Size: 4033 bytes --] == Series Details == Series: drm/syncobj: Fix use-after-free URL : https://patchwork.freedesktop.org/series/86043/ State : success == Summary == CI Bug Log - changes from CI_DRM_9643 -> Patchwork_19407 ==================================================== Summary ------- **SUCCESS** No regressions found. External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/index.html Known issues ------------ Here are the changes found in Patchwork_19407 that come from known issues: ### CI changes ### ### IGT changes ### #### Issues hit #### * igt@i915_selftest@live@execlists: - fi-bsw-nick: [PASS][1] -> [INCOMPLETE][2] ([i915#2940]) [1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/fi-bsw-nick/igt@i915_selftest@live@execlists.html [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/fi-bsw-nick/igt@i915_selftest@live@execlists.html * igt@prime_self_import@basic-with_two_bos: - fi-tgl-y: [PASS][3] -> [DMESG-WARN][4] ([i915#402]) [3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/fi-tgl-y/igt@prime_self_import@basic-with_two_bos.html [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/fi-tgl-y/igt@prime_self_import@basic-with_two_bos.html * igt@runner@aborted: - fi-bsw-nick: NOTRUN -> [FAIL][5] ([i915#1436]) [5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/fi-bsw-nick/igt@runner@aborted.html #### Possible fixes #### * igt@i915_selftest@live@active: - fi-skl-6600u: [DMESG-FAIL][6] ([i915#2291] / [i915#666]) -> [PASS][7] [6]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/fi-skl-6600u/igt@i915_selftest@live@active.html [7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/fi-skl-6600u/igt@i915_selftest@live@active.html * igt@prime_self_import@basic-with_one_bo_two_files: - fi-tgl-y: [DMESG-WARN][8] ([i915#402]) -> [PASS][9] [8]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/fi-tgl-y/igt@prime_self_import@basic-with_one_bo_two_files.html [9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/fi-tgl-y/igt@prime_self_import@basic-with_one_bo_two_files.html #### Warnings #### * igt@debugfs_test@read_all_entries: - fi-tgl-y: [DMESG-WARN][10] ([i915#402]) -> [DMESG-WARN][11] ([i915#1982] / [i915#402]) [10]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/fi-tgl-y/igt@debugfs_test@read_all_entries.html [11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/fi-tgl-y/igt@debugfs_test@read_all_entries.html {name}: This element is suppressed. This means it is ignored when computing the status of the difference (SUCCESS, WARNING, or FAILURE). [i915#1436]: https://gitlab.freedesktop.org/drm/intel/issues/1436 [i915#1982]: https://gitlab.freedesktop.org/drm/intel/issues/1982 [i915#2291]: https://gitlab.freedesktop.org/drm/intel/issues/2291 [i915#2601]: https://gitlab.freedesktop.org/drm/intel/issues/2601 [i915#2788]: https://gitlab.freedesktop.org/drm/intel/issues/2788 [i915#2940]: https://gitlab.freedesktop.org/drm/intel/issues/2940 [i915#402]: https://gitlab.freedesktop.org/drm/intel/issues/402 [i915#666]: https://gitlab.freedesktop.org/drm/intel/issues/666 Participating hosts (42 -> 38) ------------------------------ Additional (1): fi-dg1-1 Missing (5): fi-ilk-m540 fi-hsw-4200u fi-bsw-cyan fi-ctg-p8600 fi-bdw-samus Build changes ------------- * Linux: CI_DRM_9643 -> Patchwork_19407 CI-20190529: 20190529 CI_DRM_9643: fabbcd086b7f667f0e0cce8eeb26a7b5c7120782 @ git://anongit.freedesktop.org/gfx-ci/linux IGT_5960: ace82fcd5f3623f8dde7c220a825873dc53dfae4 @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools Patchwork_19407: 9ced0389047e68a5f718a091ebc892af5fcab69a @ git://anongit.freedesktop.org/gfx-ci/linux == Linux commits == 9ced0389047e drm/syncobj: Fix use-after-free == Logs == For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/index.html [-- Attachment #1.2: Type: text/html, Size: 4850 bytes --] [-- Attachment #2: Type: text/plain, Size: 160 bytes --] _______________________________________________ Intel-gfx mailing list Intel-gfx@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/intel-gfx ^ permalink raw reply [flat|nested] 12+ messages in thread
* [Intel-gfx] ✗ Fi.CI.IGT: failure for drm/syncobj: Fix use-after-free 2021-01-19 13:03 ` Daniel Vetter ` (4 preceding siblings ...) (?) @ 2021-01-19 19:32 ` Patchwork -1 siblings, 0 replies; 12+ messages in thread From: Patchwork @ 2021-01-19 19:32 UTC (permalink / raw) To: Daniel Vetter; +Cc: intel-gfx [-- Attachment #1.1: Type: text/plain, Size: 22264 bytes --] == Series Details == Series: drm/syncobj: Fix use-after-free URL : https://patchwork.freedesktop.org/series/86043/ State : failure == Summary == CI Bug Log - changes from CI_DRM_9643_full -> Patchwork_19407_full ==================================================== Summary ------- **FAILURE** Serious unknown changes coming with Patchwork_19407_full absolutely need to be verified manually. If you think the reported changes have nothing to do with the changes introduced in Patchwork_19407_full, please notify your bug team to allow them to document this new failure mode, which will reduce false positives in CI. Possible new issues ------------------- Here are the unknown changes that may have been introduced in Patchwork_19407_full: ### IGT changes ### #### Possible regressions #### * igt@i915_pm_rps@reset: - shard-snb: [PASS][1] -> [FAIL][2] [1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-snb5/igt@i915_pm_rps@reset.html [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-snb4/igt@i915_pm_rps@reset.html Known issues ------------ Here are the changes found in Patchwork_19407_full that come from known issues: ### IGT changes ### #### Issues hit #### * igt@drm_import_export@flink: - shard-tglb: [PASS][3] -> [INCOMPLETE][4] ([i915#750]) [3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-tglb5/igt@drm_import_export@flink.html [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-tglb2/igt@drm_import_export@flink.html * igt@gem_ctx_persistence@close-replace-race: - shard-kbl: [PASS][5] -> [TIMEOUT][6] ([i915#2918]) [5]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-kbl2/igt@gem_ctx_persistence@close-replace-race.html [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-kbl7/igt@gem_ctx_persistence@close-replace-race.html - shard-glk: [PASS][7] -> [TIMEOUT][8] ([i915#2918]) [7]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-glk5/igt@gem_ctx_persistence@close-replace-race.html [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-glk1/igt@gem_ctx_persistence@close-replace-race.html * igt@gem_ctx_persistence@legacy-engines-mixed-process: - shard-hsw: NOTRUN -> [SKIP][9] ([fdo#109271] / [i915#1099]) +3 similar issues [9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-hsw4/igt@gem_ctx_persistence@legacy-engines-mixed-process.html * igt@gem_eio@kms: - shard-snb: [PASS][10] -> [SKIP][11] ([fdo#109271]) [10]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-snb4/igt@gem_eio@kms.html [11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-snb6/igt@gem_eio@kms.html * igt@gem_exec_balancer@waits: - shard-tglb: [PASS][12] -> [INCOMPLETE][13] ([i915#2931]) [12]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-tglb6/igt@gem_exec_balancer@waits.html [13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-tglb6/igt@gem_exec_balancer@waits.html * igt@gem_exec_fair@basic-pace-share@rcs0: - shard-tglb: [PASS][14] -> [FAIL][15] ([i915#2842]) +1 similar issue [14]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-tglb1/igt@gem_exec_fair@basic-pace-share@rcs0.html [15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-tglb1/igt@gem_exec_fair@basic-pace-share@rcs0.html * igt@gem_exec_fair@basic-pace-solo@rcs0: - shard-glk: [PASS][16] -> [FAIL][17] ([i915#2842]) [16]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-glk7/igt@gem_exec_fair@basic-pace-solo@rcs0.html [17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-glk3/igt@gem_exec_fair@basic-pace-solo@rcs0.html - shard-kbl: [PASS][18] -> [FAIL][19] ([i915#2842]) [18]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-kbl2/igt@gem_exec_fair@basic-pace-solo@rcs0.html [19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-kbl7/igt@gem_exec_fair@basic-pace-solo@rcs0.html * igt@gem_exec_reloc@basic-wide-active@vcs1: - shard-iclb: NOTRUN -> [FAIL][20] ([i915#2389]) [20]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-iclb4/igt@gem_exec_reloc@basic-wide-active@vcs1.html * igt@gem_ppgtt@flink-and-close-vma-leak: - shard-skl: [PASS][21] -> [FAIL][22] ([i915#644]) [21]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-skl5/igt@gem_ppgtt@flink-and-close-vma-leak.html [22]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl6/igt@gem_ppgtt@flink-and-close-vma-leak.html * igt@gem_userptr_blits@process-exit-mmap@wc: - shard-hsw: NOTRUN -> [SKIP][23] ([fdo#109271]) +214 similar issues [23]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-hsw4/igt@gem_userptr_blits@process-exit-mmap@wc.html * igt@i915_suspend@forcewake: - shard-skl: [PASS][24] -> [INCOMPLETE][25] ([i915#636]) [24]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-skl10/igt@i915_suspend@forcewake.html [25]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl7/igt@i915_suspend@forcewake.html * igt@kms_big_joiner@basic: - shard-skl: NOTRUN -> [SKIP][26] ([fdo#109271] / [i915#2705]) [26]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl6/igt@kms_big_joiner@basic.html * igt@kms_chamelium@common-hpd-after-suspend: - shard-hsw: NOTRUN -> [SKIP][27] ([fdo#109271] / [fdo#111827]) +16 similar issues [27]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-hsw4/igt@kms_chamelium@common-hpd-after-suspend.html * igt@kms_color_chamelium@pipe-d-ctm-red-to-blue: - shard-skl: NOTRUN -> [SKIP][28] ([fdo#109271] / [fdo#111827]) +6 similar issues [28]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl6/igt@kms_color_chamelium@pipe-d-ctm-red-to-blue.html * igt@kms_cursor_crc@pipe-b-cursor-128x42-sliding: - shard-skl: [PASS][29] -> [FAIL][30] ([i915#54]) +1 similar issue [29]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-skl6/igt@kms_cursor_crc@pipe-b-cursor-128x42-sliding.html [30]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl4/igt@kms_cursor_crc@pipe-b-cursor-128x42-sliding.html * igt@kms_cursor_crc@pipe-b-cursor-64x21-onscreen: - shard-skl: NOTRUN -> [FAIL][31] ([i915#54]) +2 similar issues [31]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl6/igt@kms_cursor_crc@pipe-b-cursor-64x21-onscreen.html * igt@kms_cursor_crc@pipe-c-cursor-suspend: - shard-skl: [PASS][32] -> [INCOMPLETE][33] ([i915#300]) [32]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-skl3/igt@kms_cursor_crc@pipe-c-cursor-suspend.html [33]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl9/igt@kms_cursor_crc@pipe-c-cursor-suspend.html * igt@kms_cursor_edge_walk@pipe-a-64x64-top-edge: - shard-glk: [PASS][34] -> [DMESG-WARN][35] ([i915#118] / [i915#95]) +1 similar issue [34]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-glk6/igt@kms_cursor_edge_walk@pipe-a-64x64-top-edge.html [35]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-glk2/igt@kms_cursor_edge_walk@pipe-a-64x64-top-edge.html * igt@kms_cursor_legacy@flip-vs-cursor-atomic: - shard-skl: [PASS][36] -> [FAIL][37] ([i915#2346]) +1 similar issue [36]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-skl4/igt@kms_cursor_legacy@flip-vs-cursor-atomic.html [37]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl7/igt@kms_cursor_legacy@flip-vs-cursor-atomic.html * igt@kms_flip@blocking-absolute-wf_vblank-interruptible@a-dp1: - shard-kbl: [PASS][38] -> [DMESG-WARN][39] ([i915#165]) [38]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-kbl3/igt@kms_flip@blocking-absolute-wf_vblank-interruptible@a-dp1.html [39]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-kbl2/igt@kms_flip@blocking-absolute-wf_vblank-interruptible@a-dp1.html * igt@kms_flip@flip-vs-expired-vblank-interruptible@b-dp1: - shard-apl: [PASS][40] -> [FAIL][41] ([i915#79]) [40]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-apl2/igt@kms_flip@flip-vs-expired-vblank-interruptible@b-dp1.html [41]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-apl1/igt@kms_flip@flip-vs-expired-vblank-interruptible@b-dp1.html * igt@kms_flip@flip-vs-expired-vblank-interruptible@c-edp1: - shard-skl: [PASS][42] -> [FAIL][43] ([i915#79]) [42]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-skl9/igt@kms_flip@flip-vs-expired-vblank-interruptible@c-edp1.html [43]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl2/igt@kms_flip@flip-vs-expired-vblank-interruptible@c-edp1.html * igt@kms_flip@flip-vs-expired-vblank@a-edp1: - shard-tglb: [PASS][44] -> [FAIL][45] ([i915#2598]) [44]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-tglb8/igt@kms_flip@flip-vs-expired-vblank@a-edp1.html [45]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-tglb7/igt@kms_flip@flip-vs-expired-vblank@a-edp1.html * igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-indfb-msflip-blt: - shard-skl: NOTRUN -> [SKIP][46] ([fdo#109271]) +48 similar issues [46]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl2/igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-indfb-msflip-blt.html * igt@kms_pipe_crc_basic@read-crc-pipe-a: - shard-glk: [PASS][47] -> [FAIL][48] ([i915#53]) [47]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-glk6/igt@kms_pipe_crc_basic@read-crc-pipe-a.html [48]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-glk2/igt@kms_pipe_crc_basic@read-crc-pipe-a.html * igt@kms_pipe_crc_basic@read-crc-pipe-d: - shard-skl: NOTRUN -> [SKIP][49] ([fdo#109271] / [i915#533]) [49]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl6/igt@kms_pipe_crc_basic@read-crc-pipe-d.html * igt@kms_plane@plane-panning-bottom-right-suspend-pipe-a-planes: - shard-skl: [PASS][50] -> [INCOMPLETE][51] ([i915#648]) [50]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-skl5/igt@kms_plane@plane-panning-bottom-right-suspend-pipe-a-planes.html [51]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl6/igt@kms_plane@plane-panning-bottom-right-suspend-pipe-a-planes.html * igt@kms_plane_alpha_blend@pipe-a-alpha-7efc: - shard-skl: NOTRUN -> [FAIL][52] ([fdo#108145] / [i915#265]) +1 similar issue [52]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl2/igt@kms_plane_alpha_blend@pipe-a-alpha-7efc.html * igt@kms_psr2_sf@overlay-plane-update-sf-dmg-area-5: - shard-skl: NOTRUN -> [SKIP][53] ([fdo#109271] / [i915#658]) [53]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl6/igt@kms_psr2_sf@overlay-plane-update-sf-dmg-area-5.html * igt@kms_psr2_su@frontbuffer: - shard-iclb: [PASS][54] -> [SKIP][55] ([fdo#109642] / [fdo#111068]) [54]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-iclb2/igt@kms_psr2_su@frontbuffer.html [55]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-iclb4/igt@kms_psr2_su@frontbuffer.html * igt@kms_psr@psr2_cursor_render: - shard-iclb: [PASS][56] -> [SKIP][57] ([fdo#109441]) +1 similar issue [56]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-iclb2/igt@kms_psr@psr2_cursor_render.html [57]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-iclb1/igt@kms_psr@psr2_cursor_render.html #### Possible fixes #### * igt@gem_exec_fair@basic-none-share@rcs0: - shard-tglb: [FAIL][58] ([i915#2842]) -> [PASS][59] [58]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-tglb3/igt@gem_exec_fair@basic-none-share@rcs0.html [59]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-tglb7/igt@gem_exec_fair@basic-none-share@rcs0.html * igt@gem_exec_fair@basic-none@vecs0: - shard-apl: [FAIL][60] ([i915#2842]) -> [PASS][61] [60]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-apl3/igt@gem_exec_fair@basic-none@vecs0.html [61]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-apl8/igt@gem_exec_fair@basic-none@vecs0.html * igt@gem_exec_schedule@u-fairslice@vecs0: - shard-skl: [DMESG-WARN][62] ([i915#1610] / [i915#2803]) -> [PASS][63] [62]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-skl9/igt@gem_exec_schedule@u-fairslice@vecs0.html [63]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl2/igt@gem_exec_schedule@u-fairslice@vecs0.html * igt@i915_pm_dc@dc6-psr: - shard-iclb: [FAIL][64] ([i915#454]) -> [PASS][65] [64]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-iclb6/igt@i915_pm_dc@dc6-psr.html [65]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-iclb7/igt@i915_pm_dc@dc6-psr.html * igt@kms_cursor_crc@pipe-b-cursor-256x256-sliding: - shard-skl: [FAIL][66] ([i915#54]) -> [PASS][67] +6 similar issues [66]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-skl1/igt@kms_cursor_crc@pipe-b-cursor-256x256-sliding.html [67]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl9/igt@kms_cursor_crc@pipe-b-cursor-256x256-sliding.html * igt@kms_hdr@bpc-switch-dpms: - shard-skl: [FAIL][68] ([i915#1188]) -> [PASS][69] [68]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-skl6/igt@kms_hdr@bpc-switch-dpms.html [69]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl9/igt@kms_hdr@bpc-switch-dpms.html * igt@kms_psr@psr2_sprite_plane_move: - shard-iclb: [SKIP][70] ([fdo#109441]) -> [PASS][71] +2 similar issues [70]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-iclb4/igt@kms_psr@psr2_sprite_plane_move.html [71]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-iclb2/igt@kms_psr@psr2_sprite_plane_move.html * igt@kms_psr@suspend: - shard-skl: [INCOMPLETE][72] ([i915#198]) -> [PASS][73] +1 similar issue [72]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-skl2/igt@kms_psr@suspend.html [73]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl2/igt@kms_psr@suspend.html #### Warnings #### * igt@gem_vm_create@destroy-race: - shard-tglb: [FAIL][74] ([i915#2822]) -> [TIMEOUT][75] ([i915#2795]) [74]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-tglb2/igt@gem_vm_create@destroy-race.html [75]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-tglb6/igt@gem_vm_create@destroy-race.html * igt@i915_pm_dc@dc3co-vpb-simulation: - shard-iclb: [SKIP][76] ([i915#588]) -> [SKIP][77] ([i915#658]) [76]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-iclb2/igt@i915_pm_dc@dc3co-vpb-simulation.html [77]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-iclb4/igt@i915_pm_dc@dc3co-vpb-simulation.html * igt@i915_pm_rc6_residency@rc6-fence: - shard-iclb: [WARN][78] ([i915#2681] / [i915#2684]) -> [WARN][79] ([i915#1804] / [i915#2684]) [78]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-iclb1/igt@i915_pm_rc6_residency@rc6-fence.html [79]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-iclb3/igt@i915_pm_rc6_residency@rc6-fence.html * igt@i915_pm_rc6_residency@rc6-idle: - shard-iclb: [WARN][80] ([i915#1804] / [i915#2684]) -> [WARN][81] ([i915#2681] / [i915#2684]) [80]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-iclb4/igt@i915_pm_rc6_residency@rc6-idle.html [81]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-iclb1/igt@i915_pm_rc6_residency@rc6-idle.html * igt@kms_dp_dsc@basic-dsc-enable-edp: - shard-iclb: [DMESG-WARN][82] ([i915#1226]) -> [SKIP][83] ([fdo#109349]) [82]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-iclb2/igt@kms_dp_dsc@basic-dsc-enable-edp.html [83]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-iclb4/igt@kms_dp_dsc@basic-dsc-enable-edp.html * igt@kms_psr2_sf@plane-move-sf-dmg-area-1: - shard-iclb: [SKIP][84] ([i915#2920]) -> [SKIP][85] ([i915#658]) +1 similar issue [84]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-iclb2/igt@kms_psr2_sf@plane-move-sf-dmg-area-1.html [85]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-iclb1/igt@kms_psr2_sf@plane-move-sf-dmg-area-1.html * igt@kms_psr2_sf@primary-plane-update-sf-dmg-area-2: - shard-iclb: [SKIP][86] ([i915#658]) -> [SKIP][87] ([i915#2920]) +2 similar issues [86]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-iclb5/igt@kms_psr2_sf@primary-plane-update-sf-dmg-area-2.html [87]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-iclb2/igt@kms_psr2_sf@primary-plane-update-sf-dmg-area-2.html * igt@runner@aborted: - shard-kbl: [FAIL][88] ([i915#2295] / [i915#2505]) -> [FAIL][89] ([i915#2295]) [88]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-kbl6/igt@runner@aborted.html [89]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-kbl2/igt@runner@aborted.html - shard-skl: ([FAIL][90], [FAIL][91]) ([i915#2295] / [i915#2426]) -> ([FAIL][92], [FAIL][93]) ([i915#1814] / [i915#2029] / [i915#2295]) [90]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-skl1/igt@runner@aborted.html [91]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9643/shard-skl9/igt@runner@aborted.html [92]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl3/igt@runner@aborted.html [93]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/shard-skl9/igt@runner@aborted.html {name}: This element is suppressed. This means it is ignored when computing the status of the difference (SUCCESS, WARNING, or FAILURE). [fdo#108145]: https://bugs.freedesktop.org/show_bug.cgi?id=108145 [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 [fdo#109349]: https://bugs.freedesktop.org/show_bug.cgi?id=109349 [fdo#109441]: https://bugs.freedesktop.org/show_bug.cgi?id=109441 [fdo#109642]: https://bugs.freedesktop.org/show_bug.cgi?id=109642 [fdo#111068]: https://bugs.freedesktop.org/show_bug.cgi?id=111068 [fdo#111827]: https://bugs.freedesktop.org/show_bug.cgi?id=111827 [i915#1099]: https://gitlab.freedesktop.org/drm/intel/issues/1099 [i915#118]: https://gitlab.freedesktop.org/drm/intel/issues/118 [i915#1188]: https://gitlab.freedesktop.org/drm/intel/issues/1188 [i915#1226]: https://gitlab.freedesktop.org/drm/intel/issues/1226 [i915#1610]: https://gitlab.freedesktop.org/drm/intel/issues/1610 [i915#165]: https://gitlab.freedesktop.org/drm/intel/issues/165 [i915#1804]: https://gitlab.freedesktop.org/drm/intel/issues/1804 [i915#1814]: https://gitlab.freedesktop.org/drm/intel/issues/1814 [i915#198]: https://gitlab.freedesktop.org/drm/intel/issues/198 [i915#2029]: https://gitlab.freedesktop.org/drm/intel/issues/2029 [i915#2295]: https://gitlab.freedesktop.org/drm/intel/issues/2295 [i915#2346]: https://gitlab.freedesktop.org/drm/intel/issues/2346 [i915#2389]: https://gitlab.freedesktop.org/drm/intel/issues/2389 [i915#2426]: https://gitlab.freedesktop.org/drm/intel/issues/2426 [i915#2505]: https://gitlab.freedesktop.org/drm/intel/issues/2505 [i915#2598]: https://gitlab.freedesktop.org/drm/intel/issues/2598 [i915#265]: https://gitlab.freedesktop.org/drm/intel/issues/265 [i915#2681]: https://gitlab.freedesktop.org/drm/intel/issues/2681 [i915#2684]: https://gitlab.freedesktop.org/drm/intel/issues/2684 [i915#2705]: https://gitlab.freedesktop.org/drm/intel/issues/2705 [i915#2795]: https://gitlab.freedesktop.org/drm/intel/issues/2795 [i915#2803]: https://gitlab.freedesktop.org/drm/intel/issues/2803 [i915#2822]: https://gitlab.freedesktop.org/drm/intel/issues/2822 [i915#2842]: https://gitlab.freedesktop.org/drm/intel/issues/2842 [i915#2918]: https://gitlab.freedesktop.org/drm/intel/issues/2918 [i915#2920]: https://gitlab.freedesktop.org/drm/intel/issues/2920 [i915#2931]: https://gitlab.freedesktop.org/drm/intel/issues/2931 [i915#300]: https://gitlab.freedesktop.org/drm/intel/issues/300 [i915#454]: https://gitlab.freedesktop.org/drm/intel/issues/454 [i915#53]: https://gitlab.freedesktop.org/drm/intel/issues/53 [i915#533]: https://gitlab.freedesktop.org/drm/intel/issues/533 [i915#54]: https://gitlab.freedesktop.org/drm/intel/issues/54 [i915#588]: https://gitlab.freedesktop.org/drm/intel/issues/588 [i915#636]: https://gitlab.freedesktop.org/drm/intel/issues/636 [i915#644]: https://gitlab.freedesktop.org/drm/intel/issues/644 [i915#648]: https://gitlab.freedesktop.org/drm/intel/issues/648 [i915#658]: https://gitlab.freedesktop.org/drm/intel/issues/658 [i915#750]: https://gitlab.freedesktop.org/drm/intel/issues/750 [i915#79]: https://gitlab.freedesktop.org/drm/intel/issues/79 [i915#95]: https://gitlab.freedesktop.org/drm/intel/issues/95 Participating hosts (10 -> 10) ------------------------------ No changes in participating hosts Build changes ------------- * Linux: CI_DRM_9643 -> Patchwork_19407 CI-20190529: 20190529 CI_DRM_9643: fabbcd086b7f667f0e0cce8eeb26a7b5c7120782 @ git://anongit.freedesktop.org/gfx-ci/linux IGT_5960: ace82fcd5f3623f8dde7c220a825873dc53dfae4 @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools Patchwork_19407: 9ced0389047e68a5f718a091ebc892af5fcab69a @ git://anongit.freedesktop.org/gfx-ci/linux piglit_4509: fdc5a4ca11124ab8413c7988896eec4c97336694 @ git://anongit.freedesktop.org/piglit == Logs == For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19407/index.html [-- Attachment #1.2: Type: text/html, Size: 26095 bytes --] [-- Attachment #2: Type: text/plain, Size: 160 bytes --] _______________________________________________ Intel-gfx mailing list Intel-gfx@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/intel-gfx ^ permalink raw reply [flat|nested] 12+ messages in thread
end of thread, other threads:[~2021-01-20 11:02 UTC | newest] Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2021-01-19 13:03 [PATCH] drm/syncobj: Fix use-after-free Daniel Vetter 2021-01-19 13:03 ` [Intel-gfx] " Daniel Vetter 2021-01-19 13:03 ` Daniel Vetter 2021-01-19 13:08 ` Christian König 2021-01-19 13:08 ` [Intel-gfx] " Christian König 2021-01-19 13:08 ` Christian König 2021-01-20 9:28 ` Daniel Vetter 2021-01-20 9:28 ` [Intel-gfx] " Daniel Vetter 2021-01-20 9:28 ` Daniel Vetter 2021-01-19 16:34 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for " Patchwork 2021-01-19 17:03 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork 2021-01-19 19:32 ` [Intel-gfx] ✗ Fi.CI.IGT: failure " Patchwork
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.