* [Intel-gfx] [PATCH] drm/i9i5/gt: Fix a double free in gen8_preallocate_top_level_pdp
@ 2021-04-26 12:43 ` Lv Yunlong
0 siblings, 0 replies; 8+ messages in thread
From: Lv Yunlong @ 2021-04-26 12:43 UTC (permalink / raw)
To: jani.nikula, joonas.lahtinen, rodrigo.vivi, airlied, daniel, chris
Cc: intel-gfx, Lv Yunlong, linux-kernel, dri-devel
Our code analyzer reported a double free bug.
In gen8_preallocate_top_level_pdp, pde and pde->pt.base are allocated
via alloc_pd(vm) with one reference. If pin_pt_dma() failed, pde->pt.base
is freed by i915_gem_object_put() with a reference dropped. Then free_pd
calls free_px() defined in intel_ppgtt.c, which calls i915_gem_object_put()
to put pde->pt.base again.
As pde->pt.base is protected by refcount, so the second put will not free
pde->pt.base actually. But, maybe it is better to remove the first put?
Fixes: 82adf901138cc ("drm/i915/gt: Shrink i915_page_directory's slab bucket")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
---
drivers/gpu/drm/i915/gt/gen8_ppgtt.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/gt/gen8_ppgtt.c b/drivers/gpu/drm/i915/gt/gen8_ppgtt.c
index 755522ced60d..3ae16945bd43 100644
--- a/drivers/gpu/drm/i915/gt/gen8_ppgtt.c
+++ b/drivers/gpu/drm/i915/gt/gen8_ppgtt.c
@@ -630,7 +630,6 @@ static int gen8_preallocate_top_level_pdp(struct i915_ppgtt *ppgtt)
err = pin_pt_dma(vm, pde->pt.base);
if (err) {
- i915_gem_object_put(pde->pt.base);
free_pd(vm, pde);
return err;
}
--
2.25.1
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply related [flat|nested] 8+ messages in thread* [PATCH] drm/i9i5/gt: Fix a double free in gen8_preallocate_top_level_pdp
@ 2021-04-26 12:43 ` Lv Yunlong
0 siblings, 0 replies; 8+ messages in thread
From: Lv Yunlong @ 2021-04-26 12:43 UTC (permalink / raw)
To: jani.nikula, joonas.lahtinen, rodrigo.vivi, airlied, daniel, chris
Cc: intel-gfx, Lv Yunlong, linux-kernel, dri-devel
Our code analyzer reported a double free bug.
In gen8_preallocate_top_level_pdp, pde and pde->pt.base are allocated
via alloc_pd(vm) with one reference. If pin_pt_dma() failed, pde->pt.base
is freed by i915_gem_object_put() with a reference dropped. Then free_pd
calls free_px() defined in intel_ppgtt.c, which calls i915_gem_object_put()
to put pde->pt.base again.
As pde->pt.base is protected by refcount, so the second put will not free
pde->pt.base actually. But, maybe it is better to remove the first put?
Fixes: 82adf901138cc ("drm/i915/gt: Shrink i915_page_directory's slab bucket")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
---
drivers/gpu/drm/i915/gt/gen8_ppgtt.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/gt/gen8_ppgtt.c b/drivers/gpu/drm/i915/gt/gen8_ppgtt.c
index 755522ced60d..3ae16945bd43 100644
--- a/drivers/gpu/drm/i915/gt/gen8_ppgtt.c
+++ b/drivers/gpu/drm/i915/gt/gen8_ppgtt.c
@@ -630,7 +630,6 @@ static int gen8_preallocate_top_level_pdp(struct i915_ppgtt *ppgtt)
err = pin_pt_dma(vm, pde->pt.base);
if (err) {
- i915_gem_object_put(pde->pt.base);
free_pd(vm, pde);
return err;
}
--
2.25.1
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply related [flat|nested] 8+ messages in thread* [Intel-gfx] ✓ Fi.CI.BAT: success for drm/i9i5/gt: Fix a double free in gen8_preallocate_top_level_pdp
2021-04-26 12:43 ` Lv Yunlong
(?)
(?)
@ 2021-04-26 18:11 ` Patchwork
-1 siblings, 0 replies; 8+ messages in thread
From: Patchwork @ 2021-04-26 18:11 UTC (permalink / raw)
To: Lv Yunlong; +Cc: intel-gfx
[-- Attachment #1.1: Type: text/plain, Size: 2661 bytes --]
== Series Details ==
Series: drm/i9i5/gt: Fix a double free in gen8_preallocate_top_level_pdp
URL : https://patchwork.freedesktop.org/series/89500/
State : success
== Summary ==
CI Bug Log - changes from CI_DRM_10010 -> Patchwork_19992
====================================================
Summary
-------
**SUCCESS**
No regressions found.
External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/index.html
Known issues
------------
Here are the changes found in Patchwork_19992 that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@gem_exec_suspend@basic-s0:
- fi-tgl-u2: [PASS][1] -> [FAIL][2] ([i915#1888])
[1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/fi-tgl-u2/igt@gem_exec_suspend@basic-s0.html
[2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/fi-tgl-u2/igt@gem_exec_suspend@basic-s0.html
* igt@i915_selftest@live@execlists:
- fi-bsw-kefka: [PASS][3] -> [INCOMPLETE][4] ([i915#2782] / [i915#2940])
[3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/fi-bsw-kefka/igt@i915_selftest@live@execlists.html
[4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/fi-bsw-kefka/igt@i915_selftest@live@execlists.html
* igt@runner@aborted:
- fi-bsw-kefka: NOTRUN -> [FAIL][5] ([i915#1436])
[5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/fi-bsw-kefka/igt@runner@aborted.html
{name}: This element is suppressed. This means it is ignored when computing
the status of the difference (SUCCESS, WARNING, or FAILURE).
[i915#1436]: https://gitlab.freedesktop.org/drm/intel/issues/1436
[i915#1888]: https://gitlab.freedesktop.org/drm/intel/issues/1888
[i915#2782]: https://gitlab.freedesktop.org/drm/intel/issues/2782
[i915#2940]: https://gitlab.freedesktop.org/drm/intel/issues/2940
[i915#3303]: https://gitlab.freedesktop.org/drm/intel/issues/3303
Participating hosts (40 -> 38)
------------------------------
Missing (2): fi-bsw-cyan fi-bdw-samus
Build changes
-------------
* Linux: CI_DRM_10010 -> Patchwork_19992
CI-20190529: 20190529
CI_DRM_10010: 58acb454bb6b897117656a2cba0edce64e3ee1dc @ git://anongit.freedesktop.org/gfx-ci/linux
IGT_6075: ccf602c569257291045415ff504a6d2460986c28 @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools
Patchwork_19992: 8a9defaba2621a654c95903bf97297815d0c80f3 @ git://anongit.freedesktop.org/gfx-ci/linux
== Linux commits ==
8a9defaba262 drm/i9i5/gt: Fix a double free in gen8_preallocate_top_level_pdp
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/index.html
[-- Attachment #1.2: Type: text/html, Size: 3258 bytes --]
[-- Attachment #2: Type: text/plain, Size: 160 bytes --]
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 8+ messages in thread* [Intel-gfx] ✗ Fi.CI.IGT: failure for drm/i9i5/gt: Fix a double free in gen8_preallocate_top_level_pdp
2021-04-26 12:43 ` Lv Yunlong
` (2 preceding siblings ...)
(?)
@ 2021-04-27 1:04 ` Patchwork
-1 siblings, 0 replies; 8+ messages in thread
From: Patchwork @ 2021-04-27 1:04 UTC (permalink / raw)
To: Lv Yunlong; +Cc: intel-gfx
[-- Attachment #1.1: Type: text/plain, Size: 26415 bytes --]
== Series Details ==
Series: drm/i9i5/gt: Fix a double free in gen8_preallocate_top_level_pdp
URL : https://patchwork.freedesktop.org/series/89500/
State : failure
== Summary ==
CI Bug Log - changes from CI_DRM_10010_full -> Patchwork_19992_full
====================================================
Summary
-------
**FAILURE**
Serious unknown changes coming with Patchwork_19992_full absolutely need to be
verified manually.
If you think the reported changes have nothing to do with the changes
introduced in Patchwork_19992_full, please notify your bug team to allow them
to document this new failure mode, which will reduce false positives in CI.
Possible new issues
-------------------
Here are the unknown changes that may have been introduced in Patchwork_19992_full:
### IGT changes ###
#### Possible regressions ####
* igt@gem_exec_fair@basic-none@vecs0:
- shard-apl: NOTRUN -> [INCOMPLETE][1]
[1]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl1/igt@gem_exec_fair@basic-none@vecs0.html
* igt@perf_pmu@busy-accuracy-98@rcs0:
- shard-skl: [PASS][2] -> [FAIL][3]
[2]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-skl8/igt@perf_pmu@busy-accuracy-98@rcs0.html
[3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl4/igt@perf_pmu@busy-accuracy-98@rcs0.html
Known issues
------------
Here are the changes found in Patchwork_19992_full that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@gem_ctx_persistence@legacy-engines-mixed-process:
- shard-snb: NOTRUN -> [SKIP][4] ([fdo#109271] / [i915#1099]) +5 similar issues
[4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-snb7/igt@gem_ctx_persistence@legacy-engines-mixed-process.html
* igt@gem_eio@unwedge-stress:
- shard-iclb: [PASS][5] -> [TIMEOUT][6] ([i915#2369] / [i915#2481] / [i915#3070])
[5]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-iclb4/igt@gem_eio@unwedge-stress.html
[6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-iclb2/igt@gem_eio@unwedge-stress.html
* igt@gem_exec_fair@basic-deadline:
- shard-apl: NOTRUN -> [FAIL][7] ([i915#2846])
[7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl1/igt@gem_exec_fair@basic-deadline.html
* igt@gem_exec_fair@basic-pace-share@rcs0:
- shard-tglb: [PASS][8] -> [FAIL][9] ([i915#2842]) +1 similar issue
[8]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-tglb7/igt@gem_exec_fair@basic-pace-share@rcs0.html
[9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-tglb2/igt@gem_exec_fair@basic-pace-share@rcs0.html
* igt@gem_exec_fair@basic-pace@vcs1:
- shard-kbl: [PASS][10] -> [FAIL][11] ([i915#2842]) +1 similar issue
[10]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-kbl7/igt@gem_exec_fair@basic-pace@vcs1.html
[11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl1/igt@gem_exec_fair@basic-pace@vcs1.html
* igt@gem_exec_fair@basic-pace@vecs0:
- shard-kbl: [PASS][12] -> [SKIP][13] ([fdo#109271])
[12]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-kbl7/igt@gem_exec_fair@basic-pace@vecs0.html
[13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl1/igt@gem_exec_fair@basic-pace@vecs0.html
* igt@gem_exec_params@no-vebox:
- shard-skl: NOTRUN -> [SKIP][14] ([fdo#109271]) +51 similar issues
[14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl4/igt@gem_exec_params@no-vebox.html
* igt@gem_pread@exhaustion:
- shard-apl: NOTRUN -> [WARN][15] ([i915#2658])
[15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl1/igt@gem_pread@exhaustion.html
- shard-snb: NOTRUN -> [WARN][16] ([i915#2658])
[16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-snb7/igt@gem_pread@exhaustion.html
* igt@gem_render_copy@x-tiled-to-vebox-yf-tiled:
- shard-kbl: NOTRUN -> [SKIP][17] ([fdo#109271]) +76 similar issues
[17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl2/igt@gem_render_copy@x-tiled-to-vebox-yf-tiled.html
* igt@gem_workarounds@suspend-resume-context:
- shard-skl: [PASS][18] -> [INCOMPLETE][19] ([i915#198])
[18]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-skl9/igt@gem_workarounds@suspend-resume-context.html
[19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl2/igt@gem_workarounds@suspend-resume-context.html
* igt@gen9_exec_parse@bb-large:
- shard-apl: NOTRUN -> [FAIL][20] ([i915#3296])
[20]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl6/igt@gen9_exec_parse@bb-large.html
* igt@kms_chamelium@dp-mode-timings:
- shard-apl: NOTRUN -> [SKIP][21] ([fdo#109271] / [fdo#111827]) +11 similar issues
[21]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl8/igt@kms_chamelium@dp-mode-timings.html
* igt@kms_chamelium@vga-hpd-for-each-pipe:
- shard-kbl: NOTRUN -> [SKIP][22] ([fdo#109271] / [fdo#111827]) +5 similar issues
[22]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl2/igt@kms_chamelium@vga-hpd-for-each-pipe.html
* igt@kms_color_chamelium@pipe-a-ctm-0-25:
- shard-snb: NOTRUN -> [SKIP][23] ([fdo#109271] / [fdo#111827]) +23 similar issues
[23]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-snb7/igt@kms_color_chamelium@pipe-a-ctm-0-25.html
* igt@kms_color_chamelium@pipe-d-ctm-0-75:
- shard-skl: NOTRUN -> [SKIP][24] ([fdo#109271] / [fdo#111827]) +3 similar issues
[24]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl4/igt@kms_color_chamelium@pipe-d-ctm-0-75.html
* igt@kms_content_protection@legacy:
- shard-apl: NOTRUN -> [TIMEOUT][25] ([i915#1319])
[25]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl3/igt@kms_content_protection@legacy.html
* igt@kms_content_protection@uevent:
- shard-apl: NOTRUN -> [FAIL][26] ([i915#2105])
[26]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl8/igt@kms_content_protection@uevent.html
* igt@kms_cursor_crc@pipe-b-cursor-256x85-sliding:
- shard-skl: [PASS][27] -> [FAIL][28] ([i915#54])
[27]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-skl8/igt@kms_cursor_crc@pipe-b-cursor-256x85-sliding.html
[28]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl8/igt@kms_cursor_crc@pipe-b-cursor-256x85-sliding.html
* igt@kms_cursor_crc@pipe-b-cursor-suspend:
- shard-skl: [PASS][29] -> [INCOMPLETE][30] ([i915#2405] / [i915#300])
[29]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-skl8/igt@kms_cursor_crc@pipe-b-cursor-suspend.html
[30]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl4/igt@kms_cursor_crc@pipe-b-cursor-suspend.html
* igt@kms_cursor_crc@pipe-c-cursor-suspend:
- shard-kbl: [PASS][31] -> [DMESG-WARN][32] ([i915#180]) +3 similar issues
[31]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-kbl4/igt@kms_cursor_crc@pipe-c-cursor-suspend.html
[32]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl4/igt@kms_cursor_crc@pipe-c-cursor-suspend.html
* igt@kms_flip@basic-flip-vs-dpms@a-edp1:
- shard-skl: [PASS][33] -> [DMESG-WARN][34] ([i915#1982])
[33]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-skl1/igt@kms_flip@basic-flip-vs-dpms@a-edp1.html
[34]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl7/igt@kms_flip@basic-flip-vs-dpms@a-edp1.html
* igt@kms_flip@flip-vs-expired-vblank-interruptible@a-edp1:
- shard-skl: [PASS][35] -> [FAIL][36] ([i915#2122])
[35]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-skl4/igt@kms_flip@flip-vs-expired-vblank-interruptible@a-edp1.html
[36]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl6/igt@kms_flip@flip-vs-expired-vblank-interruptible@a-edp1.html
* igt@kms_flip@flip-vs-expired-vblank@a-edp1:
- shard-skl: [PASS][37] -> [FAIL][38] ([i915#79])
[37]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-skl7/igt@kms_flip@flip-vs-expired-vblank@a-edp1.html
[38]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl1/igt@kms_flip@flip-vs-expired-vblank@a-edp1.html
* igt@kms_flip_scaled_crc@flip-32bpp-ytileccs-to-64bpp-ytile:
- shard-snb: NOTRUN -> [SKIP][39] ([fdo#109271]) +400 similar issues
[39]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-snb7/igt@kms_flip_scaled_crc@flip-32bpp-ytileccs-to-64bpp-ytile.html
* igt@kms_hdr@bpc-switch:
- shard-skl: [PASS][40] -> [FAIL][41] ([i915#1188])
[40]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-skl10/igt@kms_hdr@bpc-switch.html
[41]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl9/igt@kms_hdr@bpc-switch.html
* igt@kms_pipe_crc_basic@nonblocking-crc-pipe-d-frame-sequence:
- shard-apl: NOTRUN -> [SKIP][42] ([fdo#109271] / [i915#533])
[42]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl3/igt@kms_pipe_crc_basic@nonblocking-crc-pipe-d-frame-sequence.html
* igt@kms_pipe_crc_basic@read-crc-pipe-d:
- shard-kbl: NOTRUN -> [SKIP][43] ([fdo#109271] / [i915#533]) +1 similar issue
[43]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl6/igt@kms_pipe_crc_basic@read-crc-pipe-d.html
* igt@kms_pipe_crc_basic@suspend-read-crc-pipe-c:
- shard-apl: NOTRUN -> [DMESG-WARN][44] ([i915#180])
[44]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl6/igt@kms_pipe_crc_basic@suspend-read-crc-pipe-c.html
* igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb:
- shard-kbl: NOTRUN -> [FAIL][45] ([i915#265])
[45]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl4/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
* igt@kms_plane_alpha_blend@pipe-b-constant-alpha-max:
- shard-skl: NOTRUN -> [FAIL][46] ([fdo#108145] / [i915#265])
[46]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl4/igt@kms_plane_alpha_blend@pipe-b-constant-alpha-max.html
* igt@kms_plane_alpha_blend@pipe-b-coverage-7efc:
- shard-skl: [PASS][47] -> [FAIL][48] ([fdo#108145] / [i915#265])
[47]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-skl8/igt@kms_plane_alpha_blend@pipe-b-coverage-7efc.html
[48]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl8/igt@kms_plane_alpha_blend@pipe-b-coverage-7efc.html
* igt@kms_plane_alpha_blend@pipe-c-alpha-basic:
- shard-apl: NOTRUN -> [FAIL][49] ([fdo#108145] / [i915#265])
[49]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl8/igt@kms_plane_alpha_blend@pipe-c-alpha-basic.html
* igt@kms_plane_alpha_blend@pipe-c-alpha-transparent-fb:
- shard-apl: NOTRUN -> [FAIL][50] ([i915#265])
[50]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl3/igt@kms_plane_alpha_blend@pipe-c-alpha-transparent-fb.html
* igt@kms_plane_scaling@scaler-with-clipping-clamping@pipe-c-scaler-with-clipping-clamping:
- shard-kbl: NOTRUN -> [SKIP][51] ([fdo#109271] / [i915#2733])
[51]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl4/igt@kms_plane_scaling@scaler-with-clipping-clamping@pipe-c-scaler-with-clipping-clamping.html
* igt@kms_psr2_sf@overlay-primary-update-sf-dmg-area-5:
- shard-apl: NOTRUN -> [SKIP][52] ([fdo#109271] / [i915#658]) +2 similar issues
[52]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl3/igt@kms_psr2_sf@overlay-primary-update-sf-dmg-area-5.html
* igt@kms_psr2_sf@plane-move-sf-dmg-area-3:
- shard-skl: NOTRUN -> [SKIP][53] ([fdo#109271] / [i915#658])
[53]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl7/igt@kms_psr2_sf@plane-move-sf-dmg-area-3.html
* igt@kms_psr2_sf@primary-plane-update-sf-dmg-area-5:
- shard-kbl: NOTRUN -> [SKIP][54] ([fdo#109271] / [i915#658]) +2 similar issues
[54]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl4/igt@kms_psr2_sf@primary-plane-update-sf-dmg-area-5.html
* igt@kms_psr@psr2_cursor_blt:
- shard-iclb: [PASS][55] -> [SKIP][56] ([fdo#109441])
[55]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-iclb2/igt@kms_psr@psr2_cursor_blt.html
[56]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-iclb1/igt@kms_psr@psr2_cursor_blt.html
* igt@kms_sysfs_edid_timing:
- shard-apl: NOTRUN -> [FAIL][57] ([IGT#2])
[57]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl8/igt@kms_sysfs_edid_timing.html
* igt@kms_vblank@pipe-c-ts-continuation-dpms-suspend:
- shard-kbl: [PASS][58] -> [INCOMPLETE][59] ([i915#155] / [i915#2405])
[58]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-kbl1/igt@kms_vblank@pipe-c-ts-continuation-dpms-suspend.html
[59]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl3/igt@kms_vblank@pipe-c-ts-continuation-dpms-suspend.html
* igt@kms_vblank@pipe-d-wait-idle:
- shard-skl: NOTRUN -> [SKIP][60] ([fdo#109271] / [i915#533])
[60]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl7/igt@kms_vblank@pipe-d-wait-idle.html
* igt@kms_writeback@writeback-fb-id:
- shard-kbl: NOTRUN -> [SKIP][61] ([fdo#109271] / [i915#2437])
[61]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl4/igt@kms_writeback@writeback-fb-id.html
* igt@prime_nv_api@i915_nv_reimport_twice_check_flink_name:
- shard-apl: NOTRUN -> [SKIP][62] ([fdo#109271]) +125 similar issues
[62]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl8/igt@prime_nv_api@i915_nv_reimport_twice_check_flink_name.html
* igt@sysfs_clients@fair-1:
- shard-skl: NOTRUN -> [SKIP][63] ([fdo#109271] / [i915#2994])
[63]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl7/igt@sysfs_clients@fair-1.html
* igt@sysfs_clients@recycle-many:
- shard-apl: NOTRUN -> [SKIP][64] ([fdo#109271] / [i915#2994])
[64]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl1/igt@sysfs_clients@recycle-many.html
* igt@sysfs_clients@sema-10:
- shard-kbl: NOTRUN -> [SKIP][65] ([fdo#109271] / [i915#2994]) +1 similar issue
[65]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl2/igt@sysfs_clients@sema-10.html
#### Possible fixes ####
* igt@gem_ctx_isolation@preservation-s3@vecs0:
- shard-skl: [INCOMPLETE][66] ([i915#198]) -> [PASS][67]
[66]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-skl1/igt@gem_ctx_isolation@preservation-s3@vecs0.html
[67]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl7/igt@gem_ctx_isolation@preservation-s3@vecs0.html
* igt@gem_ctx_ringsize@active@bcs0:
- shard-skl: [INCOMPLETE][68] ([i915#3316]) -> [PASS][69]
[68]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-skl4/igt@gem_ctx_ringsize@active@bcs0.html
[69]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl8/igt@gem_ctx_ringsize@active@bcs0.html
* igt@gem_exec_capture@pi@vcs0:
- shard-skl: [INCOMPLETE][70] ([i915#2369]) -> [PASS][71]
[70]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-skl2/igt@gem_exec_capture@pi@vcs0.html
[71]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl4/igt@gem_exec_capture@pi@vcs0.html
* igt@gem_exec_fair@basic-none@vcs0:
- shard-kbl: [FAIL][72] ([i915#2842]) -> [PASS][73]
[72]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-kbl2/igt@gem_exec_fair@basic-none@vcs0.html
[73]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl4/igt@gem_exec_fair@basic-none@vcs0.html
* igt@gem_exec_fair@basic-pace-solo@rcs0:
- shard-iclb: [FAIL][74] ([i915#2842]) -> [PASS][75] +2 similar issues
[74]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-iclb6/igt@gem_exec_fair@basic-pace-solo@rcs0.html
[75]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-iclb6/igt@gem_exec_fair@basic-pace-solo@rcs0.html
* igt@gem_exec_fair@basic-pace@bcs0:
- shard-tglb: [FAIL][76] ([i915#2842]) -> [PASS][77] +1 similar issue
[76]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-tglb6/igt@gem_exec_fair@basic-pace@bcs0.html
[77]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-tglb5/igt@gem_exec_fair@basic-pace@bcs0.html
* igt@gem_exec_fair@basic-throttle@rcs0:
- shard-iclb: [FAIL][78] ([i915#2849]) -> [PASS][79]
[78]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-iclb7/igt@gem_exec_fair@basic-throttle@rcs0.html
[79]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-iclb7/igt@gem_exec_fair@basic-throttle@rcs0.html
* igt@kms_plane@plane-panning-bottom-right-suspend-pipe-c-planes:
- shard-kbl: [DMESG-WARN][80] ([i915#180]) -> [PASS][81] +3 similar issues
[80]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-kbl4/igt@kms_plane@plane-panning-bottom-right-suspend-pipe-c-planes.html
[81]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl6/igt@kms_plane@plane-panning-bottom-right-suspend-pipe-c-planes.html
* igt@kms_prime@basic-crc@second-to-first:
- shard-skl: [DMESG-WARN][82] ([i915#1982]) -> [PASS][83] +1 similar issue
[82]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-skl1/igt@kms_prime@basic-crc@second-to-first.html
[83]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl7/igt@kms_prime@basic-crc@second-to-first.html
* igt@kms_psr@psr2_cursor_mmap_cpu:
- shard-iclb: [SKIP][84] ([fdo#109441]) -> [PASS][85] +2 similar issues
[84]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-iclb8/igt@kms_psr@psr2_cursor_mmap_cpu.html
[85]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-iclb2/igt@kms_psr@psr2_cursor_mmap_cpu.html
#### Warnings ####
* igt@i915_pm_rc6_residency@rc6-fence:
- shard-iclb: [WARN][86] ([i915#2681] / [i915#2684]) -> [WARN][87] ([i915#2684])
[86]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-iclb8/igt@i915_pm_rc6_residency@rc6-fence.html
[87]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-iclb2/igt@i915_pm_rc6_residency@rc6-fence.html
* igt@kms_psr2_sf@plane-move-sf-dmg-area-0:
- shard-iclb: [SKIP][88] ([i915#658]) -> [SKIP][89] ([i915#2920]) +1 similar issue
[88]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-iclb1/igt@kms_psr2_sf@plane-move-sf-dmg-area-0.html
[89]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-iclb2/igt@kms_psr2_sf@plane-move-sf-dmg-area-0.html
* igt@kms_psr2_sf@primary-plane-update-sf-dmg-area-2:
- shard-iclb: [SKIP][90] ([i915#2920]) -> [SKIP][91] ([i915#658]) +1 similar issue
[90]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-iclb2/igt@kms_psr2_sf@primary-plane-update-sf-dmg-area-2.html
[91]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-iclb5/igt@kms_psr2_sf@primary-plane-update-sf-dmg-area-2.html
* igt@runner@aborted:
- shard-kbl: ([FAIL][92], [FAIL][93], [FAIL][94], [FAIL][95], [FAIL][96], [FAIL][97]) ([i915#180] / [i915#1814] / [i915#3002]) -> ([FAIL][98], [FAIL][99], [FAIL][100], [FAIL][101], [FAIL][102], [FAIL][103]) ([i915#1436] / [i915#180] / [i915#1814] / [i915#3002])
[92]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-kbl7/igt@runner@aborted.html
[93]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-kbl4/igt@runner@aborted.html
[94]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-kbl7/igt@runner@aborted.html
[95]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-kbl7/igt@runner@aborted.html
[96]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-kbl7/igt@runner@aborted.html
[97]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-kbl4/igt@runner@aborted.html
[98]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl7/igt@runner@aborted.html
[99]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl7/igt@runner@aborted.html
[100]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl1/igt@runner@aborted.html
[101]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl4/igt@runner@aborted.html
[102]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl4/igt@runner@aborted.html
[103]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-kbl3/igt@runner@aborted.html
- shard-apl: ([FAIL][104], [FAIL][105]) ([i915#3002]) -> ([FAIL][106], [FAIL][107], [FAIL][108], [FAIL][109]) ([fdo#109271] / [i915#1814] / [i915#2722] / [i915#3002])
[104]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-apl7/igt@runner@aborted.html
[105]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-apl6/igt@runner@aborted.html
[106]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl1/igt@runner@aborted.html
[107]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl3/igt@runner@aborted.html
[108]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl6/igt@runner@aborted.html
[109]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-apl7/igt@runner@aborted.html
- shard-skl: ([FAIL][110], [FAIL][111], [FAIL][112]) ([i915#2369] / [i915#3002]) -> ([FAIL][113], [FAIL][114], [FAIL][115]) ([i915#1814] / [i915#2029] / [i915#3002])
[110]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-skl4/igt@runner@aborted.html
[111]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-skl2/igt@runner@aborted.html
[112]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10010/shard-skl9/igt@runner@aborted.html
[113]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl2/igt@runner@aborted.html
[114]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl2/igt@runner@aborted.html
[115]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/shard-skl2/igt@runner@aborted.html
{name}: This element is suppressed. This means it is ignored when computing
the status of the difference (SUCCESS, WARNING, or FAILURE).
[IGT#2]: https://gitlab.freedesktop.org/drm/igt-gpu-tools/issues/2
[fdo#108145]: https://bugs.freedesktop.org/show_bug.cgi?id=108145
[fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271
[fdo#109441]: https://bugs.freedesktop.org/show_bug.cgi?id=109441
[fdo#111827]: https://bugs.freedesktop.org/show_bug.cgi?id=111827
[i915#1099]: https://gitlab.freedesktop.org/drm/intel/issues/1099
[i915#1188]: https://gitlab.freedesktop.org/drm/intel/issues/1188
[i915#1319]: https://gitlab.freedesktop.org/drm/intel/issues/1319
[i915#1436]: https://gitlab.freedesktop.org/drm/intel/issues/1436
[i915#155]: https://gitlab.freedesktop.org/drm/intel/issues/155
[i915#180]: https://gitlab.freedesktop.org/drm/intel/issues/180
[i915#1814]: https://gitlab.freedesktop.org/drm/intel/issues/1814
[i915#198]: https://gitlab.freedesktop.org/drm/intel/issues/198
[i915#1982]: https://gitlab.freedesktop.org/drm/intel/issues/1982
[i915#2029]: https://gitlab.freedesktop.org/drm/intel/issues/2029
[i915#2105]: https://gitlab.freedesktop.org/drm/intel/issues/2105
[i915#2122]: https://gitlab.freedesktop.org/drm/intel/issues/2122
[i915#2369]: https://gitlab.freedesktop.org/drm/intel/issues/2369
[i915#2405]: https://gitlab.freedesktop.org/drm/intel/issues/2405
[i915#2437]: https://gitlab.freedesktop.org/drm/intel/issues/2437
[i915#2481]: https://gitlab.freedesktop.org/drm/intel/issues/2481
[i915#265]: https://gitlab.freedesktop.org/drm/intel/issues/265
[i915#2658]: https://gitlab.freedesktop.org/drm/intel/issues/2658
[i915#2681]: https://gitlab.freedesktop.org/drm/intel/issues/2681
[i915#2684]: https://gitlab.freedesktop.org/drm/intel/issues/2684
[i915#2722]: https://gitlab.freedesktop.org/drm/intel/issues/2722
[i915#2733]: https://gitlab.freedesktop.org/drm/intel/issues/2733
[i915#2842]: https://gitlab.freedesktop.org/drm/intel/issues/2842
[i915#2846]: https://gitlab.freedesktop.org/drm/intel/issues/2846
[i915#2849]: https://gitlab.freedesktop.org/drm/intel/issues/2849
[i915#2920]: https://gitlab.freedesktop.org/drm/intel/issues/2920
[i915#2994]: https://gitlab.freedesktop.org/drm/intel/issues/2994
[i915#300]: https://gitlab.freedesktop.org/drm/intel/issues/300
[i915#3002]: https://gitlab.freedesktop.org/drm/intel/issues/3002
[i915#3070]: https://gitlab.freedesktop.org/drm/intel/issues/3070
[i915#3296]: https://gitlab.freedesktop.org/drm/intel/issues/3296
[i915#3316]: https://gitlab.freedesktop.org/drm/intel/issues/3316
[i915#533]: https://gitlab.freedesktop.org/drm/intel/issues/533
[i915#54]: https://gitlab.freedesktop.org/drm/intel/issues/54
[i915#658]: https://gitlab.freedesktop.org/drm/intel/issues/658
[i915#79]: https://gitlab.freedesktop.org/drm/intel/issues/79
Participating hosts (11 -> 11)
------------------------------
No changes in participating hosts
Build changes
-------------
* Linux: CI_DRM_10010 -> Patchwork_19992
CI-20190529: 20190529
CI_DRM_10010: 58acb454bb6b897117656a2cba0edce64e3ee1dc @ git://anongit.freedesktop.org/gfx-ci/linux
IGT_6075: ccf602c569257291045415ff504a6d2460986c28 @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools
Patchwork_19992: 8a9defaba2621a654c95903bf97297815d0c80f3 @ git://anongit.freedesktop.org/gfx-ci/linux
piglit_4509: fdc5a4ca11124ab8413c7988896eec4c97336694 @ git://anongit.freedesktop.org/piglit
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_19992/index.html
[-- Attachment #1.2: Type: text/html, Size: 33200 bytes --]
[-- Attachment #2: Type: text/plain, Size: 160 bytes --]
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] drm/i9i5/gt: Fix a double free in gen8_preallocate_top_level_pdp
2021-04-26 12:43 ` Lv Yunlong
(?)
@ 2021-04-27 9:42 ` Matthew Auld
-1 siblings, 0 replies; 8+ messages in thread
From: Matthew Auld @ 2021-04-27 9:42 UTC (permalink / raw)
To: Lv Yunlong
Cc: Jani Nikula, Joonas Lahtinen, Rodrigo Vivi, David Airlie,
Daniel Vetter, Chris Wilson, Intel Graphics Development,
kernel list, ML dri-devel
On Mon, 26 Apr 2021 at 13:44, Lv Yunlong <lyl2019@mail.ustc.edu.cn> wrote:
>
> Our code analyzer reported a double free bug.
>
> In gen8_preallocate_top_level_pdp, pde and pde->pt.base are allocated
> via alloc_pd(vm) with one reference. If pin_pt_dma() failed, pde->pt.base
> is freed by i915_gem_object_put() with a reference dropped. Then free_pd
> calls free_px() defined in intel_ppgtt.c, which calls i915_gem_object_put()
> to put pde->pt.base again.
>
> As pde->pt.base is protected by refcount, so the second put will not free
> pde->pt.base actually. But, maybe it is better to remove the first put?
>
> Fixes: 82adf901138cc ("drm/i915/gt: Shrink i915_page_directory's slab bucket")
> Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Yes, it looks like this fixes a potential use-after-free. Thanks for the patch,
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Pushed to drm-intel-gt-next.
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [Intel-gfx] [PATCH] drm/i9i5/gt: Fix a double free in gen8_preallocate_top_level_pdp
@ 2021-04-27 9:42 ` Matthew Auld
0 siblings, 0 replies; 8+ messages in thread
From: Matthew Auld @ 2021-04-27 9:42 UTC (permalink / raw)
To: Lv Yunlong
Cc: David Airlie, Intel Graphics Development, kernel list,
Chris Wilson, ML dri-devel
On Mon, 26 Apr 2021 at 13:44, Lv Yunlong <lyl2019@mail.ustc.edu.cn> wrote:
>
> Our code analyzer reported a double free bug.
>
> In gen8_preallocate_top_level_pdp, pde and pde->pt.base are allocated
> via alloc_pd(vm) with one reference. If pin_pt_dma() failed, pde->pt.base
> is freed by i915_gem_object_put() with a reference dropped. Then free_pd
> calls free_px() defined in intel_ppgtt.c, which calls i915_gem_object_put()
> to put pde->pt.base again.
>
> As pde->pt.base is protected by refcount, so the second put will not free
> pde->pt.base actually. But, maybe it is better to remove the first put?
>
> Fixes: 82adf901138cc ("drm/i915/gt: Shrink i915_page_directory's slab bucket")
> Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Yes, it looks like this fixes a potential use-after-free. Thanks for the patch,
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Pushed to drm-intel-gt-next.
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] drm/i9i5/gt: Fix a double free in gen8_preallocate_top_level_pdp
@ 2021-04-27 9:42 ` Matthew Auld
0 siblings, 0 replies; 8+ messages in thread
From: Matthew Auld @ 2021-04-27 9:42 UTC (permalink / raw)
To: Lv Yunlong
Cc: David Airlie, Intel Graphics Development, kernel list,
Chris Wilson, ML dri-devel, Rodrigo Vivi
On Mon, 26 Apr 2021 at 13:44, Lv Yunlong <lyl2019@mail.ustc.edu.cn> wrote:
>
> Our code analyzer reported a double free bug.
>
> In gen8_preallocate_top_level_pdp, pde and pde->pt.base are allocated
> via alloc_pd(vm) with one reference. If pin_pt_dma() failed, pde->pt.base
> is freed by i915_gem_object_put() with a reference dropped. Then free_pd
> calls free_px() defined in intel_ppgtt.c, which calls i915_gem_object_put()
> to put pde->pt.base again.
>
> As pde->pt.base is protected by refcount, so the second put will not free
> pde->pt.base actually. But, maybe it is better to remove the first put?
>
> Fixes: 82adf901138cc ("drm/i915/gt: Shrink i915_page_directory's slab bucket")
> Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Yes, it looks like this fixes a potential use-after-free. Thanks for the patch,
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Pushed to drm-intel-gt-next.
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 8+ messages in thread