* [Intel-gfx] [PATCH v16 0/6] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation @ 2022-12-28 19:22 Gwan-gyeong Mun 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 1/6] drm/i915/gem: Typecheck page lookups Gwan-gyeong Mun ` (10 more replies) 0 siblings, 11 replies; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-12-28 19:22 UTC (permalink / raw) To: intel-gfx Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld, mchehab, nirmoy.das This patch series fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation, etc. We need to check that we avoid integer overflows when looking up a page, and so fix all the instances where we have mistakenly used a plain integer instead of a more suitable long. And there is an impedance mismatch between the scatterlist API using unsigned int and our memory/page accounting in unsigned long. That is we may try to create a scatterlist for a large object that overflows returning a small table into which we try to fit very many pages. As the object size is under the control of userspace, we have to be prudent and catch the conversion errors. To catch the implicit truncation as we switch from unsigned long into the scatterlist's unsigned int, we use improved overflows_type check and report E2BIG prior to the operation. This is already used in our create ioctls to indicate if the uABI request is simply too large for the backing store. And ttm place also has the same problem with scatterlist creation, and we fix the integer truncation problem with the way approached by scatterlist creation. And It corrects the error code to return -E2BIG when creating gem objects using ttm or shmem, if the size is too large in each case. Compared to the v15 version patch series[1], there is no code modification in this version patch series. Among the warnings reported by CI.CHECKPATCH, this patch fixes the parts that need fixing. Fix "ERROR:SPACING" Checkpatch report Fix "WARNING:COMMIT_LOG_LONG_LINE" Checkpatch report [1] https://patchwork.freedesktop.org/series/112270/ Chris Wilson (3): drm/i915/gem: Typecheck page lookups drm/i915: Check for integer truncation on scatterlist creation drm/i915: Remove truncation warning for large objects Gwan-gyeong Mun (3): drm/i915: Check for integer truncation on the configuration of ttm place drm/i915: Check if the size is too big while creating shmem file drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large drivers/gpu/drm/i915/gem/i915_gem_internal.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_object.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_object.h | 303 +++++++++++++++--- drivers/gpu/drm/i915/gem/i915_gem_pages.c | 27 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 4 + drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 23 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 20 +- drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 6 +- .../drm/i915/gem/selftests/huge_gem_object.c | 6 +- .../gpu/drm/i915/gem/selftests/huge_pages.c | 8 + .../drm/i915/gem/selftests/i915_gem_context.c | 12 +- .../drm/i915/gem/selftests/i915_gem_mman.c | 8 +- .../drm/i915/gem/selftests/i915_gem_object.c | 8 +- drivers/gpu/drm/i915/gvt/dmabuf.c | 10 +- drivers/gpu/drm/i915/i915_gem.c | 18 +- drivers/gpu/drm/i915/i915_scatterlist.c | 9 + drivers/gpu/drm/i915/i915_vma.c | 8 +- drivers/gpu/drm/i915/intel_region_ttm.c | 14 + drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 4 + drivers/gpu/drm/i915/selftests/scatterlist.c | 4 + 20 files changed, 420 insertions(+), 86 deletions(-) -- 2.37.1 ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] [PATCH v16 1/6] drm/i915/gem: Typecheck page lookups 2022-12-28 19:22 [Intel-gfx] [PATCH v16 0/6] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun @ 2022-12-28 19:22 ` Gwan-gyeong Mun 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 2/6] drm/i915: Check for integer truncation on scatterlist creation Gwan-gyeong Mun ` (9 subsequent siblings) 10 siblings, 0 replies; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-12-28 19:22 UTC (permalink / raw) To: intel-gfx Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld, mchehab, nirmoy.das From: Chris Wilson <chris@chris-wilson.co.uk> We need to check that we avoid integer overflows when looking up a page, and so fix all the instances where we have mistakenly used a plain integer instead of a more suitable long. Be pedantic and add integer typechecking to the lookup so that we can be sure that we are safe. And it also uses pgoff_t as our page lookups must remain compatible with the page cache, pgoff_t is currently exactly unsigned long. v2: Move added i915_utils's macro into drm_util header (Jani N) v3: Make not use the same macro name on a function. (Mauro) For kernel-doc, macros and functions are handled in the same namespace, the same macro name on a function prevents ever adding documentation for it. v4: Add kernel-doc markups to the kAPI functions and macros (Mauoro) v5: Fix an alignment to match open parenthesis v6: Rebase v10: Use assert_typable instead of exactly_pgoff_t() macro. (Kees) v11: Change the use of assert_typable to assert_same_typable (G.G) v12: Change to use static_assert(__castable_to_type(n ,T)) style since the assert_same_typable() macro has been dropped. (G.G) v13: Change the use of __castable_to_type() to castable_to_type() Remove an unnecessary header include line. (G.G) v16: Fix "ERROR:SPACING" Checkpatch report (G.G) Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com> Cc: Matthew Auld <matthew.auld@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Kees Cook <keescook@chromium.org> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> Reviewed-by: Nirmoy Das <nirmoy.das@intel.com> (v2) Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org> (v3) Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com> (v5) --- drivers/gpu/drm/i915/gem/i915_gem_object.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_object.h | 293 ++++++++++++++++-- drivers/gpu/drm/i915/gem/i915_gem_pages.c | 27 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 2 +- .../drm/i915/gem/selftests/i915_gem_context.c | 12 +- .../drm/i915/gem/selftests/i915_gem_mman.c | 8 +- .../drm/i915/gem/selftests/i915_gem_object.c | 8 +- drivers/gpu/drm/i915/i915_gem.c | 18 +- drivers/gpu/drm/i915/i915_vma.c | 8 +- 9 files changed, 322 insertions(+), 61 deletions(-) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object.c b/drivers/gpu/drm/i915/gem/i915_gem_object.c index 1a0886b8aaa1..e6d4efde4fc5 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_object.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_object.c @@ -427,10 +427,11 @@ void __i915_gem_object_invalidate_frontbuffer(struct drm_i915_gem_object *obj, static void i915_gem_object_read_from_page_kmap(struct drm_i915_gem_object *obj, u64 offset, void *dst, int size) { + pgoff_t idx = offset >> PAGE_SHIFT; void *src_map; void *src_ptr; - src_map = kmap_atomic(i915_gem_object_get_page(obj, offset >> PAGE_SHIFT)); + src_map = kmap_atomic(i915_gem_object_get_page(obj, idx)); src_ptr = src_map + offset_in_page(offset); if (!(obj->cache_coherent & I915_BO_CACHE_COHERENT_FOR_READ)) @@ -443,9 +444,10 @@ i915_gem_object_read_from_page_kmap(struct drm_i915_gem_object *obj, u64 offset, static void i915_gem_object_read_from_page_iomap(struct drm_i915_gem_object *obj, u64 offset, void *dst, int size) { + pgoff_t idx = offset >> PAGE_SHIFT; + dma_addr_t dma = i915_gem_object_get_dma_address(obj, idx); void __iomem *src_map; void __iomem *src_ptr; - dma_addr_t dma = i915_gem_object_get_dma_address(obj, offset >> PAGE_SHIFT); src_map = io_mapping_map_wc(&obj->mm.region->iomap, dma - obj->mm.region->region.start, @@ -484,6 +486,7 @@ static bool object_has_mappable_iomem(struct drm_i915_gem_object *obj) */ int i915_gem_object_read_from_page(struct drm_i915_gem_object *obj, u64 offset, void *dst, int size) { + GEM_BUG_ON(overflows_type(offset >> PAGE_SHIFT, pgoff_t)); GEM_BUG_ON(offset >= obj->base.size); GEM_BUG_ON(offset_in_page(offset) > PAGE_SIZE - size); GEM_BUG_ON(!i915_gem_object_has_pinned_pages(obj)); diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object.h b/drivers/gpu/drm/i915/gem/i915_gem_object.h index 3db53769864c..f7b562e255a5 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_object.h +++ b/drivers/gpu/drm/i915/gem/i915_gem_object.h @@ -27,8 +27,10 @@ enum intel_region_id; * spot such a local variable, please consider fixing! * * Aside from our own locals (for which we have no excuse!): - * - sg_table embeds unsigned int for num_pages - * - get_user_pages*() mixed ints with longs + * - sg_table embeds unsigned int for nents + * + * We can check for invalidly typed locals with typecheck(), see for example + * i915_gem_object_get_sg(). */ #define GEM_CHECK_SIZE_OVERFLOW(sz) \ GEM_WARN_ON((sz) >> PAGE_SHIFT > INT_MAX) @@ -363,44 +365,289 @@ i915_gem_object_get_tile_row_size(const struct drm_i915_gem_object *obj) int i915_gem_object_set_tiling(struct drm_i915_gem_object *obj, unsigned int tiling, unsigned int stride); +/** + * __i915_gem_object_page_iter_get_sg - helper to find the target scatterlist + * pointer and the target page position using pgoff_t n input argument and + * i915_gem_object_page_iter + * @obj: i915 GEM buffer object + * @iter: i915 GEM buffer object page iterator + * @n: page offset + * @offset: searched physical offset, + * it will be used for returning physical page offset value + * + * Context: Takes and releases the mutex lock of the i915_gem_object_page_iter. + * Takes and releases the RCU lock to search the radix_tree of + * i915_gem_object_page_iter. + * + * Returns: + * The target scatterlist pointer and the target page position. + * + * Recommended to use wrapper macro: i915_gem_object_page_iter_get_sg() + */ struct scatterlist * -__i915_gem_object_get_sg(struct drm_i915_gem_object *obj, - struct i915_gem_object_page_iter *iter, - unsigned int n, - unsigned int *offset, bool dma); +__i915_gem_object_page_iter_get_sg(struct drm_i915_gem_object *obj, + struct i915_gem_object_page_iter *iter, + pgoff_t n, + unsigned int *offset); +/** + * i915_gem_object_page_iter_get_sg - wrapper macro for + * __i915_gem_object_page_iter_get_sg() + * @obj: i915 GEM buffer object + * @it: i915 GEM buffer object page iterator + * @n: page offset + * @offset: searched physical offset, + * it will be used for returning physical page offset value + * + * Context: Takes and releases the mutex lock of the i915_gem_object_page_iter. + * Takes and releases the RCU lock to search the radix_tree of + * i915_gem_object_page_iter. + * + * Returns: + * The target scatterlist pointer and the target page position. + * + * In order to avoid the truncation of the input parameter, it checks the page + * offset n's type from the input parameter before calling + * __i915_gem_object_page_iter_get_sg(). + */ +#define i915_gem_object_page_iter_get_sg(obj, it, n, offset) ({ \ + static_assert(castable_to_type(n, pgoff_t)); \ + __i915_gem_object_page_iter_get_sg(obj, it, n, offset); \ +}) + +/** + * __i915_gem_object_get_sg - helper to find the target scatterlist + * pointer and the target page position using pgoff_t n input argument and + * drm_i915_gem_object. It uses an internal shmem scatterlist lookup function. + * @obj: i915 GEM buffer object + * @n: page offset + * @offset: searched physical offset, + * it will be used for returning physical page offset value + * + * It uses drm_i915_gem_object's internal shmem scatterlist lookup function as + * i915_gem_object_page_iter and calls __i915_gem_object_page_iter_get_sg(). + * + * Returns: + * The target scatterlist pointer and the target page position. + * + * Recommended to use wrapper macro: i915_gem_object_get_sg() + * See also __i915_gem_object_page_iter_get_sg() + */ static inline struct scatterlist * -i915_gem_object_get_sg(struct drm_i915_gem_object *obj, - unsigned int n, - unsigned int *offset) +__i915_gem_object_get_sg(struct drm_i915_gem_object *obj, pgoff_t n, + unsigned int *offset) { - return __i915_gem_object_get_sg(obj, &obj->mm.get_page, n, offset, false); + return __i915_gem_object_page_iter_get_sg(obj, &obj->mm.get_page, n, offset); } +/** + * i915_gem_object_get_sg - wrapper macro for __i915_gem_object_get_sg() + * @obj: i915 GEM buffer object + * @n: page offset + * @offset: searched physical offset, + * it will be used for returning physical page offset value + * + * Returns: + * The target scatterlist pointer and the target page position. + * + * In order to avoid the truncation of the input parameter, it checks the page + * offset n's type from the input parameter before calling + * __i915_gem_object_get_sg(). + * See also __i915_gem_object_page_iter_get_sg() + */ +#define i915_gem_object_get_sg(obj, n, offset) ({ \ + static_assert(castable_to_type(n, pgoff_t)); \ + __i915_gem_object_get_sg(obj, n, offset); \ +}) + +/** + * __i915_gem_object_get_sg_dma - helper to find the target scatterlist + * pointer and the target page position using pgoff_t n input argument and + * drm_i915_gem_object. It uses an internal DMA mapped scatterlist lookup function + * @obj: i915 GEM buffer object + * @n: page offset + * @offset: searched physical offset, + * it will be used for returning physical page offset value + * + * It uses drm_i915_gem_object's internal DMA mapped scatterlist lookup function + * as i915_gem_object_page_iter and calls __i915_gem_object_page_iter_get_sg(). + * + * Returns: + * The target scatterlist pointer and the target page position. + * + * Recommended to use wrapper macro: i915_gem_object_get_sg_dma() + * See also __i915_gem_object_page_iter_get_sg() + */ static inline struct scatterlist * -i915_gem_object_get_sg_dma(struct drm_i915_gem_object *obj, - unsigned int n, - unsigned int *offset) +__i915_gem_object_get_sg_dma(struct drm_i915_gem_object *obj, pgoff_t n, + unsigned int *offset) { - return __i915_gem_object_get_sg(obj, &obj->mm.get_dma_page, n, offset, true); + return __i915_gem_object_page_iter_get_sg(obj, &obj->mm.get_dma_page, n, offset); } +/** + * i915_gem_object_get_sg_dma - wrapper macro for __i915_gem_object_get_sg_dma() + * @obj: i915 GEM buffer object + * @n: page offset + * @offset: searched physical offset, + * it will be used for returning physical page offset value + * + * Returns: + * The target scatterlist pointer and the target page position. + * + * In order to avoid the truncation of the input parameter, it checks the page + * offset n's type from the input parameter before calling + * __i915_gem_object_get_sg_dma(). + * See also __i915_gem_object_page_iter_get_sg() + */ +#define i915_gem_object_get_sg_dma(obj, n, offset) ({ \ + static_assert(castable_to_type(n, pgoff_t)); \ + __i915_gem_object_get_sg_dma(obj, n, offset); \ +}) + +/** + * __i915_gem_object_get_page - helper to find the target page with a page offset + * @obj: i915 GEM buffer object + * @n: page offset + * + * It uses drm_i915_gem_object's internal shmem scatterlist lookup function as + * i915_gem_object_page_iter and calls __i915_gem_object_page_iter_get_sg() + * internally. + * + * Returns: + * The target page pointer. + * + * Recommended to use wrapper macro: i915_gem_object_get_page() + * See also __i915_gem_object_page_iter_get_sg() + */ struct page * -i915_gem_object_get_page(struct drm_i915_gem_object *obj, - unsigned int n); +__i915_gem_object_get_page(struct drm_i915_gem_object *obj, pgoff_t n); +/** + * i915_gem_object_get_page - wrapper macro for __i915_gem_object_get_page + * @obj: i915 GEM buffer object + * @n: page offset + * + * Returns: + * The target page pointer. + * + * In order to avoid the truncation of the input parameter, it checks the page + * offset n's type from the input parameter before calling + * __i915_gem_object_get_page(). + * See also __i915_gem_object_page_iter_get_sg() + */ +#define i915_gem_object_get_page(obj, n) ({ \ + static_assert(castable_to_type(n, pgoff_t)); \ + __i915_gem_object_get_page(obj, n); \ +}) + +/** + * __i915_gem_object_get_dirty_page - helper to find the target page with a page + * offset + * @obj: i915 GEM buffer object + * @n: page offset + * + * It works like i915_gem_object_get_page(), but it marks the returned page dirty. + * + * Returns: + * The target page pointer. + * + * Recommended to use wrapper macro: i915_gem_object_get_dirty_page() + * See also __i915_gem_object_page_iter_get_sg() and __i915_gem_object_get_page() + */ struct page * -i915_gem_object_get_dirty_page(struct drm_i915_gem_object *obj, - unsigned int n); +__i915_gem_object_get_dirty_page(struct drm_i915_gem_object *obj, pgoff_t n); + +/** + * i915_gem_object_get_dirty_page - wrapper macro for __i915_gem_object_get_dirty_page + * @obj: i915 GEM buffer object + * @n: page offset + * + * Returns: + * The target page pointer. + * + * In order to avoid the truncation of the input parameter, it checks the page + * offset n's type from the input parameter before calling + * __i915_gem_object_get_dirty_page(). + * See also __i915_gem_object_page_iter_get_sg() and __i915_gem_object_get_page() + */ +#define i915_gem_object_get_dirty_page(obj, n) ({ \ + static_assert(castable_to_type(n, pgoff_t)); \ + __i915_gem_object_get_dirty_page(obj, n); \ +}) +/** + * __i915_gem_object_get_dma_address_len - helper to get bus addresses of + * targeted DMA mapped scatterlist from i915 GEM buffer object and it's length + * @obj: i915 GEM buffer object + * @n: page offset + * @len: DMA mapped scatterlist's DMA bus addresses length to return + * + * Returns: + * Bus addresses of targeted DMA mapped scatterlist + * + * Recommended to use wrapper macro: i915_gem_object_get_dma_address_len() + * See also __i915_gem_object_page_iter_get_sg() and __i915_gem_object_get_sg_dma() + */ dma_addr_t -i915_gem_object_get_dma_address_len(struct drm_i915_gem_object *obj, - unsigned long n, - unsigned int *len); +__i915_gem_object_get_dma_address_len(struct drm_i915_gem_object *obj, pgoff_t n, + unsigned int *len); +/** + * i915_gem_object_get_dma_address_len - wrapper macro for + * __i915_gem_object_get_dma_address_len + * @obj: i915 GEM buffer object + * @n: page offset + * @len: DMA mapped scatterlist's DMA bus addresses length to return + * + * Returns: + * Bus addresses of targeted DMA mapped scatterlist + * + * In order to avoid the truncation of the input parameter, it checks the page + * offset n's type from the input parameter before calling + * __i915_gem_object_get_dma_address_len(). + * See also __i915_gem_object_page_iter_get_sg() and + * __i915_gem_object_get_dma_address_len() + */ +#define i915_gem_object_get_dma_address_len(obj, n, len) ({ \ + static_assert(castable_to_type(n, pgoff_t)); \ + __i915_gem_object_get_dma_address_len(obj, n, len); \ +}) + +/** + * __i915_gem_object_get_dma_address - helper to get bus addresses of + * targeted DMA mapped scatterlist from i915 GEM buffer object + * @obj: i915 GEM buffer object + * @n: page offset + * + * Returns: + * Bus addresses of targeted DMA mapped scatterlis + * + * Recommended to use wrapper macro: i915_gem_object_get_dma_address() + * See also __i915_gem_object_page_iter_get_sg() and __i915_gem_object_get_sg_dma() + */ dma_addr_t -i915_gem_object_get_dma_address(struct drm_i915_gem_object *obj, - unsigned long n); +__i915_gem_object_get_dma_address(struct drm_i915_gem_object *obj, pgoff_t n); + +/** + * i915_gem_object_get_dma_address - wrapper macro for + * __i915_gem_object_get_dma_address + * @obj: i915 GEM buffer object + * @n: page offset + * + * Returns: + * Bus addresses of targeted DMA mapped scatterlist + * + * In order to avoid the truncation of the input parameter, it checks the page + * offset n's type from the input parameter before calling + * __i915_gem_object_get_dma_address(). + * See also __i915_gem_object_page_iter_get_sg() and + * __i915_gem_object_get_dma_address() + */ +#define i915_gem_object_get_dma_address(obj, n) ({ \ + static_assert(castable_to_type(n, pgoff_t)); \ + __i915_gem_object_get_dma_address(obj, n); \ +}) void __i915_gem_object_set_pages(struct drm_i915_gem_object *obj, struct sg_table *pages); diff --git a/drivers/gpu/drm/i915/gem/i915_gem_pages.c b/drivers/gpu/drm/i915/gem/i915_gem_pages.c index 05a27723ebb8..ecd86130b74f 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_pages.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_pages.c @@ -521,14 +521,16 @@ void __i915_gem_object_release_map(struct drm_i915_gem_object *obj) } struct scatterlist * -__i915_gem_object_get_sg(struct drm_i915_gem_object *obj, - struct i915_gem_object_page_iter *iter, - unsigned int n, - unsigned int *offset, - bool dma) +__i915_gem_object_page_iter_get_sg(struct drm_i915_gem_object *obj, + struct i915_gem_object_page_iter *iter, + pgoff_t n, + unsigned int *offset) + { - struct scatterlist *sg; + const bool dma = iter == &obj->mm.get_dma_page || + iter == &obj->ttm.get_io_page; unsigned int idx, count; + struct scatterlist *sg; might_sleep(); GEM_BUG_ON(n >= obj->base.size >> PAGE_SHIFT); @@ -636,7 +638,7 @@ __i915_gem_object_get_sg(struct drm_i915_gem_object *obj, } struct page * -i915_gem_object_get_page(struct drm_i915_gem_object *obj, unsigned int n) +__i915_gem_object_get_page(struct drm_i915_gem_object *obj, pgoff_t n) { struct scatterlist *sg; unsigned int offset; @@ -649,8 +651,7 @@ i915_gem_object_get_page(struct drm_i915_gem_object *obj, unsigned int n) /* Like i915_gem_object_get_page(), but mark the returned page dirty */ struct page * -i915_gem_object_get_dirty_page(struct drm_i915_gem_object *obj, - unsigned int n) +__i915_gem_object_get_dirty_page(struct drm_i915_gem_object *obj, pgoff_t n) { struct page *page; @@ -662,9 +663,8 @@ i915_gem_object_get_dirty_page(struct drm_i915_gem_object *obj, } dma_addr_t -i915_gem_object_get_dma_address_len(struct drm_i915_gem_object *obj, - unsigned long n, - unsigned int *len) +__i915_gem_object_get_dma_address_len(struct drm_i915_gem_object *obj, + pgoff_t n, unsigned int *len) { struct scatterlist *sg; unsigned int offset; @@ -678,8 +678,7 @@ i915_gem_object_get_dma_address_len(struct drm_i915_gem_object *obj, } dma_addr_t -i915_gem_object_get_dma_address(struct drm_i915_gem_object *obj, - unsigned long n) +__i915_gem_object_get_dma_address(struct drm_i915_gem_object *obj, pgoff_t n) { return i915_gem_object_get_dma_address_len(obj, n, NULL); } diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c index d409a77449a3..2b5fc98ae922 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c @@ -692,7 +692,7 @@ static unsigned long i915_ttm_io_mem_pfn(struct ttm_buffer_object *bo, GEM_WARN_ON(bo->ttm); base = obj->mm.region->iomap.base - obj->mm.region->region.start; - sg = __i915_gem_object_get_sg(obj, &obj->ttm.get_io_page, page_offset, &ofs, true); + sg = i915_gem_object_page_iter_get_sg(obj, &obj->ttm.get_io_page, page_offset, &ofs); return ((base + sg_dma_address(sg)) >> PAGE_SHIFT) + ofs; } diff --git a/drivers/gpu/drm/i915/gem/selftests/i915_gem_context.c b/drivers/gpu/drm/i915/gem/selftests/i915_gem_context.c index ac02fb036592..414ee2cb70fc 100644 --- a/drivers/gpu/drm/i915/gem/selftests/i915_gem_context.c +++ b/drivers/gpu/drm/i915/gem/selftests/i915_gem_context.c @@ -469,7 +469,8 @@ static int gpu_fill(struct intel_context *ce, static int cpu_fill(struct drm_i915_gem_object *obj, u32 value) { const bool has_llc = HAS_LLC(to_i915(obj->base.dev)); - unsigned int n, m, need_flush; + unsigned int need_flush; + unsigned long n, m; int err; i915_gem_object_lock(obj, NULL); @@ -499,7 +500,8 @@ static int cpu_fill(struct drm_i915_gem_object *obj, u32 value) static noinline int cpu_check(struct drm_i915_gem_object *obj, unsigned int idx, unsigned int max) { - unsigned int n, m, needs_flush; + unsigned int needs_flush; + unsigned long n; int err; i915_gem_object_lock(obj, NULL); @@ -508,7 +510,7 @@ static noinline int cpu_check(struct drm_i915_gem_object *obj, goto out_unlock; for (n = 0; n < real_page_count(obj); n++) { - u32 *map; + u32 *map, m; map = kmap_atomic(i915_gem_object_get_page(obj, n)); if (needs_flush & CLFLUSH_BEFORE) @@ -516,7 +518,7 @@ static noinline int cpu_check(struct drm_i915_gem_object *obj, for (m = 0; m < max; m++) { if (map[m] != m) { - pr_err("%pS: Invalid value at object %d page %d/%ld, offset %d/%d: found %x expected %x\n", + pr_err("%pS: Invalid value at object %d page %ld/%ld, offset %d/%d: found %x expected %x\n", __builtin_return_address(0), idx, n, real_page_count(obj), m, max, map[m], m); @@ -527,7 +529,7 @@ static noinline int cpu_check(struct drm_i915_gem_object *obj, for (; m < DW_PER_PAGE; m++) { if (map[m] != STACK_MAGIC) { - pr_err("%pS: Invalid value at object %d page %d, offset %d: found %x expected %x (uninitialised)\n", + pr_err("%pS: Invalid value at object %d page %ld, offset %d: found %x expected %x (uninitialised)\n", __builtin_return_address(0), idx, n, m, map[m], STACK_MAGIC); err = -EINVAL; diff --git a/drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c index 7f6353827735..56279908ed30 100644 --- a/drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c +++ b/drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c @@ -97,11 +97,11 @@ static int check_partial_mapping(struct drm_i915_gem_object *obj, struct drm_i915_private *i915 = to_i915(obj->base.dev); struct i915_gtt_view view; struct i915_vma *vma; + unsigned long offset; unsigned long page; u32 __iomem *io; struct page *p; unsigned int n; - u64 offset; u32 *cpu; int err; @@ -158,7 +158,7 @@ static int check_partial_mapping(struct drm_i915_gem_object *obj, cpu = kmap(p) + offset_in_page(offset); drm_clflush_virt_range(cpu, sizeof(*cpu)); if (*cpu != (u32)page) { - pr_err("Partial view for %lu [%u] (offset=%llu, size=%u [%llu, row size %u], fence=%d, tiling=%d, stride=%d) misalignment, expected write to page (%llu + %u [0x%llx]) of 0x%x, found 0x%x\n", + pr_err("Partial view for %lu [%u] (offset=%llu, size=%u [%llu, row size %u], fence=%d, tiling=%d, stride=%d) misalignment, expected write to page (%lu + %u [0x%lx]) of 0x%x, found 0x%x\n", page, n, view.partial.offset, view.partial.size, @@ -214,10 +214,10 @@ static int check_partial_mappings(struct drm_i915_gem_object *obj, for_each_prime_number_from(page, 1, npages) { struct i915_gtt_view view = compute_partial_view(obj, page, MIN_CHUNK_PAGES); + unsigned long offset; u32 __iomem *io; struct page *p; unsigned int n; - u64 offset; u32 *cpu; GEM_BUG_ON(view.partial.size > nreal); @@ -254,7 +254,7 @@ static int check_partial_mappings(struct drm_i915_gem_object *obj, cpu = kmap(p) + offset_in_page(offset); drm_clflush_virt_range(cpu, sizeof(*cpu)); if (*cpu != (u32)page) { - pr_err("Partial view for %lu [%u] (offset=%llu, size=%u [%llu, row size %u], fence=%d, tiling=%d, stride=%d) misalignment, expected write to page (%llu + %u [0x%llx]) of 0x%x, found 0x%x\n", + pr_err("Partial view for %lu [%u] (offset=%llu, size=%u [%llu, row size %u], fence=%d, tiling=%d, stride=%d) misalignment, expected write to page (%lu + %u [0x%lx]) of 0x%x, found 0x%x\n", page, n, view.partial.offset, view.partial.size, diff --git a/drivers/gpu/drm/i915/gem/selftests/i915_gem_object.c b/drivers/gpu/drm/i915/gem/selftests/i915_gem_object.c index bdf5bb40ccf1..19e374f68ff7 100644 --- a/drivers/gpu/drm/i915/gem/selftests/i915_gem_object.c +++ b/drivers/gpu/drm/i915/gem/selftests/i915_gem_object.c @@ -33,10 +33,10 @@ static int igt_gem_object(void *arg) static int igt_gem_huge(void *arg) { - const unsigned int nreal = 509; /* just to be awkward */ + const unsigned long nreal = 509; /* just to be awkward */ struct drm_i915_private *i915 = arg; struct drm_i915_gem_object *obj; - unsigned int n; + unsigned long n; int err; /* Basic sanitycheck of our huge fake object allocation */ @@ -49,7 +49,7 @@ static int igt_gem_huge(void *arg) err = i915_gem_object_pin_pages_unlocked(obj); if (err) { - pr_err("Failed to allocate %u pages (%lu total), err=%d\n", + pr_err("Failed to allocate %lu pages (%lu total), err=%d\n", nreal, obj->base.size / PAGE_SIZE, err); goto out; } @@ -57,7 +57,7 @@ static int igt_gem_huge(void *arg) for (n = 0; n < obj->base.size / PAGE_SIZE; n++) { if (i915_gem_object_get_page(obj, n) != i915_gem_object_get_page(obj, n % nreal)) { - pr_err("Page lookup mismatch at index %u [%u]\n", + pr_err("Page lookup mismatch at index %lu [%lu]\n", n, n % nreal); err = -EINVAL; goto out_unpin; diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index 969581e7106f..35950fa91406 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -229,8 +229,9 @@ i915_gem_shmem_pread(struct drm_i915_gem_object *obj, struct drm_i915_gem_pread *args) { unsigned int needs_clflush; - unsigned int idx, offset; char __user *user_data; + unsigned long offset; + pgoff_t idx; u64 remain; int ret; @@ -383,13 +384,17 @@ i915_gem_gtt_pread(struct drm_i915_gem_object *obj, { struct drm_i915_private *i915 = to_i915(obj->base.dev); struct i915_ggtt *ggtt = to_gt(i915)->ggtt; + unsigned long remain, offset; intel_wakeref_t wakeref; struct drm_mm_node node; void __user *user_data; struct i915_vma *vma; - u64 remain, offset; int ret = 0; + if (overflows_type(args->size, remain) || + overflows_type(args->offset, offset)) + return -EINVAL; + wakeref = intel_runtime_pm_get(&i915->runtime_pm); vma = i915_gem_gtt_prepare(obj, &node, false); @@ -540,13 +545,17 @@ i915_gem_gtt_pwrite_fast(struct drm_i915_gem_object *obj, struct drm_i915_private *i915 = to_i915(obj->base.dev); struct i915_ggtt *ggtt = to_gt(i915)->ggtt; struct intel_runtime_pm *rpm = &i915->runtime_pm; + unsigned long remain, offset; intel_wakeref_t wakeref; struct drm_mm_node node; struct i915_vma *vma; - u64 remain, offset; void __user *user_data; int ret = 0; + if (overflows_type(args->size, remain) || + overflows_type(args->offset, offset)) + return -EINVAL; + if (i915_gem_object_has_struct_page(obj)) { /* * Avoid waking the device up if we can fallback, as @@ -654,8 +663,9 @@ i915_gem_shmem_pwrite(struct drm_i915_gem_object *obj, { unsigned int partial_cacheline_write; unsigned int needs_clflush; - unsigned int offset, idx; void __user *user_data; + unsigned long offset; + pgoff_t idx; u64 remain; int ret; diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c index 7d044888ac33..8b16f6e32efa 100644 --- a/drivers/gpu/drm/i915/i915_vma.c +++ b/drivers/gpu/drm/i915/i915_vma.c @@ -936,7 +936,7 @@ rotate_pages(struct drm_i915_gem_object *obj, unsigned int offset, struct sg_table *st, struct scatterlist *sg) { unsigned int column, row; - unsigned int src_idx; + pgoff_t src_idx; for (column = 0; column < width; column++) { unsigned int left; @@ -1042,7 +1042,7 @@ add_padding_pages(unsigned int count, static struct scatterlist * remap_tiled_color_plane_pages(struct drm_i915_gem_object *obj, - unsigned int offset, unsigned int alignment_pad, + unsigned long offset, unsigned int alignment_pad, unsigned int width, unsigned int height, unsigned int src_stride, unsigned int dst_stride, struct sg_table *st, struct scatterlist *sg, @@ -1101,7 +1101,7 @@ remap_tiled_color_plane_pages(struct drm_i915_gem_object *obj, static struct scatterlist * remap_contiguous_pages(struct drm_i915_gem_object *obj, - unsigned int obj_offset, + pgoff_t obj_offset, unsigned int count, struct sg_table *st, struct scatterlist *sg) { @@ -1134,7 +1134,7 @@ remap_contiguous_pages(struct drm_i915_gem_object *obj, static struct scatterlist * remap_linear_color_plane_pages(struct drm_i915_gem_object *obj, - unsigned int obj_offset, unsigned int alignment_pad, + pgoff_t obj_offset, unsigned int alignment_pad, unsigned int size, struct sg_table *st, struct scatterlist *sg, unsigned int *gtt_offset) -- 2.37.1 ^ permalink raw reply related [flat|nested] 23+ messages in thread
* [Intel-gfx] [PATCH v16 2/6] drm/i915: Check for integer truncation on scatterlist creation 2022-12-28 19:22 [Intel-gfx] [PATCH v16 0/6] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 1/6] drm/i915/gem: Typecheck page lookups Gwan-gyeong Mun @ 2022-12-28 19:22 ` Gwan-gyeong Mun 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 3/6] drm/i915: Check for integer truncation on the configuration of ttm place Gwan-gyeong Mun ` (8 subsequent siblings) 10 siblings, 0 replies; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-12-28 19:22 UTC (permalink / raw) To: intel-gfx Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld, mchehab, nirmoy.das From: Chris Wilson <chris@chris-wilson.co.uk> There is an impedance mismatch between the scatterlist API using unsigned int and our memory/page accounting in unsigned long. That is we may try to create a scatterlist for a large object that overflows returning a small table into which we try to fit very many pages. As the object size is under the control of userspace, we have to be prudent and catch the conversion errors. To catch the implicit truncation we check before calling scattterlist creation Apis. we use overflows_type check and report E2BIG if the overflows may raise. When caller does not return errno, use WARN_ON to report a problem. This is already used in our create ioctls to indicate if the uABI request is simply too large for the backing store. Failing that type check, we have a second check at sg_alloc_table time to make sure the values we are passing into the scatterlist API are not truncated. v2: Move added i915_utils's macro into drm_util header (Jani N) v5: Fix macros to be enclosed in parentheses for complex values Fix too long line warning v8: Replace safe_conversion() with check_assign() (Kees) v14: Remove shadowing macros of scatterlist creation api and fix to explicitly overflow check where the scatterlist creation APIs are called. (Jani) v15: Add missing returning of error code when the WARN_ON() has been detected. (Jani) Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: Brian Welty <brian.welty@intel.com> Cc: Matthew Auld <matthew.auld@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> Reviewed-by: Nirmoy Das <nirmoy.das@intel.com> Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org> Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com> Acked-by: Jani Nikula <jani.nikula@intel.com> --- drivers/gpu/drm/i915/gem/i915_gem_internal.c | 7 +++++-- drivers/gpu/drm/i915/gem/i915_gem_object.h | 3 --- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 4 ++++ drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 9 ++++++--- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 4 ++++ drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 6 +++++- drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c | 6 +++++- drivers/gpu/drm/i915/gem/selftests/huge_pages.c | 8 ++++++++ drivers/gpu/drm/i915/gvt/dmabuf.c | 10 ++++++---- drivers/gpu/drm/i915/i915_scatterlist.c | 9 +++++++++ drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 4 ++++ drivers/gpu/drm/i915/selftests/scatterlist.c | 4 ++++ 12 files changed, 60 insertions(+), 14 deletions(-) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_internal.c b/drivers/gpu/drm/i915/gem/i915_gem_internal.c index f66bcefc09ec..6bc26b4b06b8 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_internal.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_internal.c @@ -35,11 +35,15 @@ static int i915_gem_object_get_pages_internal(struct drm_i915_gem_object *obj) struct drm_i915_private *i915 = to_i915(obj->base.dev); struct sg_table *st; struct scatterlist *sg; - unsigned int npages; + unsigned int npages; /* restricted by sg_alloc_table */ int max_order = MAX_ORDER; unsigned int max_segment; gfp_t gfp; + if (overflows_type(obj->base.size >> PAGE_SHIFT, npages)) + return -E2BIG; + + npages = obj->base.size >> PAGE_SHIFT; max_segment = i915_sg_segment_size(i915->drm.dev) >> PAGE_SHIFT; max_order = min(max_order, get_order(max_segment)); @@ -55,7 +59,6 @@ static int i915_gem_object_get_pages_internal(struct drm_i915_gem_object *obj) if (!st) return -ENOMEM; - npages = obj->base.size / PAGE_SIZE; if (sg_alloc_table(st, npages, GFP_KERNEL)) { kfree(st); return -ENOMEM; diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object.h b/drivers/gpu/drm/i915/gem/i915_gem_object.h index f7b562e255a5..4a661af87c4d 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_object.h +++ b/drivers/gpu/drm/i915/gem/i915_gem_object.h @@ -26,9 +26,6 @@ enum intel_region_id; * this and catch if we ever need to fix it. In the meantime, if you do * spot such a local variable, please consider fixing! * - * Aside from our own locals (for which we have no excuse!): - * - sg_table embeds unsigned int for nents - * * We can check for invalidly typed locals with typecheck(), see for example * i915_gem_object_get_sg(). */ diff --git a/drivers/gpu/drm/i915/gem/i915_gem_phys.c b/drivers/gpu/drm/i915/gem/i915_gem_phys.c index 68453572275b..76efe98eaa14 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_phys.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_phys.c @@ -28,6 +28,10 @@ static int i915_gem_object_get_pages_phys(struct drm_i915_gem_object *obj) void *dst; int i; + /* Contiguous chunk, with a single scatterlist element */ + if (overflows_type(obj->base.size, sg->length)) + return -E2BIG; + if (GEM_WARN_ON(i915_gem_object_needs_bit17_swizzle(obj))) return -EINVAL; diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c index 9c759df700ca..28e857f8c169 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c @@ -60,7 +60,7 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st, struct address_space *mapping, unsigned int max_segment) { - const unsigned long page_count = size / PAGE_SIZE; + unsigned int page_count; /* restricted by sg_alloc_table */ unsigned long i; struct scatterlist *sg; struct page *page; @@ -68,6 +68,10 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st, gfp_t noreclaim; int ret; + if (overflows_type(size / PAGE_SIZE, page_count)) + return -E2BIG; + + page_count = size / PAGE_SIZE; /* * If there's no chance of allocating enough pages for the whole * object, bail early. @@ -193,7 +197,6 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj) struct drm_i915_private *i915 = to_i915(obj->base.dev); struct intel_memory_region *mem = obj->mm.region; struct address_space *mapping = obj->base.filp->f_mapping; - const unsigned long page_count = obj->base.size / PAGE_SIZE; unsigned int max_segment = i915_sg_segment_size(i915->drm.dev); struct sg_table *st; struct sgt_iter sgt_iter; @@ -236,7 +239,7 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj) } else { dev_warn(i915->drm.dev, "Failed to DMA remap %lu pages\n", - page_count); + obj->base.size >> PAGE_SHIFT); goto err_pages; } } diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c index 2b5fc98ae922..244fca7c39f9 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c @@ -835,6 +835,10 @@ static int i915_ttm_get_pages(struct drm_i915_gem_object *obj) struct ttm_place requested, busy[I915_TTM_MAX_PLACEMENTS]; struct ttm_placement placement; + /* restricted by sg_alloc_table */ + if (overflows_type(obj->base.size >> PAGE_SHIFT, unsigned int)) + return -E2BIG; + GEM_BUG_ON(obj->mm.n_placements > I915_TTM_MAX_PLACEMENTS); /* Move to the requested placement. */ diff --git a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c index 9348b1804d53..1d3ebdf4069b 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c @@ -128,12 +128,16 @@ static void i915_gem_object_userptr_drop_ref(struct drm_i915_gem_object *obj) static int i915_gem_userptr_get_pages(struct drm_i915_gem_object *obj) { - const unsigned long num_pages = obj->base.size >> PAGE_SHIFT; unsigned int max_segment = i915_sg_segment_size(obj->base.dev->dev); struct sg_table *st; struct page **pvec; + unsigned int num_pages; /* limited by sg_alloc_table_from_pages_segment */ int ret; + if (overflows_type(obj->base.size >> PAGE_SHIFT, num_pages)) + return -E2BIG; + + num_pages = obj->base.size >> PAGE_SHIFT; st = kmalloc(sizeof(*st), GFP_KERNEL); if (!st) return -ENOMEM; diff --git a/drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c b/drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c index cbd9b624a788..bac957755068 100644 --- a/drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c +++ b/drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c @@ -29,11 +29,15 @@ static int huge_get_pages(struct drm_i915_gem_object *obj) { #define GFP (GFP_KERNEL | __GFP_NOWARN | __GFP_RETRY_MAYFAIL) const unsigned long nreal = obj->scratch / PAGE_SIZE; - const unsigned long npages = obj->base.size / PAGE_SIZE; + unsigned int npages; /* restricted by sg_alloc_table */ struct scatterlist *sg, *src, *end; struct sg_table *pages; unsigned long n; + if (overflows_type(obj->base.size / PAGE_SIZE, npages)) + return -E2BIG; + + npages = obj->base.size / PAGE_SIZE; pages = kmalloc(sizeof(*pages), GFP); if (!pages) return -ENOMEM; diff --git a/drivers/gpu/drm/i915/gem/selftests/huge_pages.c b/drivers/gpu/drm/i915/gem/selftests/huge_pages.c index e0c2ac9c8053..c281b0ec9e05 100644 --- a/drivers/gpu/drm/i915/gem/selftests/huge_pages.c +++ b/drivers/gpu/drm/i915/gem/selftests/huge_pages.c @@ -84,6 +84,10 @@ static int get_huge_pages(struct drm_i915_gem_object *obj) unsigned int sg_page_sizes; u64 rem; + /* restricted by sg_alloc_table */ + if (overflows_type(obj->base.size >> PAGE_SHIFT, unsigned int)) + return -E2BIG; + st = kmalloc(sizeof(*st), GFP); if (!st) return -ENOMEM; @@ -212,6 +216,10 @@ static int fake_get_huge_pages(struct drm_i915_gem_object *obj) struct scatterlist *sg; u64 rem; + /* restricted by sg_alloc_table */ + if (overflows_type(obj->base.size >> PAGE_SHIFT, unsigned int)) + return -E2BIG; + st = kmalloc(sizeof(*st), GFP); if (!st) return -ENOMEM; diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c index 355f1c0e8664..7af09eb24ac0 100644 --- a/drivers/gpu/drm/i915/gvt/dmabuf.c +++ b/drivers/gpu/drm/i915/gvt/dmabuf.c @@ -42,8 +42,7 @@ #define GEN8_DECODE_PTE(pte) (pte & GENMASK_ULL(63, 12)) -static int vgpu_gem_get_pages( - struct drm_i915_gem_object *obj) +static int vgpu_gem_get_pages(struct drm_i915_gem_object *obj) { struct drm_i915_private *dev_priv = to_i915(obj->base.dev); struct intel_vgpu *vgpu; @@ -52,8 +51,12 @@ static int vgpu_gem_get_pages( int i, j, ret; gen8_pte_t __iomem *gtt_entries; struct intel_vgpu_fb_info *fb_info; - u32 page_num; + unsigned int page_num; /* limited by sg_alloc_table */ + if (overflows_type(obj->base.size >> PAGE_SHIFT, page_num)) + return -E2BIG; + + page_num = obj->base.size >> PAGE_SHIFT; fb_info = (struct intel_vgpu_fb_info *)obj->gvt_info; if (drm_WARN_ON(&dev_priv->drm, !fb_info)) return -ENODEV; @@ -66,7 +69,6 @@ static int vgpu_gem_get_pages( if (unlikely(!st)) return -ENOMEM; - page_num = obj->base.size >> PAGE_SHIFT; ret = sg_alloc_table(st, page_num, GFP_KERNEL); if (ret) { kfree(st); diff --git a/drivers/gpu/drm/i915/i915_scatterlist.c b/drivers/gpu/drm/i915/i915_scatterlist.c index 114e5e39aa72..756289e43dff 100644 --- a/drivers/gpu/drm/i915/i915_scatterlist.c +++ b/drivers/gpu/drm/i915/i915_scatterlist.c @@ -96,6 +96,11 @@ struct i915_refct_sgt *i915_rsgt_from_mm_node(const struct drm_mm_node *node, i915_refct_sgt_init(rsgt, node->size << PAGE_SHIFT); st = &rsgt->table; + /* restricted by sg_alloc_table */ + if (WARN_ON(overflows_type(DIV_ROUND_UP_ULL(node->size, segment_pages), + unsigned int))) + return ERR_PTR(-E2BIG); + if (sg_alloc_table(st, DIV_ROUND_UP_ULL(node->size, segment_pages), GFP_KERNEL)) { i915_refct_sgt_put(rsgt); @@ -177,6 +182,10 @@ struct i915_refct_sgt *i915_rsgt_from_buddy_resource(struct ttm_resource *res, i915_refct_sgt_init(rsgt, size); st = &rsgt->table; + /* restricted by sg_alloc_table */ + if (WARN_ON(overflows_type(PFN_UP(res->size), unsigned int))) + return ERR_PTR(-E2BIG); + if (sg_alloc_table(st, PFN_UP(res->size), GFP_KERNEL)) { i915_refct_sgt_put(rsgt); return ERR_PTR(-ENOMEM); diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c index eae7d947d7de..01e75160a84a 100644 --- a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c +++ b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c @@ -68,6 +68,10 @@ static int fake_get_pages(struct drm_i915_gem_object *obj) return -ENOMEM; rem = round_up(obj->base.size, BIT(31)) >> 31; + /* restricted by sg_alloc_table */ + if (overflows_type(rem, unsigned int)) + return -E2BIG; + if (sg_alloc_table(pages, rem, GFP)) { kfree(pages); return -ENOMEM; diff --git a/drivers/gpu/drm/i915/selftests/scatterlist.c b/drivers/gpu/drm/i915/selftests/scatterlist.c index d599186d5b71..805c4bfb85fe 100644 --- a/drivers/gpu/drm/i915/selftests/scatterlist.c +++ b/drivers/gpu/drm/i915/selftests/scatterlist.c @@ -220,6 +220,10 @@ static int alloc_table(struct pfn_table *pt, struct scatterlist *sg; unsigned long n, pfn; + /* restricted by sg_alloc_table */ + if (overflows_type(max, unsigned int)) + return -E2BIG; + if (sg_alloc_table(&pt->st, max, GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN)) return alloc_error; -- 2.37.1 ^ permalink raw reply related [flat|nested] 23+ messages in thread
* [Intel-gfx] [PATCH v16 3/6] drm/i915: Check for integer truncation on the configuration of ttm place 2022-12-28 19:22 [Intel-gfx] [PATCH v16 0/6] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 1/6] drm/i915/gem: Typecheck page lookups Gwan-gyeong Mun 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 2/6] drm/i915: Check for integer truncation on scatterlist creation Gwan-gyeong Mun @ 2022-12-28 19:22 ` Gwan-gyeong Mun 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 4/6] drm/i915: Check if the size is too big while creating shmem file Gwan-gyeong Mun ` (7 subsequent siblings) 10 siblings, 0 replies; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-12-28 19:22 UTC (permalink / raw) To: intel-gfx Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld, mchehab, nirmoy.das There is an impedance mismatch between the first/last valid page frame number of ttm place in unsigned and our memory/page accounting in unsigned long. As the object size is under the control of userspace, we have to be prudent and catch the conversion errors. To catch the implicit truncation as we switch from unsigned long to unsigned, we use overflows_type check and report E2BIG or overflow_type prior to the operation. v3: Not to change execution inside a macro. (Mauro) Add safe_conversion_gem_bug_on() macro and remove temporal SAFE_CONVERSION() macro. v4: Fix unhandled GEM_BUG_ON() macro call from safe_conversion_gem_bug_on() v6: Fix to follow general use case for GEM_BUG_ON(). (Jani) v7: Fix to use WARN_ON() macro where GEM_BUG_ON() macro was used. (Jani) v8: Replace safe_conversion() with check_assign() (Kees) v14: Split one macro of assignment with checking of overflow to two steps, first overflow check, and second assignment. Cc: Chris Wilson <chris@chris-wilson.co.uk> Cc: Matthew Auld <matthew.auld@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Jani Nikula <jani.nikula@intel.com> Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> Reviewed-by: Nirmoy Das <nirmoy.das@intel.com> (v2) Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org> (v3) Reported-by: kernel test robot <lkp@intel.com> Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com> (v5) --- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 3 +++ drivers/gpu/drm/i915/intel_region_ttm.c | 14 ++++++++++++++ 2 files changed, 17 insertions(+) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c index 244fca7c39f9..ae10c7bdd509 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c @@ -140,13 +140,16 @@ i915_ttm_place_from_region(const struct intel_memory_region *mr, if (flags & I915_BO_ALLOC_CONTIGUOUS) place->flags |= TTM_PL_FLAG_CONTIGUOUS; if (offset != I915_BO_INVALID_OFFSET) { + WARN_ON(overflows_type(offset >> PAGE_SHIFT, place->fpfn)); place->fpfn = offset >> PAGE_SHIFT; + WARN_ON(overflows_type(place->fpfn + (size >> PAGE_SHIFT), place->lpfn)); place->lpfn = place->fpfn + (size >> PAGE_SHIFT); } else if (mr->io_size && mr->io_size < mr->total) { if (flags & I915_BO_ALLOC_GPU_ONLY) { place->flags |= TTM_PL_FLAG_TOPDOWN; } else { place->fpfn = 0; + WARN_ON(overflows_type(mr->io_size >> PAGE_SHIFT, place->lpfn)); place->lpfn = mr->io_size >> PAGE_SHIFT; } } diff --git a/drivers/gpu/drm/i915/intel_region_ttm.c b/drivers/gpu/drm/i915/intel_region_ttm.c index 4dc0702081b8..b7fbd5abb42a 100644 --- a/drivers/gpu/drm/i915/intel_region_ttm.c +++ b/drivers/gpu/drm/i915/intel_region_ttm.c @@ -208,13 +208,25 @@ intel_region_ttm_resource_alloc(struct intel_memory_region *mem, if (flags & I915_BO_ALLOC_CONTIGUOUS) place.flags |= TTM_PL_FLAG_CONTIGUOUS; if (offset != I915_BO_INVALID_OFFSET) { + if (WARN_ON(overflows_type(offset >> PAGE_SHIFT, place.fpfn))) { + ret = -E2BIG; + goto out; + } place.fpfn = offset >> PAGE_SHIFT; + if (WARN_ON(overflows_type(place.fpfn + (size >> PAGE_SHIFT), place.lpfn))) { + ret = -E2BIG; + goto out; + } place.lpfn = place.fpfn + (size >> PAGE_SHIFT); } else if (mem->io_size && mem->io_size < mem->total) { if (flags & I915_BO_ALLOC_GPU_ONLY) { place.flags |= TTM_PL_FLAG_TOPDOWN; } else { place.fpfn = 0; + if (WARN_ON(overflows_type(mem->io_size >> PAGE_SHIFT, place.lpfn))) { + ret = -E2BIG; + goto out; + } place.lpfn = mem->io_size >> PAGE_SHIFT; } } @@ -223,6 +235,8 @@ intel_region_ttm_resource_alloc(struct intel_memory_region *mem, mock_bo.bdev = &mem->i915->bdev; ret = man->func->alloc(man, &mock_bo, &place, &res); + +out: if (ret == -ENOSPC) ret = -ENXIO; if (!ret) -- 2.37.1 ^ permalink raw reply related [flat|nested] 23+ messages in thread
* [Intel-gfx] [PATCH v16 4/6] drm/i915: Check if the size is too big while creating shmem file 2022-12-28 19:22 [Intel-gfx] [PATCH v16 0/6] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun ` (2 preceding siblings ...) 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 3/6] drm/i915: Check for integer truncation on the configuration of ttm place Gwan-gyeong Mun @ 2022-12-28 19:22 ` Gwan-gyeong Mun 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 5/6] drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large Gwan-gyeong Mun ` (6 subsequent siblings) 10 siblings, 0 replies; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-12-28 19:22 UTC (permalink / raw) To: intel-gfx Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld, mchehab, nirmoy.das The __shmem_file_setup() function returns -EINVAL if size is greater than MAX_LFS_FILESIZE. To handle the same error as other code that returns -E2BIG when the size is too large, it add a code that returns -E2BIG when the size is larger than the size that can be handled. v4: If BITS_PER_LONG is 32, size > MAX_LFS_FILESIZE is always false, so it checks only when BITS_PER_LONG is 64. Cc: Chris Wilson <chris@chris-wilson.co.uk> Cc: Matthew Auld <matthew.auld@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> Reviewed-by: Nirmoy Das <nirmoy.das@intel.com> Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org> Reported-by: kernel test robot <lkp@intel.com> Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com> --- drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c index 28e857f8c169..e767791e40e0 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c @@ -541,6 +541,20 @@ static int __create_shmem(struct drm_i915_private *i915, drm_gem_private_object_init(&i915->drm, obj, size); + /* XXX: The __shmem_file_setup() function returns -EINVAL if size is + * greater than MAX_LFS_FILESIZE. + * To handle the same error as other code that returns -E2BIG when + * the size is too large, we add a code that returns -E2BIG when the + * size is larger than the size that can be handled. + * If BITS_PER_LONG is 32, size > MAX_LFS_FILESIZE is always false, + * so we only needs to check when BITS_PER_LONG is 64. + * If BITS_PER_LONG is 32, E2BIG checks are processed when + * i915_gem_object_size_2big() is called before init_object() callback + * is called. + */ + if (BITS_PER_LONG == 64 && size > MAX_LFS_FILESIZE) + return -E2BIG; + if (i915->mm.gemfs) filp = shmem_file_setup_with_mnt(i915->mm.gemfs, "i915", size, flags); -- 2.37.1 ^ permalink raw reply related [flat|nested] 23+ messages in thread
* [Intel-gfx] [PATCH v16 5/6] drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large 2022-12-28 19:22 [Intel-gfx] [PATCH v16 0/6] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun ` (3 preceding siblings ...) 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 4/6] drm/i915: Check if the size is too big while creating shmem file Gwan-gyeong Mun @ 2022-12-28 19:22 ` Gwan-gyeong Mun 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 6/6] drm/i915: Remove truncation warning for large objects Gwan-gyeong Mun ` (5 subsequent siblings) 10 siblings, 0 replies; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-12-28 19:22 UTC (permalink / raw) To: intel-gfx Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld, mchehab, nirmoy.das The ttm_bo_init_reserved() functions returns -ENOSPC if the size is too big to add vma. The direct function that returns -ENOSPC is drm_mm_insert_node_in_range(). To handle the same error as other code returning -E2BIG when the size is too large, it converts return value to -E2BIG. Cc: Chris Wilson <chris@chris-wilson.co.uk> Cc: Matthew Auld <matthew.auld@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> Reviewed-by: Nirmoy Das <nirmoy.das@intel.com> Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org> Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com> --- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c index ae10c7bdd509..8cfed1bef629 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c @@ -1312,6 +1312,17 @@ int __i915_gem_ttm_object_init(struct intel_memory_region *mem, ret = ttm_bo_init_reserved(&i915->bdev, i915_gem_to_ttm(obj), bo_type, &i915_sys_placement, page_size >> PAGE_SHIFT, &ctx, NULL, NULL, i915_ttm_bo_destroy); + + /* + * XXX: The ttm_bo_init_reserved() functions returns -ENOSPC if the size + * is too big to add vma. The direct function that returns -ENOSPC is + * drm_mm_insert_node_in_range(). To handle the same error as other code + * that returns -E2BIG when the size is too large, it converts -ENOSPC to + * -E2BIG. + */ + if (size >> PAGE_SHIFT > INT_MAX && ret == -ENOSPC) + ret = -E2BIG; + if (ret) return i915_ttm_err_to_gem(ret); -- 2.37.1 ^ permalink raw reply related [flat|nested] 23+ messages in thread
* [Intel-gfx] [PATCH v16 6/6] drm/i915: Remove truncation warning for large objects 2022-12-28 19:22 [Intel-gfx] [PATCH v16 0/6] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun ` (4 preceding siblings ...) 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 5/6] drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large Gwan-gyeong Mun @ 2022-12-28 19:22 ` Gwan-gyeong Mun 2022-12-28 19:51 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Patchwork ` (4 subsequent siblings) 10 siblings, 0 replies; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-12-28 19:22 UTC (permalink / raw) To: intel-gfx Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld, mchehab, nirmoy.das From: Chris Wilson <chris@chris-wilson.co.uk> Having addressed the issues surrounding incorrect types for local variables and potential integer truncation in using the scatterlist API, we have closed all the loop holes we had previously identified with dangerously large object creation. As such, we can eliminate the warning put in place to remind us to complete the review. Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: Brian Welty <brian.welty@intel.com> Cc: Matthew Auld <matthew.auld@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Testcase: igt@gem_create@create-massive Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/4991 Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> Reviewed-by: Nirmoy Das <nirmoy.das@intel.com> Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org> Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com> --- drivers/gpu/drm/i915/gem/i915_gem_object.h | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object.h b/drivers/gpu/drm/i915/gem/i915_gem_object.h index 4a661af87c4d..f9a8acbba715 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_object.h +++ b/drivers/gpu/drm/i915/gem/i915_gem_object.h @@ -20,25 +20,10 @@ enum intel_region_id; -/* - * XXX: There is a prevalence of the assumption that we fit the - * object's page count inside a 32bit _signed_ variable. Let's document - * this and catch if we ever need to fix it. In the meantime, if you do - * spot such a local variable, please consider fixing! - * - * We can check for invalidly typed locals with typecheck(), see for example - * i915_gem_object_get_sg(). - */ -#define GEM_CHECK_SIZE_OVERFLOW(sz) \ - GEM_WARN_ON((sz) >> PAGE_SHIFT > INT_MAX) - static inline bool i915_gem_object_size_2big(u64 size) { struct drm_i915_gem_object *obj; - if (GEM_CHECK_SIZE_OVERFLOW(size)) - return true; - if (overflows_type(size, obj->base.size)) return true; -- 2.37.1 ^ permalink raw reply related [flat|nested] 23+ messages in thread
* [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation 2022-12-28 19:22 [Intel-gfx] [PATCH v16 0/6] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun ` (5 preceding siblings ...) 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 6/6] drm/i915: Remove truncation warning for large objects Gwan-gyeong Mun @ 2022-12-28 19:51 ` Patchwork 2022-12-29 8:35 ` Gwan-gyeong Mun 2022-12-28 19:51 ` [Intel-gfx] ✗ Fi.CI.SPARSE: " Patchwork ` (3 subsequent siblings) 10 siblings, 1 reply; 23+ messages in thread From: Patchwork @ 2022-12-28 19:51 UTC (permalink / raw) To: Gwan-gyeong Mun; +Cc: intel-gfx == Series Details == Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation URL : https://patchwork.freedesktop.org/series/112279/ State : warning == Summary == Error: dim checkpatch failed 580bc7c6ee10 drm/i915/gem: Typecheck page lookups -:56: WARNING:DEPRECATED_API: Deprecated use of 'kmap_atomic', prefer 'kmap_local_page' instead #56: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.c:434: + src_map = kmap_atomic(i915_gem_object_get_page(obj, idx)); -:76: WARNING:AVOID_BUG: Do not crash the kernel unless it is absolutely unavoidable--use WARN_ON_ONCE() plus recovery code (if feasible) instead of BUG() or variants #76: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.c:489: + GEM_BUG_ON(overflows_type(offset >> PAGE_SHIFT, pgoff_t)); -:150: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects? #150: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:413: +#define i915_gem_object_page_iter_get_sg(obj, it, n, offset) ({ \ + static_assert(castable_to_type(n, pgoff_t)); \ + __i915_gem_object_page_iter_get_sg(obj, it, n, offset); \ +}) -:199: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects? #199: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:458: +#define i915_gem_object_get_sg(obj, n, offset) ({ \ + static_assert(castable_to_type(n, pgoff_t)); \ + __i915_gem_object_get_sg(obj, n, offset); \ +}) -:248: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects? #248: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:503: +#define i915_gem_object_get_sg_dma(obj, n, offset) ({ \ + static_assert(castable_to_type(n, pgoff_t)); \ + __i915_gem_object_get_sg_dma(obj, n, offset); \ +}) -:286: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects? #286: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:539: +#define i915_gem_object_get_page(obj, n) ({ \ + static_assert(castable_to_type(n, pgoff_t)); \ + __i915_gem_object_get_page(obj, n); \ +}) -:323: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects? #323: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:574: +#define i915_gem_object_get_dirty_page(obj, n) ({ \ + static_assert(castable_to_type(n, pgoff_t)); \ + __i915_gem_object_get_dirty_page(obj, n); \ +}) -:364: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects? #364: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:612: +#define i915_gem_object_get_dma_address_len(obj, n, len) ({ \ + static_assert(castable_to_type(n, pgoff_t)); \ + __i915_gem_object_get_dma_address_len(obj, n, len); \ +}) -:401: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects? #401: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:647: +#define i915_gem_object_get_dma_address(obj, n) ({ \ + static_assert(castable_to_type(n, pgoff_t)); \ + __i915_gem_object_get_dma_address(obj, n); \ +}) total: 0 errors, 2 warnings, 7 checks, 616 lines checked 383085856287 drm/i915: Check for integer truncation on scatterlist creation 60d38f11dfc7 drm/i915: Check for integer truncation on the configuration of ttm place c51e58da471c drm/i915: Check if the size is too big while creating shmem file 96ee63399a5e drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large 2402a45e5aac drm/i915: Remove truncation warning for large objects ^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation 2022-12-28 19:51 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Patchwork @ 2022-12-29 8:35 ` Gwan-gyeong Mun 0 siblings, 0 replies; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-12-29 8:35 UTC (permalink / raw) To: intel-gfx On 12/28/22 9:51 PM, Patchwork wrote: > == Series Details == > > Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation > URL : https://patchwork.freedesktop.org/series/112279/ > State : warning > > == Summary == > > Error: dim checkpatch failed > 580bc7c6ee10 drm/i915/gem: Typecheck page lookups > -:56: WARNING:DEPRECATED_API: Deprecated use of 'kmap_atomic', prefer 'kmap_local_page' instead > #56: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.c:434: > + src_map = kmap_atomic(i915_gem_object_get_page(obj, idx)); The kmap_atomic() used in this patch series is not a new addition, but the input argument used in the existing kmap_atomic() call is replaced with a local variable. Therefore, I suggest the discussion of replacing kmap_atomic() with kmap_local_page() should be considered in a separate patch. Unlike kmap_local_page(), kmap_atomic() is accompanied by additional operations (preempt_disable, pagefault_disable). Therefore, it is necessary to separately review whether there is a side effect by changing kmap_atomic() to kmap_local_page(). (Note. In the current implementation on i915, only kmap_atomic() is used (used in 13 places) and kmap_local_page() is not used.) [include/linux/highmem-internal.h] static inline void *kmap_atomic(struct page *page) { if (IS_ENABLED(CONFIG_PREEMPT_RT)) migrate_disable(); else preempt_disable(); pagefault_disable(); return page_address(page); } ... static inline void *kmap_local_page(struct page *page) { return page_address(page); } > > -:76: WARNING:AVOID_BUG: Do not crash the kernel unless it is absolutely unavoidable--use WARN_ON_ONCE() plus recovery code (if feasible) instead of BUG() or variants > #76: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.c:489: > + GEM_BUG_ON(overflows_type(offset >> PAGE_SHIFT, pgoff_t)); GEM_BUG_ON() used in this patch series is not a new addition, but the macro of the argument used for input has been changed from the previously used GEM_BUG_ON(). Changing GEM_BUG_ON() to a recoverable code should be considered in a separate patch. Br, G.G. > > -:150: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects? > #150: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:413: > +#define i915_gem_object_page_iter_get_sg(obj, it, n, offset) ({ \ > + static_assert(castable_to_type(n, pgoff_t)); \ > + __i915_gem_object_page_iter_get_sg(obj, it, n, offset); \ > +}) > > -:199: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects? > #199: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:458: > +#define i915_gem_object_get_sg(obj, n, offset) ({ \ > + static_assert(castable_to_type(n, pgoff_t)); \ > + __i915_gem_object_get_sg(obj, n, offset); \ > +}) > > -:248: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects? > #248: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:503: > +#define i915_gem_object_get_sg_dma(obj, n, offset) ({ \ > + static_assert(castable_to_type(n, pgoff_t)); \ > + __i915_gem_object_get_sg_dma(obj, n, offset); \ > +}) > > -:286: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects? > #286: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:539: > +#define i915_gem_object_get_page(obj, n) ({ \ > + static_assert(castable_to_type(n, pgoff_t)); \ > + __i915_gem_object_get_page(obj, n); \ > +}) > > -:323: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects? > #323: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:574: > +#define i915_gem_object_get_dirty_page(obj, n) ({ \ > + static_assert(castable_to_type(n, pgoff_t)); \ > + __i915_gem_object_get_dirty_page(obj, n); \ > +}) > > -:364: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects? > #364: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:612: > +#define i915_gem_object_get_dma_address_len(obj, n, len) ({ \ > + static_assert(castable_to_type(n, pgoff_t)); \ > + __i915_gem_object_get_dma_address_len(obj, n, len); \ > +}) > > -:401: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects? > #401: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:647: > +#define i915_gem_object_get_dma_address(obj, n) ({ \ > + static_assert(castable_to_type(n, pgoff_t)); \ > + __i915_gem_object_get_dma_address(obj, n); \ > +}) > > total: 0 errors, 2 warnings, 7 checks, 616 lines checked > 383085856287 drm/i915: Check for integer truncation on scatterlist creation > 60d38f11dfc7 drm/i915: Check for integer truncation on the configuration of ttm place > c51e58da471c drm/i915: Check if the size is too big while creating shmem file > 96ee63399a5e drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large > 2402a45e5aac drm/i915: Remove truncation warning for large objects > > ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] ✗ Fi.CI.SPARSE: warning for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation 2022-12-28 19:22 [Intel-gfx] [PATCH v16 0/6] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun ` (6 preceding siblings ...) 2022-12-28 19:51 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Patchwork @ 2022-12-28 19:51 ` Patchwork 2022-12-28 20:19 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork ` (2 subsequent siblings) 10 siblings, 0 replies; 23+ messages in thread From: Patchwork @ 2022-12-28 19:51 UTC (permalink / raw) To: Gwan-gyeong Mun; +Cc: intel-gfx == Series Details == Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation URL : https://patchwork.freedesktop.org/series/112279/ State : warning == Summary == Error: dim sparse failed Sparse version: v0.6.2 Fast mode used, each commit won't be checked separately. ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] ✓ Fi.CI.BAT: success for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation 2022-12-28 19:22 [Intel-gfx] [PATCH v16 0/6] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun ` (7 preceding siblings ...) 2022-12-28 19:51 ` [Intel-gfx] ✗ Fi.CI.SPARSE: " Patchwork @ 2022-12-28 20:19 ` Patchwork 2022-12-28 21:35 ` [Intel-gfx] ✓ Fi.CI.IGT: " Patchwork 2022-12-30 9:31 ` [Intel-gfx] [PATCH v16 0/6] " Rodrigo Vivi 10 siblings, 0 replies; 23+ messages in thread From: Patchwork @ 2022-12-28 20:19 UTC (permalink / raw) To: Gwan-gyeong Mun; +Cc: intel-gfx [-- Attachment #1: Type: text/plain, Size: 10510 bytes --] == Series Details == Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation URL : https://patchwork.freedesktop.org/series/112279/ State : success == Summary == CI Bug Log - changes from CI_DRM_12528 -> Patchwork_112279v1 ==================================================== Summary ------- **SUCCESS** No regressions found. External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/index.html Participating hosts (40 -> 44) ------------------------------ Additional (4): fi-kbl-soraka fi-bsw-kefka bat-dg2-9 bat-atsm-1 Possible new issues ------------------- Here are the unknown changes that may have been introduced in Patchwork_112279v1: ### IGT changes ### #### Suppressed #### The following results come from untrusted machines, tests, or statuses. They do not affect the overall result. * igt@runner@aborted: - {bat-adlp-9}: NOTRUN -> [FAIL][1] [1]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/bat-adlp-9/igt@runner@aborted.html Known issues ------------ Here are the changes found in Patchwork_112279v1 that come from known issues: ### IGT changes ### #### Issues hit #### * igt@gem_exec_gttfill@basic: - fi-kbl-soraka: NOTRUN -> [SKIP][2] ([fdo#109271]) +7 similar issues [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/fi-kbl-soraka/igt@gem_exec_gttfill@basic.html * igt@gem_huc_copy@huc-copy: - fi-kbl-soraka: NOTRUN -> [SKIP][3] ([fdo#109271] / [i915#2190]) [3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/fi-kbl-soraka/igt@gem_huc_copy@huc-copy.html * igt@gem_lmem_swapping@basic: - fi-kbl-soraka: NOTRUN -> [SKIP][4] ([fdo#109271] / [i915#4613]) +3 similar issues [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/fi-kbl-soraka/igt@gem_lmem_swapping@basic.html * igt@gem_lmem_swapping@parallel-random-engines: - bat-adlp-4: NOTRUN -> [SKIP][5] ([i915#4613]) +3 similar issues [5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/bat-adlp-4/igt@gem_lmem_swapping@parallel-random-engines.html * igt@i915_pm_rps@basic-api: - bat-adlp-4: NOTRUN -> [SKIP][6] ([i915#6621]) [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/bat-adlp-4/igt@i915_pm_rps@basic-api.html * igt@i915_selftest@live@gt_pm: - fi-kbl-soraka: NOTRUN -> [DMESG-FAIL][7] ([i915#1886]) [7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/fi-kbl-soraka/igt@i915_selftest@live@gt_pm.html * igt@i915_selftest@live@late_gt_pm: - fi-kbl-soraka: NOTRUN -> [INCOMPLETE][8] ([i915#7640]) [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/fi-kbl-soraka/igt@i915_selftest@live@late_gt_pm.html * igt@i915_selftest@live@migrate: - bat-adlp-4: NOTRUN -> [DMESG-FAIL][9] ([i915#7699]) [9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/bat-adlp-4/igt@i915_selftest@live@migrate.html * igt@kms_chamelium@common-hpd-after-suspend: - fi-hsw-4770: NOTRUN -> [SKIP][10] ([fdo#109271] / [fdo#111827]) [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/fi-hsw-4770/igt@kms_chamelium@common-hpd-after-suspend.html - bat-adlp-4: NOTRUN -> [SKIP][11] ([fdo#111827]) [11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/bat-adlp-4/igt@kms_chamelium@common-hpd-after-suspend.html * igt@kms_chamelium@hdmi-hpd-fast: - fi-bsw-kefka: NOTRUN -> [SKIP][12] ([fdo#109271] / [fdo#111827]) +8 similar issues [12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/fi-bsw-kefka/igt@kms_chamelium@hdmi-hpd-fast.html - fi-kbl-soraka: NOTRUN -> [SKIP][13] ([fdo#109271] / [fdo#111827]) +7 similar issues [13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/fi-kbl-soraka/igt@kms_chamelium@hdmi-hpd-fast.html * igt@kms_setmode@basic-clone-single-crtc: - fi-snb-2600: NOTRUN -> [SKIP][14] ([fdo#109271]) [14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/fi-snb-2600/igt@kms_setmode@basic-clone-single-crtc.html * igt@prime_vgem@basic-fence-flip: - fi-bsw-kefka: NOTRUN -> [SKIP][15] ([fdo#109271]) +17 similar issues [15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/fi-bsw-kefka/igt@prime_vgem@basic-fence-flip.html * igt@prime_vgem@basic-userptr: - bat-adlp-4: NOTRUN -> [SKIP][16] ([fdo#109295] / [i915#3301] / [i915#3708]) [16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/bat-adlp-4/igt@prime_vgem@basic-userptr.html * igt@prime_vgem@basic-write: - bat-adlp-4: NOTRUN -> [SKIP][17] ([fdo#109295] / [i915#3291] / [i915#3708]) +2 similar issues [17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/bat-adlp-4/igt@prime_vgem@basic-write.html #### Possible fixes #### * igt@i915_pm_rpm@basic-rte: - bat-adlp-4: [DMESG-WARN][18] ([i915#7077]) -> [PASS][19] [18]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/bat-adlp-4/igt@i915_pm_rpm@basic-rte.html [19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/bat-adlp-4/igt@i915_pm_rpm@basic-rte.html * igt@i915_selftest@live@gt_heartbeat: - fi-cfl-8109u: [DMESG-FAIL][20] ([i915#5334]) -> [PASS][21] [20]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/fi-cfl-8109u/igt@i915_selftest@live@gt_heartbeat.html [21]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/fi-cfl-8109u/igt@i915_selftest@live@gt_heartbeat.html * igt@i915_selftest@live@hangcheck: - fi-hsw-4770: [INCOMPLETE][22] ([i915#4785]) -> [PASS][23] [22]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/fi-hsw-4770/igt@i915_selftest@live@hangcheck.html [23]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/fi-hsw-4770/igt@i915_selftest@live@hangcheck.html * igt@i915_selftest@live@reset: - {bat-rpls-2}: [DMESG-FAIL][24] ([i915#4983]) -> [PASS][25] [24]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/bat-rpls-2/igt@i915_selftest@live@reset.html [25]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/bat-rpls-2/igt@i915_selftest@live@reset.html {name}: This element is suppressed. This means it is ignored when computing the status of the difference (SUCCESS, WARNING, or FAILURE). [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 [fdo#109285]: https://bugs.freedesktop.org/show_bug.cgi?id=109285 [fdo#109295]: https://bugs.freedesktop.org/show_bug.cgi?id=109295 [fdo#111827]: https://bugs.freedesktop.org/show_bug.cgi?id=111827 [i915#1072]: https://gitlab.freedesktop.org/drm/intel/issues/1072 [i915#1836]: https://gitlab.freedesktop.org/drm/intel/issues/1836 [i915#1845]: https://gitlab.freedesktop.org/drm/intel/issues/1845 [i915#1886]: https://gitlab.freedesktop.org/drm/intel/issues/1886 [i915#2190]: https://gitlab.freedesktop.org/drm/intel/issues/2190 [i915#2582]: https://gitlab.freedesktop.org/drm/intel/issues/2582 [i915#3291]: https://gitlab.freedesktop.org/drm/intel/issues/3291 [i915#3301]: https://gitlab.freedesktop.org/drm/intel/issues/3301 [i915#3555]: https://gitlab.freedesktop.org/drm/intel/issues/3555 [i915#3708]: https://gitlab.freedesktop.org/drm/intel/issues/3708 [i915#4077]: https://gitlab.freedesktop.org/drm/intel/issues/4077 [i915#4079]: https://gitlab.freedesktop.org/drm/intel/issues/4079 [i915#4083]: https://gitlab.freedesktop.org/drm/intel/issues/4083 [i915#4103]: https://gitlab.freedesktop.org/drm/intel/issues/4103 [i915#4212]: https://gitlab.freedesktop.org/drm/intel/issues/4212 [i915#4213]: https://gitlab.freedesktop.org/drm/intel/issues/4213 [i915#4215]: https://gitlab.freedesktop.org/drm/intel/issues/4215 [i915#4258]: https://gitlab.freedesktop.org/drm/intel/issues/4258 [i915#4579]: https://gitlab.freedesktop.org/drm/intel/issues/4579 [i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613 [i915#4785]: https://gitlab.freedesktop.org/drm/intel/issues/4785 [i915#4873]: https://gitlab.freedesktop.org/drm/intel/issues/4873 [i915#4983]: https://gitlab.freedesktop.org/drm/intel/issues/4983 [i915#5190]: https://gitlab.freedesktop.org/drm/intel/issues/5190 [i915#5274]: https://gitlab.freedesktop.org/drm/intel/issues/5274 [i915#5334]: https://gitlab.freedesktop.org/drm/intel/issues/5334 [i915#5354]: https://gitlab.freedesktop.org/drm/intel/issues/5354 [i915#6077]: https://gitlab.freedesktop.org/drm/intel/issues/6077 [i915#6078]: https://gitlab.freedesktop.org/drm/intel/issues/6078 [i915#6093]: https://gitlab.freedesktop.org/drm/intel/issues/6093 [i915#6094]: https://gitlab.freedesktop.org/drm/intel/issues/6094 [i915#6166]: https://gitlab.freedesktop.org/drm/intel/issues/6166 [i915#6311]: https://gitlab.freedesktop.org/drm/intel/issues/6311 [i915#6367]: https://gitlab.freedesktop.org/drm/intel/issues/6367 [i915#6621]: https://gitlab.freedesktop.org/drm/intel/issues/6621 [i915#6645]: https://gitlab.freedesktop.org/drm/intel/issues/6645 [i915#7077]: https://gitlab.freedesktop.org/drm/intel/issues/7077 [i915#7357]: https://gitlab.freedesktop.org/drm/intel/issues/7357 [i915#7561]: https://gitlab.freedesktop.org/drm/intel/issues/7561 [i915#7640]: https://gitlab.freedesktop.org/drm/intel/issues/7640 [i915#7699]: https://gitlab.freedesktop.org/drm/intel/issues/7699 Build changes ------------- * Linux: CI_DRM_12528 -> Patchwork_112279v1 CI-20190529: 20190529 CI_DRM_12528: 7e9f060b6f2ad746710306da06ba9c4a53876357 @ git://anongit.freedesktop.org/gfx-ci/linux IGT_7104: fe5def13049225967770eaaf19ec01ef80e2adc5 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git Patchwork_112279v1: 7e9f060b6f2ad746710306da06ba9c4a53876357 @ git://anongit.freedesktop.org/gfx-ci/linux ### Linux commits ad580bfb2c81 drm/i915: Remove truncation warning for large objects ab0b994e08dc drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large 5bcbc61d97b3 drm/i915: Check if the size is too big while creating shmem file 5ef5f4c7cd8a drm/i915: Check for integer truncation on the configuration of ttm place f63af31128b5 drm/i915: Check for integer truncation on scatterlist creation f451d70d6c05 drm/i915/gem: Typecheck page lookups == Logs == For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/index.html [-- Attachment #2: Type: text/html, Size: 10552 bytes --] ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] ✓ Fi.CI.IGT: success for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation 2022-12-28 19:22 [Intel-gfx] [PATCH v16 0/6] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun ` (8 preceding siblings ...) 2022-12-28 20:19 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork @ 2022-12-28 21:35 ` Patchwork 2022-12-30 9:31 ` [Intel-gfx] [PATCH v16 0/6] " Rodrigo Vivi 10 siblings, 0 replies; 23+ messages in thread From: Patchwork @ 2022-12-28 21:35 UTC (permalink / raw) To: Gwan-gyeong Mun; +Cc: intel-gfx [-- Attachment #1: Type: text/plain, Size: 22499 bytes --] == Series Details == Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation URL : https://patchwork.freedesktop.org/series/112279/ State : success == Summary == CI Bug Log - changes from CI_DRM_12528_full -> Patchwork_112279v1_full ==================================================== Summary ------- **SUCCESS** No regressions found. External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/index.html Participating hosts (13 -> 10) ------------------------------ Missing (3): pig-skl-6260u pig-kbl-iris pig-glk-j5005 Known issues ------------ Here are the changes found in Patchwork_112279v1_full that come from known issues: ### IGT changes ### #### Issues hit #### * igt@gem_exec_fair@basic-pace-share@rcs0: - shard-glk: [PASS][1] -> [FAIL][2] ([i915#2842]) [1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-glk3/igt@gem_exec_fair@basic-pace-share@rcs0.html [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-glk3/igt@gem_exec_fair@basic-pace-share@rcs0.html * igt@gen9_exec_parse@allowed-single: - shard-glk: [PASS][3] -> [DMESG-WARN][4] ([i915#5566] / [i915#716]) [3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-glk1/igt@gen9_exec_parse@allowed-single.html [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-glk2/igt@gen9_exec_parse@allowed-single.html * igt@kms_ccs@pipe-a-bad-aux-stride-y_tiled_gen12_rc_ccs_cc: - shard-glk: NOTRUN -> [SKIP][5] ([fdo#109271] / [i915#3886]) [5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-glk5/igt@kms_ccs@pipe-a-bad-aux-stride-y_tiled_gen12_rc_ccs_cc.html * igt@kms_chamelium@dp-edid-stress-resolution-non-4k: - shard-glk: NOTRUN -> [SKIP][6] ([fdo#109271] / [fdo#111827]) +3 similar issues [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-glk8/igt@kms_chamelium@dp-edid-stress-resolution-non-4k.html * igt@kms_psr2_su@frontbuffer-xrgb8888: - shard-glk: NOTRUN -> [SKIP][7] ([fdo#109271] / [i915#658]) +1 similar issue [7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-glk8/igt@kms_psr2_su@frontbuffer-xrgb8888.html * igt@kms_vrr@negative-basic: - shard-glk: NOTRUN -> [SKIP][8] ([fdo#109271]) +54 similar issues [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-glk8/igt@kms_vrr@negative-basic.html * igt@sysfs_clients@recycle-many: - shard-glk: NOTRUN -> [SKIP][9] ([fdo#109271] / [i915#2994]) [9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-glk8/igt@sysfs_clients@recycle-many.html #### Possible fixes #### * igt@fbdev@unaligned-write: - {shard-rkl}: [SKIP][10] ([i915#2582]) -> [PASS][11] [10]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-1/igt@fbdev@unaligned-write.html [11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-6/igt@fbdev@unaligned-write.html * igt@gem_create@create-massive: - {shard-rkl}: [DMESG-WARN][12] ([i915#4991]) -> [PASS][13] +1 similar issue [12]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-1/igt@gem_create@create-massive.html [13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-6/igt@gem_create@create-massive.html - {shard-dg1}: [DMESG-WARN][14] ([i915#4991]) -> [PASS][15] +1 similar issue [14]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-dg1-15/igt@gem_create@create-massive.html [15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-dg1-15/igt@gem_create@create-massive.html - shard-glk: [DMESG-WARN][16] ([i915#4991]) -> [PASS][17] +1 similar issue [16]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-glk6/igt@gem_create@create-massive.html [17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-glk8/igt@gem_create@create-massive.html * igt@gem_ctx_exec@basic-nohangcheck: - {shard-tglu-10}: [FAIL][18] ([i915#6268]) -> [PASS][19] [18]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-tglu-10/igt@gem_ctx_exec@basic-nohangcheck.html [19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-tglu-10/igt@gem_ctx_exec@basic-nohangcheck.html * igt@gem_exec_endless@dispatch@bcs0: - {shard-rkl}: [SKIP][20] ([i915#6247]) -> [PASS][21] [20]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-5/igt@gem_exec_endless@dispatch@bcs0.html [21]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-4/igt@gem_exec_endless@dispatch@bcs0.html * igt@gem_exec_fair@basic-pace@rcs0: - {shard-rkl}: [FAIL][22] ([i915#2842]) -> [PASS][23] +2 similar issues [22]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-4/igt@gem_exec_fair@basic-pace@rcs0.html [23]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-5/igt@gem_exec_fair@basic-pace@rcs0.html * igt@gem_exec_reloc@basic-cpu-read-noreloc: - {shard-rkl}: [SKIP][24] ([i915#3281]) -> [PASS][25] +3 similar issues [24]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-4/igt@gem_exec_reloc@basic-cpu-read-noreloc.html [25]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-5/igt@gem_exec_reloc@basic-cpu-read-noreloc.html * igt@gem_partial_pwrite_pread@writes-after-reads-uncached: - {shard-rkl}: [SKIP][26] ([i915#3282]) -> [PASS][27] +3 similar issues [26]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-4/igt@gem_partial_pwrite_pread@writes-after-reads-uncached.html [27]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-5/igt@gem_partial_pwrite_pread@writes-after-reads-uncached.html * igt@gem_workarounds@suspend-resume: - {shard-rkl}: [FAIL][28] ([fdo#103375]) -> [PASS][29] [28]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-3/igt@gem_workarounds@suspend-resume.html [29]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-6/igt@gem_workarounds@suspend-resume.html * igt@gen9_exec_parse@allowed-all: - {shard-rkl}: [SKIP][30] ([i915#2527]) -> [PASS][31] [30]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-3/igt@gen9_exec_parse@allowed-all.html [31]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-5/igt@gen9_exec_parse@allowed-all.html * igt@i915_pm_dc@dc5-psr: - {shard-rkl}: [SKIP][32] ([i915#658]) -> [PASS][33] [32]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-1/igt@i915_pm_dc@dc5-psr.html [33]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-6/igt@i915_pm_dc@dc5-psr.html * igt@i915_pm_dc@dc9-dpms: - {shard-rkl}: [SKIP][34] ([i915#3361]) -> [PASS][35] [34]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-5/igt@i915_pm_dc@dc9-dpms.html [35]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-4/igt@i915_pm_dc@dc9-dpms.html * igt@i915_pm_rpm@cursor-dpms: - {shard-rkl}: [SKIP][36] ([i915#1849]) -> [PASS][37] +1 similar issue [36]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-1/igt@i915_pm_rpm@cursor-dpms.html [37]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-6/igt@i915_pm_rpm@cursor-dpms.html * igt@i915_pm_rpm@dpms-mode-unset-lpsp: - {shard-dg1}: [SKIP][38] ([i915#1397]) -> [PASS][39] +2 similar issues [38]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-dg1-16/igt@i915_pm_rpm@dpms-mode-unset-lpsp.html [39]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-dg1-14/igt@i915_pm_rpm@dpms-mode-unset-lpsp.html * igt@kms_big_fb@x-tiled-32bpp-rotate-0: - {shard-rkl}: [SKIP][40] ([i915#1845] / [i915#4098]) -> [PASS][41] +17 similar issues [40]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-1/igt@kms_big_fb@x-tiled-32bpp-rotate-0.html [41]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-6/igt@kms_big_fb@x-tiled-32bpp-rotate-0.html * igt@kms_flip@2x-flip-vs-expired-vblank@ab-hdmi-a1-hdmi-a2: - shard-glk: [FAIL][42] ([i915#2122]) -> [PASS][43] [42]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-glk3/igt@kms_flip@2x-flip-vs-expired-vblank@ab-hdmi-a1-hdmi-a2.html [43]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-glk9/igt@kms_flip@2x-flip-vs-expired-vblank@ab-hdmi-a1-hdmi-a2.html * igt@kms_flip@flip-vs-expired-vblank@b-hdmi-a2: - shard-glk: [FAIL][44] ([i915#79]) -> [PASS][45] +1 similar issue [44]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-glk3/igt@kms_flip@flip-vs-expired-vblank@b-hdmi-a2.html [45]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-glk3/igt@kms_flip@flip-vs-expired-vblank@b-hdmi-a2.html * igt@kms_frontbuffer_tracking@fbc-1p-primscrn-spr-indfb-draw-mmap-gtt: - {shard-rkl}: [SKIP][46] ([i915#1849] / [i915#4098]) -> [PASS][47] +17 similar issues [46]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-1/igt@kms_frontbuffer_tracking@fbc-1p-primscrn-spr-indfb-draw-mmap-gtt.html [47]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-6/igt@kms_frontbuffer_tracking@fbc-1p-primscrn-spr-indfb-draw-mmap-gtt.html * igt@kms_plane@plane-panning-bottom-right@pipe-a-planes: - {shard-rkl}: [SKIP][48] ([i915#3558]) -> [PASS][49] +1 similar issue [48]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-1/igt@kms_plane@plane-panning-bottom-right@pipe-a-planes.html [49]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-6/igt@kms_plane@plane-panning-bottom-right@pipe-a-planes.html * igt@kms_psr@cursor_mmap_gtt: - {shard-rkl}: [SKIP][50] ([i915#1072]) -> [PASS][51] +2 similar issues [50]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-1/igt@kms_psr@cursor_mmap_gtt.html [51]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-6/igt@kms_psr@cursor_mmap_gtt.html * igt@kms_universal_plane@cursor-fb-leak-pipe-b: - {shard-rkl}: [SKIP][52] ([i915#1845] / [i915#4070] / [i915#4098]) -> [PASS][53] [52]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-1/igt@kms_universal_plane@cursor-fb-leak-pipe-b.html [53]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-6/igt@kms_universal_plane@cursor-fb-leak-pipe-b.html * igt@kms_universal_plane@universal-plane-pageflip-windowed-pipe-b: - {shard-rkl}: [SKIP][54] ([i915#4070] / [i915#4098]) -> [PASS][55] [54]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-1/igt@kms_universal_plane@universal-plane-pageflip-windowed-pipe-b.html [55]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-6/igt@kms_universal_plane@universal-plane-pageflip-windowed-pipe-b.html * igt@perf@mi-rpc: - {shard-rkl}: [SKIP][56] ([i915#2434]) -> [PASS][57] [56]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-3/igt@perf@mi-rpc.html [57]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-5/igt@perf@mi-rpc.html * igt@perf@polling-small-buf: - {shard-rkl}: [FAIL][58] ([i915#1722]) -> [PASS][59] [58]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-rkl-3/igt@perf@polling-small-buf.html [59]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-rkl-6/igt@perf@polling-small-buf.html #### Warnings #### * igt@runner@aborted: - shard-glk: ([FAIL][60], [FAIL][61]) ([i915#3002] / [i915#4312]) -> [FAIL][62] ([i915#4312]) [60]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-glk5/igt@runner@aborted.html [61]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/shard-glk6/igt@runner@aborted.html [62]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/shard-glk2/igt@runner@aborted.html {name}: This element is suppressed. This means it is ignored when computing the status of the difference (SUCCESS, WARNING, or FAILURE). [fdo#103375]: https://bugs.freedesktop.org/show_bug.cgi?id=103375 [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 [fdo#109274]: https://bugs.freedesktop.org/show_bug.cgi?id=109274 [fdo#109279]: https://bugs.freedesktop.org/show_bug.cgi?id=109279 [fdo#109280]: https://bugs.freedesktop.org/show_bug.cgi?id=109280 [fdo#109283]: https://bugs.freedesktop.org/show_bug.cgi?id=109283 [fdo#109289]: https://bugs.freedesktop.org/show_bug.cgi?id=109289 [fdo#109295]: https://bugs.freedesktop.org/show_bug.cgi?id=109295 [fdo#109303]: https://bugs.freedesktop.org/show_bug.cgi?id=109303 [fdo#109307]: https://bugs.freedesktop.org/show_bug.cgi?id=109307 [fdo#109308]: https://bugs.freedesktop.org/show_bug.cgi?id=109308 [fdo#109312]: https://bugs.freedesktop.org/show_bug.cgi?id=109312 [fdo#109313]: https://bugs.freedesktop.org/show_bug.cgi?id=109313 [fdo#109314]: https://bugs.freedesktop.org/show_bug.cgi?id=109314 [fdo#109315]: https://bugs.freedesktop.org/show_bug.cgi?id=109315 [fdo#109506]: https://bugs.freedesktop.org/show_bug.cgi?id=109506 [fdo#109642]: https://bugs.freedesktop.org/show_bug.cgi?id=109642 [fdo#110189]: https://bugs.freedesktop.org/show_bug.cgi?id=110189 [fdo#110723]: https://bugs.freedesktop.org/show_bug.cgi?id=110723 [fdo#111068]: https://bugs.freedesktop.org/show_bug.cgi?id=111068 [fdo#111614]: https://bugs.freedesktop.org/show_bug.cgi?id=111614 [fdo#111615]: https://bugs.freedesktop.org/show_bug.cgi?id=111615 [fdo#111644]: https://bugs.freedesktop.org/show_bug.cgi?id=111644 [fdo#111656]: https://bugs.freedesktop.org/show_bug.cgi?id=111656 [fdo#111825]: https://bugs.freedesktop.org/show_bug.cgi?id=111825 [fdo#111827]: https://bugs.freedesktop.org/show_bug.cgi?id=111827 [fdo#112054]: https://bugs.freedesktop.org/show_bug.cgi?id=112054 [fdo#112283]: https://bugs.freedesktop.org/show_bug.cgi?id=112283 [i915#1072]: https://gitlab.freedesktop.org/drm/intel/issues/1072 [i915#1257]: https://gitlab.freedesktop.org/drm/intel/issues/1257 [i915#132]: https://gitlab.freedesktop.org/drm/intel/issues/132 [i915#1397]: https://gitlab.freedesktop.org/drm/intel/issues/1397 [i915#1722]: https://gitlab.freedesktop.org/drm/intel/issues/1722 [i915#1769]: https://gitlab.freedesktop.org/drm/intel/issues/1769 [i915#1825]: https://gitlab.freedesktop.org/drm/intel/issues/1825 [i915#1839]: https://gitlab.freedesktop.org/drm/intel/issues/1839 [i915#1845]: https://gitlab.freedesktop.org/drm/intel/issues/1845 [i915#1849]: https://gitlab.freedesktop.org/drm/intel/issues/1849 [i915#1850]: https://gitlab.freedesktop.org/drm/intel/issues/1850 [i915#1902]: https://gitlab.freedesktop.org/drm/intel/issues/1902 [i915#2122]: https://gitlab.freedesktop.org/drm/intel/issues/2122 [i915#2434]: https://gitlab.freedesktop.org/drm/intel/issues/2434 [i915#2436]: https://gitlab.freedesktop.org/drm/intel/issues/2436 [i915#2437]: https://gitlab.freedesktop.org/drm/intel/issues/2437 [i915#2527]: https://gitlab.freedesktop.org/drm/intel/issues/2527 [i915#2575]: https://gitlab.freedesktop.org/drm/intel/issues/2575 [i915#2582]: https://gitlab.freedesktop.org/drm/intel/issues/2582 [i915#2587]: https://gitlab.freedesktop.org/drm/intel/issues/2587 [i915#2672]: https://gitlab.freedesktop.org/drm/intel/issues/2672 [i915#2681]: https://gitlab.freedesktop.org/drm/intel/issues/2681 [i915#280]: https://gitlab.freedesktop.org/drm/intel/issues/280 [i915#284]: https://gitlab.freedesktop.org/drm/intel/issues/284 [i915#2842]: https://gitlab.freedesktop.org/drm/intel/issues/2842 [i915#2856]: https://gitlab.freedesktop.org/drm/intel/issues/2856 [i915#2920]: https://gitlab.freedesktop.org/drm/intel/issues/2920 [i915#2994]: https://gitlab.freedesktop.org/drm/intel/issues/2994 [i915#3002]: https://gitlab.freedesktop.org/drm/intel/issues/3002 [i915#3116]: https://gitlab.freedesktop.org/drm/intel/issues/3116 [i915#315]: https://gitlab.freedesktop.org/drm/intel/issues/315 [i915#3281]: https://gitlab.freedesktop.org/drm/intel/issues/3281 [i915#3282]: https://gitlab.freedesktop.org/drm/intel/issues/3282 [i915#3297]: https://gitlab.freedesktop.org/drm/intel/issues/3297 [i915#3299]: https://gitlab.freedesktop.org/drm/intel/issues/3299 [i915#3301]: https://gitlab.freedesktop.org/drm/intel/issues/3301 [i915#3359]: https://gitlab.freedesktop.org/drm/intel/issues/3359 [i915#3361]: https://gitlab.freedesktop.org/drm/intel/issues/3361 [i915#3458]: https://gitlab.freedesktop.org/drm/intel/issues/3458 [i915#3528]: https://gitlab.freedesktop.org/drm/intel/issues/3528 [i915#3539]: https://gitlab.freedesktop.org/drm/intel/issues/3539 [i915#3546]: https://gitlab.freedesktop.org/drm/intel/issues/3546 [i915#3555]: https://gitlab.freedesktop.org/drm/intel/issues/3555 [i915#3558]: https://gitlab.freedesktop.org/drm/intel/issues/3558 [i915#3637]: https://gitlab.freedesktop.org/drm/intel/issues/3637 [i915#3638]: https://gitlab.freedesktop.org/drm/intel/issues/3638 [i915#3689]: https://gitlab.freedesktop.org/drm/intel/issues/3689 [i915#3708]: https://gitlab.freedesktop.org/drm/intel/issues/3708 [i915#3734]: https://gitlab.freedesktop.org/drm/intel/issues/3734 [i915#3742]: https://gitlab.freedesktop.org/drm/intel/issues/3742 [i915#3804]: https://gitlab.freedesktop.org/drm/intel/issues/3804 [i915#3810]: https://gitlab.freedesktop.org/drm/intel/issues/3810 [i915#3825]: https://gitlab.freedesktop.org/drm/intel/issues/3825 [i915#3840]: https://gitlab.freedesktop.org/drm/intel/issues/3840 [i915#3886]: https://gitlab.freedesktop.org/drm/intel/issues/3886 [i915#3955]: https://gitlab.freedesktop.org/drm/intel/issues/3955 [i915#3966]: https://gitlab.freedesktop.org/drm/intel/issues/3966 [i915#4070]: https://gitlab.freedesktop.org/drm/intel/issues/4070 [i915#4077]: https://gitlab.freedesktop.org/drm/intel/issues/4077 [i915#4078]: https://gitlab.freedesktop.org/drm/intel/issues/4078 [i915#4079]: https://gitlab.freedesktop.org/drm/intel/issues/4079 [i915#4083]: https://gitlab.freedesktop.org/drm/intel/issues/4083 [i915#4098]: https://gitlab.freedesktop.org/drm/intel/issues/4098 [i915#4103]: https://gitlab.freedesktop.org/drm/intel/issues/4103 [i915#4270]: https://gitlab.freedesktop.org/drm/intel/issues/4270 [i915#4312]: https://gitlab.freedesktop.org/drm/intel/issues/4312 [i915#4525]: https://gitlab.freedesktop.org/drm/intel/issues/4525 [i915#4538]: https://gitlab.freedesktop.org/drm/intel/issues/4538 [i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613 [i915#4767]: https://gitlab.freedesktop.org/drm/intel/issues/4767 [i915#4812]: https://gitlab.freedesktop.org/drm/intel/issues/4812 [i915#4833]: https://gitlab.freedesktop.org/drm/intel/issues/4833 [i915#4852]: https://gitlab.freedesktop.org/drm/intel/issues/4852 [i915#4860]: https://gitlab.freedesktop.org/drm/intel/issues/4860 [i915#4880]: https://gitlab.freedesktop.org/drm/intel/issues/4880 [i915#4991]: https://gitlab.freedesktop.org/drm/intel/issues/4991 [i915#5176]: https://gitlab.freedesktop.org/drm/intel/issues/5176 [i915#5235]: https://gitlab.freedesktop.org/drm/intel/issues/5235 [i915#5286]: https://gitlab.freedesktop.org/drm/intel/issues/5286 [i915#5288]: https://gitlab.freedesktop.org/drm/intel/issues/5288 [i915#5289]: https://gitlab.freedesktop.org/drm/intel/issues/5289 [i915#5325]: https://gitlab.freedesktop.org/drm/intel/issues/5325 [i915#5327]: https://gitlab.freedesktop.org/drm/intel/issues/5327 [i915#533]: https://gitlab.freedesktop.org/drm/intel/issues/533 [i915#5439]: https://gitlab.freedesktop.org/drm/intel/issues/5439 [i915#5563]: https://gitlab.freedesktop.org/drm/intel/issues/5563 [i915#5566]: https://gitlab.freedesktop.org/drm/intel/issues/5566 [i915#5784]: https://gitlab.freedesktop.org/drm/intel/issues/5784 [i915#6095]: https://gitlab.freedesktop.org/drm/intel/issues/6095 [i915#6247]: https://gitlab.freedesktop.org/drm/intel/issues/6247 [i915#6248]: https://gitlab.freedesktop.org/drm/intel/issues/6248 [i915#6268]: https://gitlab.freedesktop.org/drm/intel/issues/6268 [i915#6301]: https://gitlab.freedesktop.org/drm/intel/issues/6301 [i915#6335]: https://gitlab.freedesktop.org/drm/intel/issues/6335 [i915#6344]: https://gitlab.freedesktop.org/drm/intel/issues/6344 [i915#6433]: https://gitlab.freedesktop.org/drm/intel/issues/6433 [i915#6497]: https://gitlab.freedesktop.org/drm/intel/issues/6497 [i915#658]: https://gitlab.freedesktop.org/drm/intel/issues/658 [i915#6621]: https://gitlab.freedesktop.org/drm/intel/issues/6621 [i915#6768]: https://gitlab.freedesktop.org/drm/intel/issues/6768 [i915#6944]: https://gitlab.freedesktop.org/drm/intel/issues/6944 [i915#6946]: https://gitlab.freedesktop.org/drm/intel/issues/6946 [i915#7037]: https://gitlab.freedesktop.org/drm/intel/issues/7037 [i915#7116]: https://gitlab.freedesktop.org/drm/intel/issues/7116 [i915#7118]: https://gitlab.freedesktop.org/drm/intel/issues/7118 [i915#716]: https://gitlab.freedesktop.org/drm/intel/issues/716 [i915#7178]: https://gitlab.freedesktop.org/drm/intel/issues/7178 [i915#7561]: https://gitlab.freedesktop.org/drm/intel/issues/7561 [i915#7697]: https://gitlab.freedesktop.org/drm/intel/issues/7697 [i915#7711]: https://gitlab.freedesktop.org/drm/intel/issues/7711 [i915#79]: https://gitlab.freedesktop.org/drm/intel/issues/79 Build changes ------------- * Linux: CI_DRM_12528 -> Patchwork_112279v1 * Piglit: piglit_4509 -> None CI-20190529: 20190529 CI_DRM_12528: 7e9f060b6f2ad746710306da06ba9c4a53876357 @ git://anongit.freedesktop.org/gfx-ci/linux IGT_7104: fe5def13049225967770eaaf19ec01ef80e2adc5 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git Patchwork_112279v1: 7e9f060b6f2ad746710306da06ba9c4a53876357 @ git://anongit.freedesktop.org/gfx-ci/linux piglit_4509: fdc5a4ca11124ab8413c7988896eec4c97336694 @ git://anongit.freedesktop.org/piglit == Logs == For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112279v1/index.html [-- Attachment #2: Type: text/html, Size: 17496 bytes --] ^ permalink raw reply [flat|nested] 23+ messages in thread
* Re: [Intel-gfx] [PATCH v16 0/6] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation 2022-12-28 19:22 [Intel-gfx] [PATCH v16 0/6] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun ` (9 preceding siblings ...) 2022-12-28 21:35 ` [Intel-gfx] ✓ Fi.CI.IGT: " Patchwork @ 2022-12-30 9:31 ` Rodrigo Vivi 10 siblings, 0 replies; 23+ messages in thread From: Rodrigo Vivi @ 2022-12-30 9:31 UTC (permalink / raw) To: Gwan-gyeong Mun Cc: thomas.hellstrom, jani.nikula, intel-gfx, chris, matthew.auld, andrzej.hajda, mchehab, nirmoy.das On Wed, Dec 28, 2022 at 09:22:46PM +0200, Gwan-gyeong Mun wrote: > This patch series fixes integer overflow or integer truncation issues in > page lookups, ttm place configuration and scatterlist creation, etc. > We need to check that we avoid integer overflows when looking up a page, > and so fix all the instances where we have mistakenly used a plain integer > instead of a more suitable long. > And there is an impedance mismatch between the scatterlist API using > unsigned int and our memory/page accounting in unsigned long. That is we > may try to create a scatterlist for a large object that overflows returning > a small table into which we try to fit very many pages. As the object size > is under the control of userspace, we have to be prudent and catch the > conversion errors. To catch the implicit truncation as we switch from > unsigned long into the scatterlist's unsigned int, we use improved > overflows_type check and report E2BIG prior to the operation. This is > already used in our create ioctls to indicate if the uABI request is simply > too large for the backing store. > And ttm place also has the same problem with scatterlist creation, > and we fix the integer truncation problem with the way approached by > scatterlist creation. > And It corrects the error code to return -E2BIG when creating gem objects > using ttm or shmem, if the size is too large in each case. > > Compared to the v15 version patch series[1], there is no code modification in > this version patch series. Among the warnings reported by CI.CHECKPATCH, > this patch fixes the parts that need fixing. > Fix "ERROR:SPACING" Checkpatch report > Fix "WARNING:COMMIT_LOG_LONG_LINE" Checkpatch report > > [1] https://patchwork.freedesktop.org/series/112270/ I have backmerged the drm-next to drm-intel-gt-next and pushed this series. Thanks for the patches and reviews. > > Chris Wilson (3): > drm/i915/gem: Typecheck page lookups > drm/i915: Check for integer truncation on scatterlist creation > drm/i915: Remove truncation warning for large objects > > Gwan-gyeong Mun (3): > drm/i915: Check for integer truncation on the configuration of ttm > place > drm/i915: Check if the size is too big while creating shmem file > drm/i915: Use error code as -E2BIG when the size of gem ttm object is > too large > > drivers/gpu/drm/i915/gem/i915_gem_internal.c | 7 +- > drivers/gpu/drm/i915/gem/i915_gem_object.c | 7 +- > drivers/gpu/drm/i915/gem/i915_gem_object.h | 303 +++++++++++++++--- > drivers/gpu/drm/i915/gem/i915_gem_pages.c | 27 +- > drivers/gpu/drm/i915/gem/i915_gem_phys.c | 4 + > drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 23 +- > drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 20 +- > drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 6 +- > .../drm/i915/gem/selftests/huge_gem_object.c | 6 +- > .../gpu/drm/i915/gem/selftests/huge_pages.c | 8 + > .../drm/i915/gem/selftests/i915_gem_context.c | 12 +- > .../drm/i915/gem/selftests/i915_gem_mman.c | 8 +- > .../drm/i915/gem/selftests/i915_gem_object.c | 8 +- > drivers/gpu/drm/i915/gvt/dmabuf.c | 10 +- > drivers/gpu/drm/i915/i915_gem.c | 18 +- > drivers/gpu/drm/i915/i915_scatterlist.c | 9 + > drivers/gpu/drm/i915/i915_vma.c | 8 +- > drivers/gpu/drm/i915/intel_region_ttm.c | 14 + > drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 4 + > drivers/gpu/drm/i915/selftests/scatterlist.c | 4 + > 20 files changed, 420 insertions(+), 86 deletions(-) > > -- > 2.37.1 > ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] [PATCH v15 0/6] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation @ 2022-12-28 14:25 Gwan-gyeong Mun 2022-12-28 15:03 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 0 siblings, 1 reply; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-12-28 14:25 UTC (permalink / raw) To: intel-gfx Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld, mchehab, nirmoy.das This patch series fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation, etc. We need to check that we avoid integer overflows when looking up a page, and so fix all the instances where we have mistakenly used a plain integer instead of a more suitable long. And there is an impedance mismatch between the scatterlist API using unsigned int and our memory/page accounting in unsigned long. That is we may try to create a scatterlist for a large object that overflows returning a small table into which we try to fit very many pages. As the object size is under the control of userspace, we have to be prudent and catch the conversion errors. To catch the implicit truncation as we switch from unsigned long into the scatterlist's unsigned int, we use improved overflows_type check and report E2BIG prior to the operation. This is already used in our create ioctls to indicate if the uABI request is simply too large for the backing store. And ttm place also has the same problem with scatterlist creation, and we fix the integer truncation problem with the way approached by scatterlist creation. And It corrects the error code to return -E2BIG when creating gem objects using ttm or shmem, if the size is too large in each case. Linux 6.2 rc1 merged into drm-tip. I resend the same patch series as the previous version, except for one patch[1] included in Linux 6.2 rc1 from the previous v15 patch series. There is no difference in the code from the previous version [2] that was updated to v15 version. And it has already been confirmed by the CI results of v15 that there is no regression caused by this patch series. [1] https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=4b21d25bf519c9487935a664886956bb18f04f6d [2] https://patchwork.freedesktop.org/series/111963/ Chris Wilson (3): drm/i915/gem: Typecheck page lookups drm/i915: Check for integer truncation on scatterlist creation drm/i915: Remove truncation warning for large objects Gwan-gyeong Mun (3): drm/i915: Check for integer truncation on the configuration of ttm place drm/i915: Check if the size is too big while creating shmem file drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large drivers/gpu/drm/i915/gem/i915_gem_internal.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_object.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_object.h | 303 +++++++++++++++--- drivers/gpu/drm/i915/gem/i915_gem_pages.c | 27 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 4 + drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 23 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 20 +- drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 6 +- .../drm/i915/gem/selftests/huge_gem_object.c | 6 +- .../gpu/drm/i915/gem/selftests/huge_pages.c | 8 + .../drm/i915/gem/selftests/i915_gem_context.c | 12 +- .../drm/i915/gem/selftests/i915_gem_mman.c | 8 +- .../drm/i915/gem/selftests/i915_gem_object.c | 8 +- drivers/gpu/drm/i915/gvt/dmabuf.c | 10 +- drivers/gpu/drm/i915/i915_gem.c | 18 +- drivers/gpu/drm/i915/i915_scatterlist.c | 9 + drivers/gpu/drm/i915/i915_vma.c | 8 +- drivers/gpu/drm/i915/intel_region_ttm.c | 14 + drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 4 + drivers/gpu/drm/i915/selftests/scatterlist.c | 4 + 20 files changed, 420 insertions(+), 86 deletions(-) -- 2.37.1 ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] ✓ Fi.CI.BAT: success for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation 2022-12-28 14:25 [Intel-gfx] [PATCH v15 " Gwan-gyeong Mun @ 2022-12-28 15:03 ` Patchwork 0 siblings, 0 replies; 23+ messages in thread From: Patchwork @ 2022-12-28 15:03 UTC (permalink / raw) To: Gwan-gyeong Mun; +Cc: intel-gfx [-- Attachment #1: Type: text/plain, Size: 9629 bytes --] == Series Details == Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation URL : https://patchwork.freedesktop.org/series/112270/ State : success == Summary == CI Bug Log - changes from CI_DRM_12528 -> Patchwork_112270v1 ==================================================== Summary ------- **SUCCESS** No regressions found. External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/index.html Participating hosts (40 -> 43) ------------------------------ Additional (3): fi-bsw-kefka bat-dg2-9 bat-atsm-1 Known issues ------------ Here are the changes found in Patchwork_112270v1 that come from known issues: ### IGT changes ### #### Issues hit #### * igt@gem_exec_gttfill@basic: - fi-pnv-d510: [PASS][1] -> [FAIL][2] ([i915#7229]) [1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/fi-pnv-d510/igt@gem_exec_gttfill@basic.html [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/fi-pnv-d510/igt@gem_exec_gttfill@basic.html * igt@gem_lmem_swapping@parallel-random-engines: - bat-adlp-4: NOTRUN -> [SKIP][3] ([i915#4613]) +3 similar issues [3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/bat-adlp-4/igt@gem_lmem_swapping@parallel-random-engines.html * igt@i915_pm_rps@basic-api: - bat-adlp-4: NOTRUN -> [SKIP][4] ([i915#6621]) [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/bat-adlp-4/igt@i915_pm_rps@basic-api.html * igt@i915_selftest@live@execlists: - fi-bsw-n3050: [PASS][5] -> [INCOMPLETE][6] ([i915#6972]) [5]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/fi-bsw-n3050/igt@i915_selftest@live@execlists.html [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/fi-bsw-n3050/igt@i915_selftest@live@execlists.html * igt@kms_chamelium@common-hpd-after-suspend: - bat-adlp-4: NOTRUN -> [SKIP][7] ([fdo#111827]) [7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/bat-adlp-4/igt@kms_chamelium@common-hpd-after-suspend.html * igt@kms_chamelium@hdmi-hpd-fast: - fi-bsw-kefka: NOTRUN -> [SKIP][8] ([fdo#109271] / [fdo#111827]) +8 similar issues [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/fi-bsw-kefka/igt@kms_chamelium@hdmi-hpd-fast.html * igt@kms_setmode@basic-clone-single-crtc: - fi-snb-2600: NOTRUN -> [SKIP][9] ([fdo#109271]) [9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/fi-snb-2600/igt@kms_setmode@basic-clone-single-crtc.html * igt@prime_vgem@basic-fence-flip: - fi-bsw-kefka: NOTRUN -> [SKIP][10] ([fdo#109271]) +17 similar issues [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/fi-bsw-kefka/igt@prime_vgem@basic-fence-flip.html * igt@prime_vgem@basic-userptr: - bat-adlp-4: NOTRUN -> [SKIP][11] ([fdo#109295] / [i915#3301] / [i915#3708]) [11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/bat-adlp-4/igt@prime_vgem@basic-userptr.html * igt@prime_vgem@basic-write: - bat-adlp-4: NOTRUN -> [SKIP][12] ([fdo#109295] / [i915#3291] / [i915#3708]) +2 similar issues [12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/bat-adlp-4/igt@prime_vgem@basic-write.html * igt@runner@aborted: - fi-bsw-n3050: NOTRUN -> [FAIL][13] ([fdo#109271] / [i915#4312]) [13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/fi-bsw-n3050/igt@runner@aborted.html #### Possible fixes #### * igt@i915_pm_rpm@basic-rte: - bat-adlp-4: [DMESG-WARN][14] ([i915#7077]) -> [PASS][15] [14]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/bat-adlp-4/igt@i915_pm_rpm@basic-rte.html [15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/bat-adlp-4/igt@i915_pm_rpm@basic-rte.html * igt@i915_selftest@live@gt_heartbeat: - fi-cfl-8109u: [DMESG-FAIL][16] ([i915#5334]) -> [PASS][17] [16]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/fi-cfl-8109u/igt@i915_selftest@live@gt_heartbeat.html [17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/fi-cfl-8109u/igt@i915_selftest@live@gt_heartbeat.html * igt@i915_selftest@live@reset: - {bat-rpls-2}: [DMESG-FAIL][18] ([i915#4983]) -> [PASS][19] [18]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/bat-rpls-2/igt@i915_selftest@live@reset.html [19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/bat-rpls-2/igt@i915_selftest@live@reset.html * igt@kms_pipe_crc_basic@nonblocking-crc@pipe-d-dp-2: - {bat-dg2-11}: [FAIL][20] ([i915#7336]) -> [PASS][21] [20]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/bat-dg2-11/igt@kms_pipe_crc_basic@nonblocking-crc@pipe-d-dp-2.html [21]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/bat-dg2-11/igt@kms_pipe_crc_basic@nonblocking-crc@pipe-d-dp-2.html * igt@kms_pipe_crc_basic@suspend-read-crc@pipe-c-dp-1: - {bat-adlp-9}: [DMESG-WARN][22] ([i915#2867]) -> [PASS][23] [22]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12528/bat-adlp-9/igt@kms_pipe_crc_basic@suspend-read-crc@pipe-c-dp-1.html [23]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/bat-adlp-9/igt@kms_pipe_crc_basic@suspend-read-crc@pipe-c-dp-1.html {name}: This element is suppressed. This means it is ignored when computing the status of the difference (SUCCESS, WARNING, or FAILURE). [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 [fdo#109285]: https://bugs.freedesktop.org/show_bug.cgi?id=109285 [fdo#109295]: https://bugs.freedesktop.org/show_bug.cgi?id=109295 [fdo#111827]: https://bugs.freedesktop.org/show_bug.cgi?id=111827 [i915#1072]: https://gitlab.freedesktop.org/drm/intel/issues/1072 [i915#1836]: https://gitlab.freedesktop.org/drm/intel/issues/1836 [i915#1845]: https://gitlab.freedesktop.org/drm/intel/issues/1845 [i915#2582]: https://gitlab.freedesktop.org/drm/intel/issues/2582 [i915#2867]: https://gitlab.freedesktop.org/drm/intel/issues/2867 [i915#3291]: https://gitlab.freedesktop.org/drm/intel/issues/3291 [i915#3301]: https://gitlab.freedesktop.org/drm/intel/issues/3301 [i915#3546]: https://gitlab.freedesktop.org/drm/intel/issues/3546 [i915#3555]: https://gitlab.freedesktop.org/drm/intel/issues/3555 [i915#3708]: https://gitlab.freedesktop.org/drm/intel/issues/3708 [i915#4077]: https://gitlab.freedesktop.org/drm/intel/issues/4077 [i915#4079]: https://gitlab.freedesktop.org/drm/intel/issues/4079 [i915#4083]: https://gitlab.freedesktop.org/drm/intel/issues/4083 [i915#4103]: https://gitlab.freedesktop.org/drm/intel/issues/4103 [i915#4212]: https://gitlab.freedesktop.org/drm/intel/issues/4212 [i915#4213]: https://gitlab.freedesktop.org/drm/intel/issues/4213 [i915#4215]: https://gitlab.freedesktop.org/drm/intel/issues/4215 [i915#4312]: https://gitlab.freedesktop.org/drm/intel/issues/4312 [i915#4579]: https://gitlab.freedesktop.org/drm/intel/issues/4579 [i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613 [i915#4873]: https://gitlab.freedesktop.org/drm/intel/issues/4873 [i915#4983]: https://gitlab.freedesktop.org/drm/intel/issues/4983 [i915#5190]: https://gitlab.freedesktop.org/drm/intel/issues/5190 [i915#5274]: https://gitlab.freedesktop.org/drm/intel/issues/5274 [i915#5334]: https://gitlab.freedesktop.org/drm/intel/issues/5334 [i915#5354]: https://gitlab.freedesktop.org/drm/intel/issues/5354 [i915#6077]: https://gitlab.freedesktop.org/drm/intel/issues/6077 [i915#6078]: https://gitlab.freedesktop.org/drm/intel/issues/6078 [i915#6093]: https://gitlab.freedesktop.org/drm/intel/issues/6093 [i915#6094]: https://gitlab.freedesktop.org/drm/intel/issues/6094 [i915#6166]: https://gitlab.freedesktop.org/drm/intel/issues/6166 [i915#6257]: https://gitlab.freedesktop.org/drm/intel/issues/6257 [i915#6311]: https://gitlab.freedesktop.org/drm/intel/issues/6311 [i915#6367]: https://gitlab.freedesktop.org/drm/intel/issues/6367 [i915#6621]: https://gitlab.freedesktop.org/drm/intel/issues/6621 [i915#6645]: https://gitlab.freedesktop.org/drm/intel/issues/6645 [i915#6972]: https://gitlab.freedesktop.org/drm/intel/issues/6972 [i915#7077]: https://gitlab.freedesktop.org/drm/intel/issues/7077 [i915#7229]: https://gitlab.freedesktop.org/drm/intel/issues/7229 [i915#7336]: https://gitlab.freedesktop.org/drm/intel/issues/7336 [i915#7357]: https://gitlab.freedesktop.org/drm/intel/issues/7357 [i915#7561]: https://gitlab.freedesktop.org/drm/intel/issues/7561 Build changes ------------- * Linux: CI_DRM_12528 -> Patchwork_112270v1 CI-20190529: 20190529 CI_DRM_12528: 7e9f060b6f2ad746710306da06ba9c4a53876357 @ git://anongit.freedesktop.org/gfx-ci/linux IGT_7104: fe5def13049225967770eaaf19ec01ef80e2adc5 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git Patchwork_112270v1: 7e9f060b6f2ad746710306da06ba9c4a53876357 @ git://anongit.freedesktop.org/gfx-ci/linux ### Linux commits 27680e35fdb4 drm/i915: Remove truncation warning for large objects f94eb8cd0409 drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large 4af85c9f94a2 drm/i915: Check if the size is too big while creating shmem file 7129dee6fb1f drm/i915: Check for integer truncation on the configuration of ttm place 2278bbb19889 drm/i915: Check for integer truncation on scatterlist creation c979e64339a3 drm/i915/gem: Typecheck page lookups == Logs == For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_112270v1/index.html [-- Attachment #2: Type: text/html, Size: 9019 bytes --] ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] [PATCH v15 0/7] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation @ 2022-12-15 12:52 Gwan-gyeong Mun 2022-12-15 15:20 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 0 siblings, 1 reply; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-12-15 12:52 UTC (permalink / raw) To: intel-gfx Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld, mchehab, nirmoy.das This patch series fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation, etc. We need to check that we avoid integer overflows when looking up a page, and so fix all the instances where we have mistakenly used a plain integer instead of a more suitable long. And there is an impedance mismatch between the scatterlist API using unsigned int and our memory/page accounting in unsigned long. That is we may try to create a scatterlist for a large object that overflows returning a small table into which we try to fit very many pages. As the object size is under the control of userspace, we have to be prudent and catch the conversion errors. To catch the implicit truncation as we switch from unsigned long into the scatterlist's unsigned int, we use improved overflows_type check and report E2BIG prior to the operation. This is already used in our create ioctls to indicate if the uABI request is simply too large for the backing store. And ttm place also has the same problem with scatterlist creation, and we fix the integer truncation problem with the way approached by scatterlist creation. And It corrects the error code to return -E2BIG when creating gem objects using ttm or shmem, if the size is too large in each case. This series includes a patch [1] merged into the linux-next tree. (it added for testing of Intel-gfx CI) This version fixes and updates the comments left in the v14 patch [2]. [1] https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=4b21d25bf519c9487935a664886956bb18f04f6d [2] https://patchwork.freedesktop.org/patch/509528/?series=110413&rev=2 Chris Wilson (3): drm/i915/gem: Typecheck page lookups drm/i915: Check for integer truncation on scatterlist creation drm/i915: Remove truncation warning for large objects Gwan-gyeong Mun (3): drm/i915: Check for integer truncation on the configuration of ttm place drm/i915: Check if the size is too big while creating shmem file drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large Kees Cook (1): overflow: Introduce overflows_type() and castable_to_type() drivers/gpu/drm/i915/gem/i915_gem_internal.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_object.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_object.h | 303 ++++++++++++-- drivers/gpu/drm/i915/gem/i915_gem_pages.c | 27 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 4 + drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 23 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 20 +- drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 6 +- .../drm/i915/gem/selftests/huge_gem_object.c | 6 +- .../gpu/drm/i915/gem/selftests/huge_pages.c | 8 + .../drm/i915/gem/selftests/i915_gem_context.c | 12 +- .../drm/i915/gem/selftests/i915_gem_mman.c | 8 +- .../drm/i915/gem/selftests/i915_gem_object.c | 8 +- drivers/gpu/drm/i915/gvt/dmabuf.c | 10 +- drivers/gpu/drm/i915/i915_gem.c | 18 +- drivers/gpu/drm/i915/i915_scatterlist.c | 9 + drivers/gpu/drm/i915/i915_user_extensions.c | 2 +- drivers/gpu/drm/i915/i915_utils.h | 4 - drivers/gpu/drm/i915/i915_vma.c | 8 +- drivers/gpu/drm/i915/intel_region_ttm.c | 14 + drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 4 + drivers/gpu/drm/i915/selftests/scatterlist.c | 4 + include/linux/compiler.h | 1 + include/linux/overflow.h | 48 +++ lib/Makefile | 1 + lib/overflow_kunit.c | 381 ++++++++++++++++++ 26 files changed, 852 insertions(+), 91 deletions(-) -- 2.37.1 ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] ✓ Fi.CI.BAT: success for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation 2022-12-15 12:52 [Intel-gfx] [PATCH v15 0/7] " Gwan-gyeong Mun @ 2022-12-15 15:20 ` Patchwork 0 siblings, 0 replies; 23+ messages in thread From: Patchwork @ 2022-12-15 15:20 UTC (permalink / raw) To: Gwan-gyeong Mun; +Cc: intel-gfx [-- Attachment #1: Type: text/plain, Size: 19687 bytes --] == Series Details == Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation URL : https://patchwork.freedesktop.org/series/111963/ State : success == Summary == CI Bug Log - changes from CI_DRM_12510 -> Patchwork_111963v1 ==================================================== Summary ------- **SUCCESS** No regressions found. External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/index.html Participating hosts (19 -> 41) ------------------------------ Additional (22): fi-kbl-soraka bat-dg1-6 bat-dg1-5 bat-adlp-6 bat-rpls-1 bat-rpls-2 fi-skl-6600u fi-bsw-n3050 bat-dg2-8 bat-adlm-1 bat-dg2-9 fi-bwr-2160 bat-adln-1 bat-atsm-1 bat-jsl-3 bat-rplp-1 bat-dg2-11 fi-bsw-nick bat-dg1-7 bat-kbl-2 bat-adlp-9 bat-adlp-4 Possible new issues ------------------- Here are the unknown changes that may have been introduced in Patchwork_111963v1: ### IGT changes ### #### Suppressed #### The following results come from untrusted machines, tests, or statuses. They do not affect the overall result. * igt@i915_selftest@live@coherency: - {bat-jsl-3}: NOTRUN -> [INCOMPLETE][1] [1]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-jsl-3/igt@i915_selftest@live@coherency.html * igt@kms_pipe_crc_basic@suspend-read-crc@pipe-b-hdmi-a-1: - {bat-rpls-2}: NOTRUN -> [FAIL][2] +1 similar issue [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-rpls-2/igt@kms_pipe_crc_basic@suspend-read-crc@pipe-b-hdmi-a-1.html Known issues ------------ Here are the changes found in Patchwork_111963v1 that come from known issues: ### IGT changes ### #### Issues hit #### * igt@debugfs_test@basic-hwmon: - bat-adlp-4: NOTRUN -> [SKIP][3] ([i915#7456]) [3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-adlp-4/igt@debugfs_test@basic-hwmon.html * igt@gem_exec_gttfill@basic: - fi-kbl-soraka: NOTRUN -> [SKIP][4] ([fdo#109271]) +7 similar issues [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-kbl-soraka/igt@gem_exec_gttfill@basic.html * igt@gem_huc_copy@huc-copy: - fi-skl-6600u: NOTRUN -> [SKIP][5] ([fdo#109271] / [i915#2190]) [5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-skl-6600u/igt@gem_huc_copy@huc-copy.html - fi-kbl-soraka: NOTRUN -> [SKIP][6] ([fdo#109271] / [i915#2190]) [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-kbl-soraka/igt@gem_huc_copy@huc-copy.html * igt@gem_lmem_swapping@basic: - fi-kbl-soraka: NOTRUN -> [SKIP][7] ([fdo#109271] / [i915#4613]) +3 similar issues [7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-kbl-soraka/igt@gem_lmem_swapping@basic.html * igt@gem_lmem_swapping@parallel-random-engines: - fi-bsw-nick: NOTRUN -> [SKIP][8] ([fdo#109271]) +39 similar issues [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-bsw-nick/igt@gem_lmem_swapping@parallel-random-engines.html * igt@gem_lmem_swapping@random-engines: - fi-bsw-n3050: NOTRUN -> [SKIP][9] ([fdo#109271]) +20 similar issues [9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-bsw-n3050/igt@gem_lmem_swapping@random-engines.html - fi-skl-6600u: NOTRUN -> [SKIP][10] ([fdo#109271] / [i915#4613]) +3 similar issues [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-skl-6600u/igt@gem_lmem_swapping@random-engines.html * igt@gem_lmem_swapping@verify-random: - bat-adlp-4: NOTRUN -> [SKIP][11] ([i915#4613]) +3 similar issues [11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-adlp-4/igt@gem_lmem_swapping@verify-random.html * igt@gem_mmap@basic: - bat-dg1-5: NOTRUN -> [SKIP][12] ([i915#4083]) [12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-5/igt@gem_mmap@basic.html - bat-dg1-6: NOTRUN -> [SKIP][13] ([i915#4083]) [13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-6/igt@gem_mmap@basic.html * igt@gem_render_tiled_blits@basic: - bat-dg1-6: NOTRUN -> [SKIP][14] ([i915#4079]) +1 similar issue [14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-6/igt@gem_render_tiled_blits@basic.html * igt@gem_tiled_fence_blits@basic: - bat-dg1-6: NOTRUN -> [SKIP][15] ([i915#4077]) +2 similar issues [15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-6/igt@gem_tiled_fence_blits@basic.html - bat-dg1-5: NOTRUN -> [SKIP][16] ([i915#4077]) +2 similar issues [16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-5/igt@gem_tiled_fence_blits@basic.html * igt@gem_tiled_pread_basic: - bat-dg1-5: NOTRUN -> [SKIP][17] ([i915#4079]) +1 similar issue [17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-5/igt@gem_tiled_pread_basic.html - bat-adlp-4: NOTRUN -> [SKIP][18] ([i915#3282]) [18]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-adlp-4/igt@gem_tiled_pread_basic.html * igt@i915_pm_backlight@basic-brightness: - bat-dg1-6: NOTRUN -> [SKIP][19] ([i915#7561]) [19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-6/igt@i915_pm_backlight@basic-brightness.html - bat-dg1-5: NOTRUN -> [SKIP][20] ([i915#7561]) [20]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-5/igt@i915_pm_backlight@basic-brightness.html * igt@i915_pm_rps@basic-api: - bat-dg1-6: NOTRUN -> [SKIP][21] ([i915#6621]) [21]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-6/igt@i915_pm_rps@basic-api.html - bat-dg1-5: NOTRUN -> [SKIP][22] ([i915#6621]) [22]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-5/igt@i915_pm_rps@basic-api.html - bat-adlp-4: NOTRUN -> [SKIP][23] ([i915#6621]) [23]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-adlp-4/igt@i915_pm_rps@basic-api.html * igt@i915_selftest@live@gt_pm: - fi-kbl-soraka: NOTRUN -> [DMESG-FAIL][24] ([i915#1886]) [24]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-kbl-soraka/igt@i915_selftest@live@gt_pm.html * igt@i915_selftest@live@hangcheck: - fi-hsw-4770: [PASS][25] -> [INCOMPLETE][26] ([i915#4785]) [25]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12510/fi-hsw-4770/igt@i915_selftest@live@hangcheck.html [26]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-hsw-4770/igt@i915_selftest@live@hangcheck.html * igt@i915_selftest@live@late_gt_pm: - fi-kbl-soraka: NOTRUN -> [INCOMPLETE][27] ([i915#7640]) [27]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-kbl-soraka/igt@i915_selftest@live@late_gt_pm.html * igt@kms_addfb_basic@basic-x-tiled-legacy: - bat-dg1-5: NOTRUN -> [SKIP][28] ([i915#4212]) +7 similar issues [28]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-5/igt@kms_addfb_basic@basic-x-tiled-legacy.html * igt@kms_addfb_basic@basic-y-tiled-legacy: - bat-dg1-5: NOTRUN -> [SKIP][29] ([i915#4215]) [29]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-5/igt@kms_addfb_basic@basic-y-tiled-legacy.html - bat-dg1-6: NOTRUN -> [SKIP][30] ([i915#4215]) [30]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-6/igt@kms_addfb_basic@basic-y-tiled-legacy.html * igt@kms_addfb_basic@tile-pitch-mismatch: - bat-dg1-6: NOTRUN -> [SKIP][31] ([i915#4212]) +7 similar issues [31]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-6/igt@kms_addfb_basic@tile-pitch-mismatch.html * igt@kms_chamelium@dp-crc-fast: - bat-adlp-4: NOTRUN -> [SKIP][32] ([fdo#111827]) +8 similar issues [32]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-adlp-4/igt@kms_chamelium@dp-crc-fast.html * igt@kms_chamelium@dp-edid-read: - fi-bsw-n3050: NOTRUN -> [SKIP][33] ([fdo#109271] / [fdo#111827]) +8 similar issues [33]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-bsw-n3050/igt@kms_chamelium@dp-edid-read.html * igt@kms_chamelium@hdmi-crc-fast: - fi-skl-6600u: NOTRUN -> [SKIP][34] ([fdo#109271] / [fdo#111827]) +8 similar issues [34]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-skl-6600u/igt@kms_chamelium@hdmi-crc-fast.html - bat-dg1-6: NOTRUN -> [SKIP][35] ([fdo#111827]) +8 similar issues [35]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-6/igt@kms_chamelium@hdmi-crc-fast.html * igt@kms_chamelium@hdmi-hpd-fast: - fi-bsw-nick: NOTRUN -> [SKIP][36] ([fdo#109271] / [fdo#111827]) +8 similar issues [36]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-bsw-nick/igt@kms_chamelium@hdmi-hpd-fast.html - bat-dg1-5: NOTRUN -> [SKIP][37] ([fdo#111827]) +8 similar issues [37]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-5/igt@kms_chamelium@hdmi-hpd-fast.html - fi-kbl-soraka: NOTRUN -> [SKIP][38] ([fdo#109271] / [fdo#111827]) +7 similar issues [38]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-kbl-soraka/igt@kms_chamelium@hdmi-hpd-fast.html * igt@kms_cursor_legacy@basic-busy-flip-before-cursor: - bat-adlp-4: NOTRUN -> [SKIP][39] ([i915#4103]) [39]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-adlp-4/igt@kms_cursor_legacy@basic-busy-flip-before-cursor.html - bat-dg1-5: NOTRUN -> [SKIP][40] ([i915#4103] / [i915#4213]) [40]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-5/igt@kms_cursor_legacy@basic-busy-flip-before-cursor.html - bat-dg1-6: NOTRUN -> [SKIP][41] ([i915#4103] / [i915#4213]) [41]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-6/igt@kms_cursor_legacy@basic-busy-flip-before-cursor.html * igt@kms_force_connector_basic@force-load-detect: - bat-dg1-5: NOTRUN -> [SKIP][42] ([fdo#109285]) [42]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-5/igt@kms_force_connector_basic@force-load-detect.html - bat-dg1-6: NOTRUN -> [SKIP][43] ([fdo#109285]) [43]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-6/igt@kms_force_connector_basic@force-load-detect.html * igt@kms_force_connector_basic@prune-stale-modes: - bat-adlp-4: NOTRUN -> [SKIP][44] ([i915#4093]) +3 similar issues [44]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-adlp-4/igt@kms_force_connector_basic@prune-stale-modes.html * igt@kms_psr@primary_mmap_gtt: - fi-bwr-2160: NOTRUN -> [SKIP][45] ([fdo#109271]) +54 similar issues [45]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-bwr-2160/igt@kms_psr@primary_mmap_gtt.html * igt@kms_psr@sprite_plane_onoff: - bat-dg1-6: NOTRUN -> [SKIP][46] ([i915#1072] / [i915#4078]) +3 similar issues [46]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-6/igt@kms_psr@sprite_plane_onoff.html - bat-dg1-5: NOTRUN -> [SKIP][47] ([i915#1072] / [i915#4078]) +3 similar issues [47]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-5/igt@kms_psr@sprite_plane_onoff.html * igt@kms_setmode@basic-clone-single-crtc: - bat-dg1-6: NOTRUN -> [SKIP][48] ([i915#3555]) [48]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-6/igt@kms_setmode@basic-clone-single-crtc.html - bat-dg1-5: NOTRUN -> [SKIP][49] ([i915#3555]) [49]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-5/igt@kms_setmode@basic-clone-single-crtc.html - bat-adlp-4: NOTRUN -> [SKIP][50] ([i915#3555] / [i915#4579]) [50]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-adlp-4/igt@kms_setmode@basic-clone-single-crtc.html * igt@prime_vgem@basic-fence-read: - bat-dg1-5: NOTRUN -> [SKIP][51] ([i915#3708]) +3 similar issues [51]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-5/igt@prime_vgem@basic-fence-read.html * igt@prime_vgem@basic-gtt: - bat-dg1-5: NOTRUN -> [SKIP][52] ([i915#3708] / [i915#4077]) +1 similar issue [52]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-5/igt@prime_vgem@basic-gtt.html - bat-dg1-6: NOTRUN -> [SKIP][53] ([i915#3708] / [i915#4077]) +1 similar issue [53]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-6/igt@prime_vgem@basic-gtt.html * igt@prime_vgem@basic-read: - bat-dg1-6: NOTRUN -> [SKIP][54] ([i915#3708]) +3 similar issues [54]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-6/igt@prime_vgem@basic-read.html * igt@prime_vgem@basic-userptr: - bat-adlp-4: NOTRUN -> [SKIP][55] ([fdo#109295] / [i915#3301] / [i915#3708]) [55]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-adlp-4/igt@prime_vgem@basic-userptr.html - fi-skl-6600u: NOTRUN -> [SKIP][56] ([fdo#109271]) +4 similar issues [56]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-skl-6600u/igt@prime_vgem@basic-userptr.html - bat-dg1-5: NOTRUN -> [SKIP][57] ([i915#3708] / [i915#4873]) [57]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-5/igt@prime_vgem@basic-userptr.html - bat-dg1-6: NOTRUN -> [SKIP][58] ([i915#3708] / [i915#4873]) [58]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-dg1-6/igt@prime_vgem@basic-userptr.html * igt@prime_vgem@basic-write: - bat-adlp-4: NOTRUN -> [SKIP][59] ([fdo#109295] / [i915#3291] / [i915#3708]) +2 similar issues [59]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/bat-adlp-4/igt@prime_vgem@basic-write.html * igt@runner@aborted: - fi-hsw-4770: NOTRUN -> [FAIL][60] ([fdo#109271] / [i915#4312] / [i915#5594]) [60]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-hsw-4770/igt@runner@aborted.html #### Possible fixes #### * igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions: - fi-bsw-kefka: [FAIL][61] ([i915#6298]) -> [PASS][62] [61]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12510/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions.html [62]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions.html {name}: This element is suppressed. This means it is ignored when computing the status of the difference (SUCCESS, WARNING, or FAILURE). [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 [fdo#109285]: https://bugs.freedesktop.org/show_bug.cgi?id=109285 [fdo#109295]: https://bugs.freedesktop.org/show_bug.cgi?id=109295 [fdo#111827]: https://bugs.freedesktop.org/show_bug.cgi?id=111827 [i915#1072]: https://gitlab.freedesktop.org/drm/intel/issues/1072 [i915#1836]: https://gitlab.freedesktop.org/drm/intel/issues/1836 [i915#1845]: https://gitlab.freedesktop.org/drm/intel/issues/1845 [i915#1849]: https://gitlab.freedesktop.org/drm/intel/issues/1849 [i915#1886]: https://gitlab.freedesktop.org/drm/intel/issues/1886 [i915#2190]: https://gitlab.freedesktop.org/drm/intel/issues/2190 [i915#2582]: https://gitlab.freedesktop.org/drm/intel/issues/2582 [i915#3003]: https://gitlab.freedesktop.org/drm/intel/issues/3003 [i915#3282]: https://gitlab.freedesktop.org/drm/intel/issues/3282 [i915#3291]: https://gitlab.freedesktop.org/drm/intel/issues/3291 [i915#3301]: https://gitlab.freedesktop.org/drm/intel/issues/3301 [i915#3555]: https://gitlab.freedesktop.org/drm/intel/issues/3555 [i915#3637]: https://gitlab.freedesktop.org/drm/intel/issues/3637 [i915#3708]: https://gitlab.freedesktop.org/drm/intel/issues/3708 [i915#4077]: https://gitlab.freedesktop.org/drm/intel/issues/4077 [i915#4078]: https://gitlab.freedesktop.org/drm/intel/issues/4078 [i915#4079]: https://gitlab.freedesktop.org/drm/intel/issues/4079 [i915#4083]: https://gitlab.freedesktop.org/drm/intel/issues/4083 [i915#4093]: https://gitlab.freedesktop.org/drm/intel/issues/4093 [i915#4103]: https://gitlab.freedesktop.org/drm/intel/issues/4103 [i915#4212]: https://gitlab.freedesktop.org/drm/intel/issues/4212 [i915#4213]: https://gitlab.freedesktop.org/drm/intel/issues/4213 [i915#4215]: https://gitlab.freedesktop.org/drm/intel/issues/4215 [i915#4258]: https://gitlab.freedesktop.org/drm/intel/issues/4258 [i915#4303]: https://gitlab.freedesktop.org/drm/intel/issues/4303 [i915#4312]: https://gitlab.freedesktop.org/drm/intel/issues/4312 [i915#4579]: https://gitlab.freedesktop.org/drm/intel/issues/4579 [i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613 [i915#4785]: https://gitlab.freedesktop.org/drm/intel/issues/4785 [i915#4873]: https://gitlab.freedesktop.org/drm/intel/issues/4873 [i915#5190]: https://gitlab.freedesktop.org/drm/intel/issues/5190 [i915#5274]: https://gitlab.freedesktop.org/drm/intel/issues/5274 [i915#5354]: https://gitlab.freedesktop.org/drm/intel/issues/5354 [i915#5594]: https://gitlab.freedesktop.org/drm/intel/issues/5594 [i915#6077]: https://gitlab.freedesktop.org/drm/intel/issues/6077 [i915#6078]: https://gitlab.freedesktop.org/drm/intel/issues/6078 [i915#6093]: https://gitlab.freedesktop.org/drm/intel/issues/6093 [i915#6094]: https://gitlab.freedesktop.org/drm/intel/issues/6094 [i915#6166]: https://gitlab.freedesktop.org/drm/intel/issues/6166 [i915#6298]: https://gitlab.freedesktop.org/drm/intel/issues/6298 [i915#6311]: https://gitlab.freedesktop.org/drm/intel/issues/6311 [i915#6367]: https://gitlab.freedesktop.org/drm/intel/issues/6367 [i915#6621]: https://gitlab.freedesktop.org/drm/intel/issues/6621 [i915#6645]: https://gitlab.freedesktop.org/drm/intel/issues/6645 [i915#6997]: https://gitlab.freedesktop.org/drm/intel/issues/6997 [i915#7357]: https://gitlab.freedesktop.org/drm/intel/issues/7357 [i915#7456]: https://gitlab.freedesktop.org/drm/intel/issues/7456 [i915#7498]: https://gitlab.freedesktop.org/drm/intel/issues/7498 [i915#7561]: https://gitlab.freedesktop.org/drm/intel/issues/7561 [i915#7640]: https://gitlab.freedesktop.org/drm/intel/issues/7640 Build changes ------------- * Linux: CI_DRM_12510 -> Patchwork_111963v1 CI-20190529: 20190529 CI_DRM_12510: e7a0d02714edf5ceac30b8da5ed7151d7dadbd40 @ git://anongit.freedesktop.org/gfx-ci/linux IGT_7094: 1763071e9d50c5e992257c9197cb26f166de6fae @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git Patchwork_111963v1: e7a0d02714edf5ceac30b8da5ed7151d7dadbd40 @ git://anongit.freedesktop.org/gfx-ci/linux ### Linux commits bbf64a76e1e2 drm/i915: Remove truncation warning for large objects 5042d9bc7b22 drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large 0c2142b41ac9 drm/i915: Check if the size is too big while creating shmem file edd8a1ef90f2 drm/i915: Check for integer truncation on the configuration of ttm place 385e2d6d8a27 drm/i915: Check for integer truncation on scatterlist creation 476700f9aa6d drm/i915/gem: Typecheck page lookups 50a091d71029 overflow: Introduce overflows_type() and castable_to_type() == Logs == For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_111963v1/index.html [-- Attachment #2: Type: text/html, Size: 23451 bytes --] ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] [PATCH v14 0/7] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation @ 2022-11-02 14:53 Gwan-gyeong Mun 2022-11-02 16:43 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 0 siblings, 1 reply; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-11-02 14:53 UTC (permalink / raw) To: intel-gfx Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld, mchehab, nirmoy.das This patch series fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation, etc. We need to check that we avoid integer overflows when looking up a page, and so fix all the instances where we have mistakenly used a plain integer instead of a more suitable long. And there is an impedance mismatch between the scatterlist API using unsigned int and our memory/page accounting in unsigned long. That is we may try to create a scatterlist for a large object that overflows returning a small table into which we try to fit very many pages. As the object size is under the control of userspace, we have to be prudent and catch the conversion errors. To catch the implicit truncation as we switch from unsigned long into the scatterlist's unsigned int, we use improved overflows_type check and report E2BIG prior to the operation. This is already used in our create ioctls to indicate if the uABI request is simply too large for the backing store. And ttm place also has the same problem with scatterlist creation, and we fix the integer truncation problem with the way approached by scatterlist creation. And It corrects the error code to return -E2BIG when creating gem objects using ttm or shmem, if the size is too large in each case. This series includes a patch [1][2] merged into the hardening tree. (it added for testing of Intel-gfx CI and it should appear in -next shortly.) This version fixes and updates the comments and discussions left in the v13 patch [3][4]. - do not shadow sg_alloc_table() and sg_alloc_table_from_pages_segment() (Jani) - drop check_assign() and check_assign_user_ptr() macros (Linus) [1] https://lore.kernel.org/lkml/202211011605.2D8C927C2@keescook/ [2] https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/commit/?h=for-next/hardening&id=5904fcb776d0b518be96bca43f258db90f26ba9a [3] https://patchwork.freedesktop.org/patch/505092/?series=109169&rev=1 [4] https://lore.kernel.org/all/20220928081300.101516-6-gwan-gyeong.mun@intel.com/ Chris Wilson (3): drm/i915/gem: Typecheck page lookups drm/i915: Check for integer truncation on scatterlist creation drm/i915: Remove truncation warning for large objects Gwan-gyeong Mun (3): drm/i915: Check for integer truncation on the configuration of ttm place drm/i915: Check if the size is too big while creating shmem file drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large Kees Cook (1): overflow: Introduce overflows_type() and castable_to_type() drivers/gpu/drm/i915/gem/i915_gem_internal.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_object.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_object.h | 303 ++++++++++++-- drivers/gpu/drm/i915/gem/i915_gem_pages.c | 27 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 4 + drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 23 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 20 +- drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 6 +- .../drm/i915/gem/selftests/huge_gem_object.c | 6 +- .../gpu/drm/i915/gem/selftests/huge_pages.c | 8 + .../drm/i915/gem/selftests/i915_gem_context.c | 12 +- .../drm/i915/gem/selftests/i915_gem_mman.c | 8 +- .../drm/i915/gem/selftests/i915_gem_object.c | 8 +- drivers/gpu/drm/i915/gvt/dmabuf.c | 10 +- drivers/gpu/drm/i915/i915_gem.c | 18 +- drivers/gpu/drm/i915/i915_scatterlist.c | 5 + drivers/gpu/drm/i915/i915_user_extensions.c | 2 +- drivers/gpu/drm/i915/i915_utils.h | 4 - drivers/gpu/drm/i915/i915_vma.c | 8 +- drivers/gpu/drm/i915/intel_region_ttm.c | 14 + drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 4 + drivers/gpu/drm/i915/selftests/scatterlist.c | 4 + include/linux/compiler.h | 1 + include/linux/overflow.h | 48 +++ lib/Makefile | 1 + lib/overflow_kunit.c | 381 ++++++++++++++++++ 26 files changed, 848 insertions(+), 91 deletions(-) -- 2.37.1 ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] ✓ Fi.CI.BAT: success for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation 2022-11-02 14:53 [Intel-gfx] [PATCH v14 0/7] " Gwan-gyeong Mun @ 2022-11-02 16:43 ` Patchwork 0 siblings, 0 replies; 23+ messages in thread From: Patchwork @ 2022-11-02 16:43 UTC (permalink / raw) To: Gwan-gyeong Mun; +Cc: intel-gfx [-- Attachment #1: Type: text/plain, Size: 5244 bytes --] == Series Details == Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation URL : https://patchwork.freedesktop.org/series/110413/ State : success == Summary == CI Bug Log - changes from CI_DRM_12332 -> Patchwork_110413v1 ==================================================== Summary ------- **SUCCESS** No regressions found. External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/index.html Participating hosts (40 -> 28) ------------------------------ Additional (1): fi-tgl-dsi Missing (13): bat-dg2-8 bat-adlm-1 fi-icl-u2 bat-dg2-9 bat-adlp-6 bat-adlp-4 fi-hsw-4770 bat-adln-1 bat-rplp-1 bat-rpls-1 bat-rpls-2 bat-dg2-11 bat-jsl-1 Known issues ------------ Here are the changes found in Patchwork_110413v1 that come from known issues: ### IGT changes ### #### Issues hit #### * igt@gem_exec_gttfill@basic: - fi-pnv-d510: [PASS][1] -> [FAIL][2] ([i915#7229]) [1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/fi-pnv-d510/igt@gem_exec_gttfill@basic.html [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/fi-pnv-d510/igt@gem_exec_gttfill@basic.html * igt@gem_tiled_blits@basic: - fi-pnv-d510: [PASS][3] -> [SKIP][4] ([fdo#109271]) [3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/fi-pnv-d510/igt@gem_tiled_blits@basic.html [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/fi-pnv-d510/igt@gem_tiled_blits@basic.html * igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions-varying-size: - fi-bsw-kefka: [PASS][5] -> [FAIL][6] ([i915#6298]) [5]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions-varying-size.html [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions-varying-size.html #### Possible fixes #### * igt@i915_selftest@live@gt_heartbeat: - fi-apl-guc: [DMESG-FAIL][7] ([i915#5334]) -> [PASS][8] [7]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/fi-apl-guc/igt@i915_selftest@live@gt_heartbeat.html [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/fi-apl-guc/igt@i915_selftest@live@gt_heartbeat.html * igt@i915_selftest@live@hangcheck: - fi-adl-ddr5: [DMESG-WARN][9] ([i915#5591]) -> [PASS][10] [9]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/fi-adl-ddr5/igt@i915_selftest@live@hangcheck.html [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/fi-adl-ddr5/igt@i915_selftest@live@hangcheck.html {name}: This element is suppressed. This means it is ignored when computing the status of the difference (SUCCESS, WARNING, or FAILURE). [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 [fdo#109284]: https://bugs.freedesktop.org/show_bug.cgi?id=109284 [fdo#109285]: https://bugs.freedesktop.org/show_bug.cgi?id=109285 [fdo#109295]: https://bugs.freedesktop.org/show_bug.cgi?id=109295 [fdo#110189]: https://bugs.freedesktop.org/show_bug.cgi?id=110189 [fdo#111827]: https://bugs.freedesktop.org/show_bug.cgi?id=111827 [i915#2190]: https://gitlab.freedesktop.org/drm/intel/issues/2190 [i915#2411]: https://gitlab.freedesktop.org/drm/intel/issues/2411 [i915#3301]: https://gitlab.freedesktop.org/drm/intel/issues/3301 [i915#3555]: https://gitlab.freedesktop.org/drm/intel/issues/3555 [i915#4103]: https://gitlab.freedesktop.org/drm/intel/issues/4103 [i915#4312]: https://gitlab.freedesktop.org/drm/intel/issues/4312 [i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613 [i915#5334]: https://gitlab.freedesktop.org/drm/intel/issues/5334 [i915#5591]: https://gitlab.freedesktop.org/drm/intel/issues/5591 [i915#6298]: https://gitlab.freedesktop.org/drm/intel/issues/6298 [i915#6856]: https://gitlab.freedesktop.org/drm/intel/issues/6856 [i915#7125]: https://gitlab.freedesktop.org/drm/intel/issues/7125 [i915#7229]: https://gitlab.freedesktop.org/drm/intel/issues/7229 Build changes ------------- * Linux: CI_DRM_12332 -> Patchwork_110413v1 CI-20190529: 20190529 CI_DRM_12332: 601b2ef606e4b83d5518aa6a5011bb2b1c5954d9 @ git://anongit.freedesktop.org/gfx-ci/linux IGT_7038: 5389b3f3b9b75df6bd8506e4aa3da357fd0c0ab1 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git Patchwork_110413v1: 601b2ef606e4b83d5518aa6a5011bb2b1c5954d9 @ git://anongit.freedesktop.org/gfx-ci/linux ### Linux commits f71c44d6a1a6 drm/i915: Remove truncation warning for large objects 641448151051 drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large 36329637fb5b drm/i915: Check if the size is too big while creating shmem file 67fe599cfb22 drm/i915: Check for integer truncation on the configuration of ttm place f4b2efa46ed0 drm/i915: Check for integer truncation on scatterlist creation 7e6baa93be9b drm/i915/gem: Typecheck page lookups 4711dd3008b8 overflow: Introduce overflows_type() and castable_to_type() == Logs == For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/index.html [-- Attachment #2: Type: text/html, Size: 5067 bytes --] ^ permalink raw reply [flat|nested] 23+ messages in thread
* [PATCH v13 0/9] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation @ 2022-09-28 8:12 Gwan-gyeong Mun 2022-09-28 14:59 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 0 siblings, 1 reply; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-09-28 8:12 UTC (permalink / raw) To: intel-gfx Cc: linux-kernel, dri-devel, mchehab, chris, matthew.auld, thomas.hellstrom, jani.nikula, nirmoy.das, airlied, daniel, andi.shyti, andrzej.hajda, keescook, mauro.chehab, linux, vitor, dlatypov, ndesaulniers, trix, llvm, linux-hardening, linux-sparse, nathan, gustavoars, luc.vanoostenryck This patch series fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation, etc. We need to check that we avoid integer overflows when looking up a page, and so fix all the instances where we have mistakenly used a plain integer instead of a more suitable long. And there is an impedance mismatch between the scatterlist API using unsigned int and our memory/page accounting in unsigned long. That is we may try to create a scatterlist for a large object that overflows returning a small table into which we try to fit very many pages. As the object size is under the control of userspace, we have to be prudent and catch the conversion errors. To catch the implicit truncation as we switch from unsigned long into the scatterlist's unsigned int, we use improved overflows_type check and report E2BIG prior to the operation. This is already used in our create ioctls to indicate if the uABI request is simply too large for the backing store. And ttm place also has the same problem with scatterlist creation, and we fix the integer truncation problem with the way approached by scatterlist creation. And It corrects the error code to return -E2BIG when creating gem objects using ttm or shmem, if the size is too large in each case. In order to provide a common macro, it adds a few utility macros into overflow header. Introduce check_assign() and check_assign_user_ptr(). the check_assign() macro which performs an assigning source value into destination pointer along with an overflow check and check_assign_user_ptr() macro which performs an assigning source value into destination pointer type variable along with an overflow check. If an explicit overflow check is required while assigning to a user-space ptr, assign_user_ptr() can be used instead of u64_to_user_ptr() to assign integers into __user pointers along with an overflow check. check_assign(), overflows_type() are implemented on top of updated check_add_overflow() macro [1], and it also uses updated overflows_type() and castable_to_type() macro [2]. Therefore this series include the patch which came from Kees [1][2] (the both patches are under reviewing from other patch mails). [1] https://lore.kernel.org/all/202208311040.C6CA8253@keescook/ [2] https://lore.kernel.org/lkml/20220926191109.1803094-1-keescook@chromium.org/ Chris Wilson (3): drm/i915/gem: Typecheck page lookups drm/i915: Check for integer truncation on scatterlist creation drm/i915: Remove truncation warning for large objects Gwan-gyeong Mun (4): overflow: Introduce check_assign() and check_assign_user_ptr() drm/i915: Check for integer truncation on the configuration of ttm place drm/i915: Check if the size is too big while creating shmem file drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large Kees Cook (2): overflow: Allow mixed type arguments overflow: Introduce overflows_type() and castable_to_type() drivers/gpu/drm/i915/gem/i915_gem_internal.c | 6 +- drivers/gpu/drm/i915/gem/i915_gem_object.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_object.h | 303 +++++++++-- drivers/gpu/drm/i915/gem/i915_gem_pages.c | 27 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 4 + drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 19 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 23 +- drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 5 +- .../drm/i915/gem/selftests/i915_gem_context.c | 12 +- .../drm/i915/gem/selftests/i915_gem_mman.c | 8 +- .../drm/i915/gem/selftests/i915_gem_object.c | 8 +- drivers/gpu/drm/i915/gvt/dmabuf.c | 9 +- drivers/gpu/drm/i915/i915_gem.c | 18 +- drivers/gpu/drm/i915/i915_scatterlist.h | 11 + drivers/gpu/drm/i915/i915_user_extensions.c | 6 +- drivers/gpu/drm/i915/i915_utils.h | 4 - drivers/gpu/drm/i915/i915_vma.c | 8 +- drivers/gpu/drm/i915/intel_region_ttm.c | 17 +- include/linux/compiler.h | 1 + include/linux/overflow.h | 166 ++++-- lib/overflow_kunit.c | 489 ++++++++++++++++-- 21 files changed, 993 insertions(+), 158 deletions(-) -- 2.37.1 ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] ✓ Fi.CI.BAT: success for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation 2022-09-28 8:12 [PATCH v13 0/9] " Gwan-gyeong Mun @ 2022-09-28 14:59 ` Patchwork 0 siblings, 0 replies; 23+ messages in thread From: Patchwork @ 2022-09-28 14:59 UTC (permalink / raw) To: Gwan-gyeong Mun; +Cc: intel-gfx [-- Attachment #1: Type: text/plain, Size: 4153 bytes --] == Series Details == Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation URL : https://patchwork.freedesktop.org/series/109169/ State : success == Summary == CI Bug Log - changes from CI_DRM_12193 -> Patchwork_109169v1 ==================================================== Summary ------- **SUCCESS** No regressions found. External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109169v1/index.html Participating hosts (44 -> 44) ------------------------------ Additional (1): fi-tgl-dsi Missing (1): fi-bdw-samus Possible new issues ------------------- Here are the unknown changes that may have been introduced in Patchwork_109169v1: ### IGT changes ### #### Suppressed #### The following results come from untrusted machines, tests, or statuses. They do not affect the overall result. * igt@kms_pipe_crc_basic@suspend-read-crc@pipe-b-dp-2: - {bat-dg2-11}: [PASS][1] -> [FAIL][2] [1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12193/bat-dg2-11/igt@kms_pipe_crc_basic@suspend-read-crc@pipe-b-dp-2.html [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109169v1/bat-dg2-11/igt@kms_pipe_crc_basic@suspend-read-crc@pipe-b-dp-2.html Known issues ------------ Here are the changes found in Patchwork_109169v1 that come from known issues: ### IGT changes ### #### Possible fixes #### * igt@gem_exec_suspend@basic-s3@lmem0: - {bat-dg2-11}: [DMESG-WARN][3] ([i915#6816]) -> [PASS][4] [3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12193/bat-dg2-11/igt@gem_exec_suspend@basic-s3@lmem0.html [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109169v1/bat-dg2-11/igt@gem_exec_suspend@basic-s3@lmem0.html {name}: This element is suppressed. This means it is ignored when computing the status of the difference (SUCCESS, WARNING, or FAILURE). [fdo#109284]: https://bugs.freedesktop.org/show_bug.cgi?id=109284 [fdo#109285]: https://bugs.freedesktop.org/show_bug.cgi?id=109285 [fdo#109295]: https://bugs.freedesktop.org/show_bug.cgi?id=109295 [fdo#110189]: https://bugs.freedesktop.org/show_bug.cgi?id=110189 [fdo#111827]: https://bugs.freedesktop.org/show_bug.cgi?id=111827 [i915#2190]: https://gitlab.freedesktop.org/drm/intel/issues/2190 [i915#2867]: https://gitlab.freedesktop.org/drm/intel/issues/2867 [i915#3301]: https://gitlab.freedesktop.org/drm/intel/issues/3301 [i915#3555]: https://gitlab.freedesktop.org/drm/intel/issues/3555 [i915#4103]: https://gitlab.freedesktop.org/drm/intel/issues/4103 [i915#4312]: https://gitlab.freedesktop.org/drm/intel/issues/4312 [i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613 [i915#4983]: https://gitlab.freedesktop.org/drm/intel/issues/4983 [i915#6816]: https://gitlab.freedesktop.org/drm/intel/issues/6816 [i915#6856]: https://gitlab.freedesktop.org/drm/intel/issues/6856 Build changes ------------- * Linux: CI_DRM_12193 -> Patchwork_109169v1 CI-20190529: 20190529 CI_DRM_12193: 0f0716dcfd8446cde4391475c9c3656ca670b55f @ git://anongit.freedesktop.org/gfx-ci/linux IGT_6666: 1e3ecbaa3c56f4c52c62047707eb4942d3a39c44 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git Patchwork_109169v1: 0f0716dcfd8446cde4391475c9c3656ca670b55f @ git://anongit.freedesktop.org/gfx-ci/linux ### Linux commits 24847626c2a0 drm/i915: Remove truncation warning for large objects 122e401d217c drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large fa026ffe63df drm/i915: Check if the size is too big while creating shmem file c21bbacab403 drm/i915: Check for integer truncation on the configuration of ttm place 28d079cef486 drm/i915: Check for integer truncation on scatterlist creation 3aab4654e14b drm/i915/gem: Typecheck page lookups 0818337d2f25 overflow: Introduce overflows_type() and castable_to_type() 47c5745d4e24 overflow: Introduce check_assign() and check_assign_user_ptr() 488ee261cc98 overflow: Allow mixed type arguments == Logs == For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109169v1/index.html [-- Attachment #2: Type: text/html, Size: 3891 bytes --] ^ permalink raw reply [flat|nested] 23+ messages in thread
* [PATCH v12 0/9] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation @ 2022-09-26 15:39 Gwan-gyeong Mun 2022-09-26 22:53 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 0 siblings, 1 reply; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-09-26 15:39 UTC (permalink / raw) To: intel-gfx Cc: gustavoars, trix, dlatypov, llvm, linux, dri-devel, chris, linux-hardening, andrzej.hajda, linux-sparse, matthew.auld, andi.shyti, airlied, thomas.hellstrom, keescook, jani.nikula, nathan, mchehab, mauro.chehab, ndesaulniers, linux-kernel, vitor, luc.vanoostenryck, nirmoy.das This patch series fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation, etc. We need to check that we avoid integer overflows when looking up a page, and so fix all the instances where we have mistakenly used a plain integer instead of a more suitable long. And there is an impedance mismatch between the scatterlist API using unsigned int and our memory/page accounting in unsigned long. That is we may try to create a scatterlist for a large object that overflows returning a small table into which we try to fit very many pages. As the object size is under the control of userspace, we have to be prudent and catch the conversion errors. To catch the implicit truncation as we switch from unsigned long into the scatterlist's unsigned int, we use improved overflows_type check and report E2BIG prior to the operation. This is already used in our create ioctls to indicate if the uABI request is simply too large for the backing store. And ttm place also has the same problem with scatterlist creation, and we fix the integer truncation problem with the way approached by scatterlist creation. And It corrects the error code to return -E2BIG when creating gem objects using ttm or shmem, if the size is too large in each case. In order to provide a common macro, it moves and adds a few utility macros into overflow/compiler header. Introduces overflows_type() and __castable_to_type(). overflows_type() tests if a variable or constant value would overflow another variable or type. This can be used as a constant expression for static_assert() (which requires a constant expression[2][3]) when used on constant values. This must be constructed manually, since __builtin_add_overflow() does not produce a constant expression[4]. Additionally adds __castable_to_type(), similar to __same_type(), for checking if a constant value will fit in a given type (i.e. it could be cast to the type without overflow). Add unit tests for overflows_type(), __same_type(), and __castable_to_type() to the existing KUnit "overflow" test. And Introduce check_assign() and check_assign_user_ptr(). the check_assign() macro which performs an assigning source value into destination pointer along with an overflow check and check_assign_user_ptr() macro which performs an assigning source value into destination pointer type variable along with an overflow check. If an explicit overflow check is required while assigning to a user-space ptr, assign_user_ptr() can be used instead of u64_to_user_ptr() to assign integers into __user pointers along with an overflow check. In order to implement check_assign(), overflows_type() on top of updated check_add_overflow() macro, this series include the patch which came from Kees [1] (this patch is under reviewing from other patch mail). [1] https://lore.kernel.org/all/202208311040.C6CA8253@keescook/ [2] https://en.cppreference.com/w/c/language/_Static_assert [3] C11 standard (ISO/IEC 9899:2011): 6.7.10 Static assertions [4] https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins.html 6.56 Built-in Functions to Perform Arithmetic with Overflow Checking Built-in Function: bool __builtin_add_overflow (type1 a, type2 b, type3 *res) v12: Introduce updated overflows_type() and __castable_to_type() (Kees) Change to use static_assert(__castable_to_type(n ,T)) style since the assert_same_typable() macro has been dropped. (G.G) v11: Update macro description (Andi) Change _Static_assert to static_assert (Rasmus) Rename assert_type to assert_same_type and assert_typable to assert_same_typable (Rasmus) Update assert_same_typable macro to handle an overflow check on the target type when a constant value is used. (Kees) Add overflows_type_ret_const_expr which returns constant-expression value (G.G) Add is_unsigned_type (G.G) Add unit tests for overflows_type, overflows_type_ret_const_expr, assert_same_type and assert_same_typable. (Kees) Fix incorrect type assignment between different address spaces caused by the wrong use of __user macro. (kernel test robot) v10: Add check_assign_user_ptr() macro and drop overflows_ptr() macro(Kees) Use assert_typable instead of exactly_pgoff_t() macro (Kees) Remove a redundant type checking for a pointer. (Andrzej) Add patch "compiler_types.h: Add assert_type to catch type mis-match while compiling" and drop patch "util_macros: Add exact_type macro to catch type mis-match while compiling" from patch series (G.G.) (adding of assert_type(t1, t2) and assert_typable(t, n) were suggested by Kees v9's comments) v9: Fix overflows_type() to use __builtin_add_overflow() instead of __builtin_add_overflow_p() (Andrzej) Fix overflows_ptr() to use overflows_type() with the unsigned long type (Andrzej) v8: Add check_assign() and remove safe_conversion() (Kees) Replace safe_conversion() with check_assign() (Kees) Fix overflows_type() to use gcc's built-in overflow function (Andrzej) Add overflows_ptr() to allow overflow checking when assigning a value into a pointer variable (G.G.) v7: Fix to use WARN_ON() macro where GEM_BUG_ON() macro was used. (Jani) v6: Move macro addition location so that it can be used by other than drm subsystem (Jani, Mauro, Andi) Fix to follow general use case for GEM_BUG_ON(). (Jani) v5: Fix an alignment to match open parenthesis Fix macros to be enclosed in parentheses for complex values Fix too long line warning v4: Fix build warnins that reported by kernel test robot. (kernel test robot <lkp@intel.com>) Add kernel-doc markups to the kAPI functions and macros (Mauoro) v3: Modify overflows_type() macro to consider signed data types and add is_type_unsigned() macro (Mauro) Make not use the same macro name on a function. (Mauro) For kernel-doc, macros and functions are handled in the same namespace, the same macro name on a function prevents ever adding documentation for it. Not to change execution inside a macro. (Mauro) Fix the problem that safe_conversion() macro always returns true (G.G) Add safe_conversion_gem_bug_on() macro and remove temporal SAFE_CONVERSION() macro. (G.G.) Chris Wilson (3): drm/i915/gem: Typecheck page lookups drm/i915: Check for integer truncation on scatterlist creation drm/i915: Remove truncation warning for large objects Gwan-gyeong Mun (4): overflow: Introduce check_assign() and check_assign_user_ptr() drm/i915: Check for integer truncation on the configuration of ttm place drm/i915: Check if the size is too big while creating shmem file drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large Kees Cook (2): overflow: Allow mixed type arguments overflow: Introduce overflows_type() and __castable_to_type() drivers/gpu/drm/i915/gem/i915_gem_internal.c | 6 +- drivers/gpu/drm/i915/gem/i915_gem_object.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_object.h | 303 +++++++++-- drivers/gpu/drm/i915/gem/i915_gem_pages.c | 27 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 4 + drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 19 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 23 +- drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 5 +- .../drm/i915/gem/selftests/i915_gem_context.c | 12 +- .../drm/i915/gem/selftests/i915_gem_mman.c | 8 +- .../drm/i915/gem/selftests/i915_gem_object.c | 8 +- drivers/gpu/drm/i915/gvt/dmabuf.c | 9 +- drivers/gpu/drm/i915/i915_gem.c | 18 +- drivers/gpu/drm/i915/i915_scatterlist.h | 11 + drivers/gpu/drm/i915/i915_user_extensions.c | 6 +- drivers/gpu/drm/i915/i915_utils.h | 6 +- drivers/gpu/drm/i915/i915_vma.c | 8 +- drivers/gpu/drm/i915/intel_region_ttm.c | 17 +- include/linux/compiler.h | 1 + include/linux/overflow.h | 166 ++++-- lib/overflow_kunit.c | 494 ++++++++++++++++-- 21 files changed, 1000 insertions(+), 158 deletions(-) -- 2.37.1 ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] ✓ Fi.CI.BAT: success for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation 2022-09-26 15:39 [PATCH v12 0/9] " Gwan-gyeong Mun @ 2022-09-26 22:53 ` Patchwork 0 siblings, 0 replies; 23+ messages in thread From: Patchwork @ 2022-09-26 22:53 UTC (permalink / raw) To: Gwan-gyeong Mun; +Cc: intel-gfx [-- Attachment #1: Type: text/plain, Size: 11462 bytes --] == Series Details == Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation URL : https://patchwork.freedesktop.org/series/109063/ State : success == Summary == CI Bug Log - changes from CI_DRM_12185 -> Patchwork_109063v1 ==================================================== Summary ------- **SUCCESS** No regressions found. External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/index.html Participating hosts (46 -> 43) ------------------------------ Additional (1): fi-rkl-11600 Missing (4): fi-hsw-4770 fi-icl-u2 fi-bdw-samus fi-tgl-mst Known issues ------------ Here are the changes found in Patchwork_109063v1 that come from known issues: ### IGT changes ### #### Issues hit #### * igt@gem_huc_copy@huc-copy: - fi-rkl-11600: NOTRUN -> [SKIP][1] ([i915#2190]) [1]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-rkl-11600/igt@gem_huc_copy@huc-copy.html * igt@gem_lmem_swapping@basic: - fi-rkl-11600: NOTRUN -> [SKIP][2] ([i915#4613]) +3 similar issues [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-rkl-11600/igt@gem_lmem_swapping@basic.html * igt@gem_tiled_pread_basic: - fi-rkl-11600: NOTRUN -> [SKIP][3] ([i915#3282]) [3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-rkl-11600/igt@gem_tiled_pread_basic.html * igt@i915_pm_backlight@basic-brightness: - fi-rkl-11600: NOTRUN -> [SKIP][4] ([i915#3012]) [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-rkl-11600/igt@i915_pm_backlight@basic-brightness.html * igt@i915_pm_rpm@module-reload: - fi-bsw-kefka: [PASS][5] -> [DMESG-WARN][6] ([i915#1982]) [5]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12185/fi-bsw-kefka/igt@i915_pm_rpm@module-reload.html [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-bsw-kefka/igt@i915_pm_rpm@module-reload.html * igt@i915_selftest@live@hangcheck: - fi-hsw-g3258: [PASS][7] -> [INCOMPLETE][8] ([i915#3303] / [i915#4785]) [7]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12185/fi-hsw-g3258/igt@i915_selftest@live@hangcheck.html [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-hsw-g3258/igt@i915_selftest@live@hangcheck.html * igt@i915_suspend@basic-s3-without-i915: - fi-rkl-11600: NOTRUN -> [INCOMPLETE][9] ([i915#5982]) [9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-rkl-11600/igt@i915_suspend@basic-s3-without-i915.html * igt@kms_chamelium@hdmi-edid-read: - fi-rkl-11600: NOTRUN -> [SKIP][10] ([fdo#111827]) +7 similar issues [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-rkl-11600/igt@kms_chamelium@hdmi-edid-read.html * igt@kms_cursor_legacy@basic-busy-flip-before-cursor: - fi-rkl-11600: NOTRUN -> [SKIP][11] ([i915#4103]) [11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-rkl-11600/igt@kms_cursor_legacy@basic-busy-flip-before-cursor.html * igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions: - fi-bsw-kefka: [PASS][12] -> [FAIL][13] ([i915#6298]) [12]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12185/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions.html [13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions.html * igt@kms_force_connector_basic@force-load-detect: - fi-rkl-11600: NOTRUN -> [SKIP][14] ([fdo#109285] / [i915#4098]) [14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-rkl-11600/igt@kms_force_connector_basic@force-load-detect.html * igt@kms_psr@primary_page_flip: - fi-rkl-11600: NOTRUN -> [SKIP][15] ([i915#1072]) +3 similar issues [15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-rkl-11600/igt@kms_psr@primary_page_flip.html * igt@kms_setmode@basic-clone-single-crtc: - fi-rkl-11600: NOTRUN -> [SKIP][16] ([i915#3555] / [i915#4098]) [16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-rkl-11600/igt@kms_setmode@basic-clone-single-crtc.html * igt@prime_vgem@basic-read: - fi-rkl-11600: NOTRUN -> [SKIP][17] ([fdo#109295] / [i915#3291] / [i915#3708]) +2 similar issues [17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-rkl-11600/igt@prime_vgem@basic-read.html * igt@prime_vgem@basic-userptr: - fi-rkl-11600: NOTRUN -> [SKIP][18] ([fdo#109295] / [i915#3301] / [i915#3708]) [18]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-rkl-11600/igt@prime_vgem@basic-userptr.html * igt@runner@aborted: - fi-bdw-5557u: NOTRUN -> [FAIL][19] ([i915#4312]) [19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-bdw-5557u/igt@runner@aborted.html - fi-hsw-g3258: NOTRUN -> [FAIL][20] ([fdo#109271] / [i915#4312]) [20]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-hsw-g3258/igt@runner@aborted.html #### Possible fixes #### * igt@gem_ringfill@basic-all: - {bat-dg2-9}: [FAIL][21] ([i915#5886]) -> [PASS][22] [21]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12185/bat-dg2-9/igt@gem_ringfill@basic-all.html [22]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/bat-dg2-9/igt@gem_ringfill@basic-all.html * igt@i915_selftest@live@late_gt_pm: - fi-cfl-8109u: [DMESG-WARN][23] ([i915#5904]) -> [PASS][24] +30 similar issues [23]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12185/fi-cfl-8109u/igt@i915_selftest@live@late_gt_pm.html [24]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-cfl-8109u/igt@i915_selftest@live@late_gt_pm.html * igt@i915_selftest@live@requests: - {bat-rpls-1}: [INCOMPLETE][25] ([i915#4983] / [i915#6257] / [i915#6380]) -> [PASS][26] [25]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12185/bat-rpls-1/igt@i915_selftest@live@requests.html [26]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/bat-rpls-1/igt@i915_selftest@live@requests.html * igt@i915_selftest@live@slpc: - {bat-rplp-1}: [DMESG-FAIL][27] -> [PASS][28] [27]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12185/bat-rplp-1/igt@i915_selftest@live@slpc.html [28]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/bat-rplp-1/igt@i915_selftest@live@slpc.html * igt@i915_suspend@basic-s2idle-without-i915: - fi-cfl-8109u: [DMESG-WARN][29] ([i915#5904] / [i915#62]) -> [PASS][30] [29]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12185/fi-cfl-8109u/igt@i915_suspend@basic-s2idle-without-i915.html [30]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-cfl-8109u/igt@i915_suspend@basic-s2idle-without-i915.html * igt@kms_frontbuffer_tracking@basic: - fi-cfl-8109u: [DMESG-FAIL][31] ([i915#62]) -> [PASS][32] +1 similar issue [31]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12185/fi-cfl-8109u/igt@kms_frontbuffer_tracking@basic.html [32]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-cfl-8109u/igt@kms_frontbuffer_tracking@basic.html * igt@kms_pipe_crc_basic@nonblocking-crc-frame-sequence@pipe-c-dp-1: - fi-cfl-8109u: [DMESG-WARN][33] ([i915#62]) -> [PASS][34] +10 similar issues [33]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12185/fi-cfl-8109u/igt@kms_pipe_crc_basic@nonblocking-crc-frame-sequence@pipe-c-dp-1.html [34]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/fi-cfl-8109u/igt@kms_pipe_crc_basic@nonblocking-crc-frame-sequence@pipe-c-dp-1.html * igt@kms_pipe_crc_basic@suspend-read-crc@pipe-d-dp-2: - {bat-dg2-11}: [FAIL][35] ([i915#6818]) -> [PASS][36] [35]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12185/bat-dg2-11/igt@kms_pipe_crc_basic@suspend-read-crc@pipe-d-dp-2.html [36]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/bat-dg2-11/igt@kms_pipe_crc_basic@suspend-read-crc@pipe-d-dp-2.html {name}: This element is suppressed. This means it is ignored when computing the status of the difference (SUCCESS, WARNING, or FAILURE). [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 [fdo#109285]: https://bugs.freedesktop.org/show_bug.cgi?id=109285 [fdo#109295]: https://bugs.freedesktop.org/show_bug.cgi?id=109295 [fdo#111827]: https://bugs.freedesktop.org/show_bug.cgi?id=111827 [i915#1072]: https://gitlab.freedesktop.org/drm/intel/issues/1072 [i915#1982]: https://gitlab.freedesktop.org/drm/intel/issues/1982 [i915#2190]: https://gitlab.freedesktop.org/drm/intel/issues/2190 [i915#2867]: https://gitlab.freedesktop.org/drm/intel/issues/2867 [i915#3012]: https://gitlab.freedesktop.org/drm/intel/issues/3012 [i915#3282]: https://gitlab.freedesktop.org/drm/intel/issues/3282 [i915#3291]: https://gitlab.freedesktop.org/drm/intel/issues/3291 [i915#3301]: https://gitlab.freedesktop.org/drm/intel/issues/3301 [i915#3303]: https://gitlab.freedesktop.org/drm/intel/issues/3303 [i915#3555]: https://gitlab.freedesktop.org/drm/intel/issues/3555 [i915#3708]: https://gitlab.freedesktop.org/drm/intel/issues/3708 [i915#4098]: https://gitlab.freedesktop.org/drm/intel/issues/4098 [i915#4103]: https://gitlab.freedesktop.org/drm/intel/issues/4103 [i915#4312]: https://gitlab.freedesktop.org/drm/intel/issues/4312 [i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613 [i915#4785]: https://gitlab.freedesktop.org/drm/intel/issues/4785 [i915#4983]: https://gitlab.freedesktop.org/drm/intel/issues/4983 [i915#5886]: https://gitlab.freedesktop.org/drm/intel/issues/5886 [i915#5904]: https://gitlab.freedesktop.org/drm/intel/issues/5904 [i915#5982]: https://gitlab.freedesktop.org/drm/intel/issues/5982 [i915#62]: https://gitlab.freedesktop.org/drm/intel/issues/62 [i915#6257]: https://gitlab.freedesktop.org/drm/intel/issues/6257 [i915#6298]: https://gitlab.freedesktop.org/drm/intel/issues/6298 [i915#6380]: https://gitlab.freedesktop.org/drm/intel/issues/6380 [i915#6818]: https://gitlab.freedesktop.org/drm/intel/issues/6818 Build changes ------------- * Linux: CI_DRM_12185 -> Patchwork_109063v1 CI-20190529: 20190529 CI_DRM_12185: ae6a4bb62f9524823ef5b00552e27231f7936da3 @ git://anongit.freedesktop.org/gfx-ci/linux IGT_6663: 5e232c77cd762147e0882c337a984121fabb1c75 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git Patchwork_109063v1: ae6a4bb62f9524823ef5b00552e27231f7936da3 @ git://anongit.freedesktop.org/gfx-ci/linux ### Linux commits 2d0fc80a1536 drm/i915: Remove truncation warning for large objects ce821be700b9 drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large 86c4e6558ba4 drm/i915: Check if the size is too big while creating shmem file 124f64264fe0 drm/i915: Check for integer truncation on the configuration of ttm place 19d3f44b8e7e drm/i915: Check for integer truncation on scatterlist creation e05c4febb634 drm/i915/gem: Typecheck page lookups ad8bb234f6d9 overflow: Introduce overflows_type() and __castable_to_type() 8dd3a4f7d133 overflow: Introduce check_assign() and check_assign_user_ptr() da21faa3a83a overflow: Allow mixed type arguments == Logs == For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_109063v1/index.html [-- Attachment #2: Type: text/html, Size: 13129 bytes --] ^ permalink raw reply [flat|nested] 23+ messages in thread
* [PATCH v11 0/9] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation @ 2022-09-23 8:26 Gwan-gyeong Mun 2022-09-23 11:13 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 0 siblings, 1 reply; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-09-23 8:26 UTC (permalink / raw) To: intel-gfx Cc: linux-kernel, dri-devel, mchehab, chris, matthew.auld, thomas.hellstrom, jani.nikula, nirmoy.das, airlied, daniel, andi.shyti, andrzej.hajda, keescook, mauro.chehab, linux, vitor, dlatypov, ndesaulniers This patch series fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation, etc. We need to check that we avoid integer overflows when looking up a page, and so fix all the instances where we have mistakenly used a plain integer instead of a more suitable long. And there is an impedance mismatch between the scatterlist API using unsigned int and our memory/page accounting in unsigned long. That is we may try to create a scatterlist for a large object that overflows returning a small table into which we try to fit very many pages. As the object size is under the control of userspace, we have to be prudent and catch the conversion errors. To catch the implicit truncation as we switch from unsigned long into the scatterlist's unsigned int, we use improved overflows_type check and report E2BIG prior to the operation. This is already used in our create ioctls to indicate if the uABI request is simply too large for the backing store. And ttm place also has the same problem with scatterlist creation, and we fix the integer truncation problem with the way approached by scatterlist creation. And It corrects the error code to return -E2BIG when creating gem objects using ttm or shmem, if the size is too large in each case. In order to provide a common macro, it moves and adds a few utility macros into overflow/compiler_types header. It introduces assert_same_type() assert_same_typable() macros to catch type mismatch while compiling. The existing typecheck() macro outputs build warnings, but the newly added assert_same_type() macro uses the static_assert macro (which uses _Static_assert keyword and it introduced in C11) to generate a build break when the types are different and can be used to detect explicit build errors. Unlike the assert_same_type() macro, assert_same_typable() macro allows a constant value as the second argument. Since static_assert is used at compile time and it requires constant-expression as an argument [2][3], overflows_type_ret_const_expr() is newly added. the overflows_type() has the same behavior, but the macro uses __builtin_add_overflow() internally, and __builtin_add_overflows returns a bool type [4], so it is difficult to use as an argument of _Static_assert. The assert_same_type and assert_same_typable macros have been added to compiler_types.h, but the overflows_type_ret_const_expr macro has been added to overflow.h So, overflow.h has to be included to use assert_same_typable which internally uses overflows_type_ret_const_expr. And it adds unit tests for overflows_type, overflows_type_ret_const_expr, assert_same_type and assert_same_typable. The overflows_type has been added as well to compare whether the overflows_type_ret_const_expr unit test has the same as the result. And it also introduces check_assign() and check_assign_user_ptr() macros to perform an assigning source value into the destination pointer along with an overflow check. In order to implemente check_assign(), overflows_type() on top of updated check_add_overflow() macro, this series include the patch which came from Kees [1] (this patch is under reviewing from other patch mail). [1] https://lore.kernel.org/all/202208311040.C6CA8253@keescook/ [2] https://en.cppreference.com/w/c/language/_Static_assert [3] C11 standard (ISO/IEC 9899:2011): 6.7.10 Static assertions [4] https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins.html 6.56 Built-in Functions to Perform Arithmetic with Overflow Checking Built-in Function: bool __builtin_add_overflow (type1 a, type2 b, type3 *res) v11: Update macro description (Andi) Change _Static_assert to static_assert (Rasmus) Rename assert_type to assert_same_type and assert_typable to assert_same_typable (Rasmus) Update assert_same_typable macro to handle an overflow check on the target type when a constant value is used. (Kees) Add overflows_type_ret_const_expr which returns constant-expression value (G.G) Add is_unsigned_type (G.G) Add unit tests for overflows_type, overflows_type_ret_const_expr, assert_same_type and assert_same_typable. (Kees) Fix incorrect type assignment between different address spaces caused by the wrong use of __user macro. (kernel test robot) v10: Add check_assign_user_ptr() macro and drop overflows_ptr() macro(Kees) Use assert_typable instead of exactly_pgoff_t() macro (Kees) Remove a redundant type checking for a pointer. (Andrzej) Add patch "compiler_types.h: Add assert_type to catch type mis-match while compiling" and drop patch "util_macros: Add exact_type macro to catch type mis-match while compiling" from patch series (G.G.) (adding of assert_type(t1, t2) and assert_typable(t, n) were suggested by Kees v9's comments) v9: Fix overflows_type() to use __builtin_add_overflow() instead of __builtin_add_overflow_p() (Andrzej) Fix overflows_ptr() to use overflows_type() with the unsigned long type (Andrzej) v8: Add check_assign() and remove safe_conversion() (Kees) Replace safe_conversion() with check_assign() (Kees) Fix overflows_type() to use gcc's built-in overflow function (Andrzej) Add overflows_ptr() to allow overflow checking when assigning a value into a pointer variable (G.G.) v7: Fix to use WARN_ON() macro where GEM_BUG_ON() macro was used. (Jani) v6: Move macro addition location so that it can be used by other than drm subsystem (Jani, Mauro, Andi) Fix to follow general use case for GEM_BUG_ON(). (Jani) v5: Fix an alignment to match open parenthesis Fix macros to be enclosed in parentheses for complex values Fix too long line warning v4: Fix build warnins that reported by kernel test robot. (kernel test robot <lkp@intel.com>) Add kernel-doc markups to the kAPI functions and macros (Mauoro) v3: Modify overflows_type() macro to consider signed data types and add is_type_unsigned() macro (Mauro) Make not use the same macro name on a function. (Mauro) For kernel-doc, macros and functions are handled in the same namespace, the same macro name on a function prevents ever adding documentation for it. Not to change execution inside a macro. (Mauro) Fix the problem that safe_conversion() macro always returns true (G.G) Add safe_conversion_gem_bug_on() macro and remove temporal SAFE_CONVERSION() macro. (G.G.) Chris Wilson (3): drm/i915/gem: Typecheck page lookups drm/i915: Check for integer truncation on scatterlist creation drm/i915: Remove truncation warning for large objects Gwan-gyeong Mun (5): overflow: Move and add few utility macros into overflow compiler_types.h: Add assert_same_type to catch type mis-match while compiling drm/i915: Check for integer truncation on the configuration of ttm place drm/i915: Check if the size is too big while creating shmem file drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large Kees Cook (1): overflow: Allow mixed type arguments drivers/gpu/drm/i915/gem/i915_gem_internal.c | 6 +- drivers/gpu/drm/i915/gem/i915_gem_object.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_object.h | 303 ++++++++++++-- drivers/gpu/drm/i915/gem/i915_gem_pages.c | 27 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 4 + drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 19 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 23 +- drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 5 +- .../drm/i915/gem/selftests/i915_gem_context.c | 12 +- .../drm/i915/gem/selftests/i915_gem_mman.c | 8 +- .../drm/i915/gem/selftests/i915_gem_object.c | 8 +- drivers/gpu/drm/i915/gvt/dmabuf.c | 9 +- drivers/gpu/drm/i915/i915_gem.c | 18 +- drivers/gpu/drm/i915/i915_scatterlist.h | 11 + drivers/gpu/drm/i915/i915_user_extensions.c | 6 +- drivers/gpu/drm/i915/i915_utils.h | 6 +- drivers/gpu/drm/i915/i915_vma.c | 8 +- drivers/gpu/drm/i915/intel_region_ttm.c | 17 +- include/linux/compiler.h | 1 + include/linux/compiler_types.h | 43 ++ include/linux/overflow.h | 165 ++++++-- lib/overflow_kunit.c | 384 ++++++++++++++++-- 22 files changed, 933 insertions(+), 157 deletions(-) -- 2.37.1 ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] ✓ Fi.CI.BAT: success for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation 2022-09-23 8:26 [PATCH v11 0/9] " Gwan-gyeong Mun @ 2022-09-23 11:13 ` Patchwork 0 siblings, 0 replies; 23+ messages in thread From: Patchwork @ 2022-09-23 11:13 UTC (permalink / raw) To: Gwan-gyeong Mun; +Cc: intel-gfx [-- Attachment #1: Type: text/plain, Size: 7507 bytes --] == Series Details == Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation URL : https://patchwork.freedesktop.org/series/108945/ State : success == Summary == CI Bug Log - changes from CI_DRM_12173 -> Patchwork_108945v1 ==================================================== Summary ------- **SUCCESS** No regressions found. External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_108945v1/index.html Participating hosts (43 -> 42) ------------------------------ Additional (1): fi-hsw-4770 Missing (2): fi-bdw-samus fi-pnv-d510 Possible new issues ------------------- Here are the unknown changes that may have been introduced in Patchwork_108945v1: ### IGT changes ### #### Suppressed #### The following results come from untrusted machines, tests, or statuses. They do not affect the overall result. * igt@kms_pipe_crc_basic@suspend-read-crc@pipe-c-dp-2: - {bat-dg2-11}: [PASS][1] -> [FAIL][2] [1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12173/bat-dg2-11/igt@kms_pipe_crc_basic@suspend-read-crc@pipe-c-dp-2.html [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_108945v1/bat-dg2-11/igt@kms_pipe_crc_basic@suspend-read-crc@pipe-c-dp-2.html Known issues ------------ Here are the changes found in Patchwork_108945v1 that come from known issues: ### IGT changes ### #### Issues hit #### * igt@gem_softpin@allocator-basic-reserve: - fi-hsw-4770: NOTRUN -> [SKIP][3] ([fdo#109271]) +9 similar issues [3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_108945v1/fi-hsw-4770/igt@gem_softpin@allocator-basic-reserve.html * igt@i915_pm_backlight@basic-brightness: - fi-hsw-4770: NOTRUN -> [SKIP][4] ([fdo#109271] / [i915#3012]) [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_108945v1/fi-hsw-4770/igt@i915_pm_backlight@basic-brightness.html * igt@i915_selftest@live@gt_engines: - fi-rkl-guc: [PASS][5] -> [INCOMPLETE][6] ([i915#4418]) [5]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12173/fi-rkl-guc/igt@i915_selftest@live@gt_engines.html [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_108945v1/fi-rkl-guc/igt@i915_selftest@live@gt_engines.html * igt@kms_chamelium@dp-crc-fast: - fi-hsw-4770: NOTRUN -> [SKIP][7] ([fdo#109271] / [fdo#111827]) +8 similar issues [7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_108945v1/fi-hsw-4770/igt@kms_chamelium@dp-crc-fast.html * igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions-varying-size: - fi-bsw-kefka: [PASS][8] -> [FAIL][9] ([i915#6298]) [8]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12173/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions-varying-size.html [9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_108945v1/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions-varying-size.html * igt@kms_psr@sprite_plane_onoff: - fi-hsw-4770: NOTRUN -> [SKIP][10] ([fdo#109271] / [i915#1072]) +3 similar issues [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_108945v1/fi-hsw-4770/igt@kms_psr@sprite_plane_onoff.html * igt@runner@aborted: - fi-rkl-guc: NOTRUN -> [FAIL][11] ([i915#4312]) [11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_108945v1/fi-rkl-guc/igt@runner@aborted.html #### Possible fixes #### * igt@gem_exec_suspend@basic-s3@lmem0: - {bat-dg2-11}: [DMESG-WARN][12] ([i915#6816]) -> [PASS][13] [12]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12173/bat-dg2-11/igt@gem_exec_suspend@basic-s3@lmem0.html [13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_108945v1/bat-dg2-11/igt@gem_exec_suspend@basic-s3@lmem0.html * igt@gem_exec_suspend@basic-s3@smem: - {bat-rplp-1}: [DMESG-WARN][14] ([i915#2867]) -> [PASS][15] [14]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12173/bat-rplp-1/igt@gem_exec_suspend@basic-s3@smem.html [15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_108945v1/bat-rplp-1/igt@gem_exec_suspend@basic-s3@smem.html * igt@i915_selftest@live@gt_pm: - {fi-tgl-mst}: [DMESG-FAIL][16] ([i915#3987]) -> [PASS][17] [16]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12173/fi-tgl-mst/igt@i915_selftest@live@gt_pm.html [17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_108945v1/fi-tgl-mst/igt@i915_selftest@live@gt_pm.html * igt@i915_selftest@live@hugepages: - {bat-adln-1}: [DMESG-WARN][18] ([i915#5278]) -> [PASS][19] [18]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12173/bat-adln-1/igt@i915_selftest@live@hugepages.html [19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_108945v1/bat-adln-1/igt@i915_selftest@live@hugepages.html * igt@i915_selftest@live@requests: - {bat-rpls-1}: [INCOMPLETE][20] ([i915#6257] / [i915#6380]) -> [PASS][21] [20]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12173/bat-rpls-1/igt@i915_selftest@live@requests.html [21]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_108945v1/bat-rpls-1/igt@i915_selftest@live@requests.html {name}: This element is suppressed. This means it is ignored when computing the status of the difference (SUCCESS, WARNING, or FAILURE). [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 [fdo#111827]: https://bugs.freedesktop.org/show_bug.cgi?id=111827 [i915#1072]: https://gitlab.freedesktop.org/drm/intel/issues/1072 [i915#2867]: https://gitlab.freedesktop.org/drm/intel/issues/2867 [i915#3012]: https://gitlab.freedesktop.org/drm/intel/issues/3012 [i915#3987]: https://gitlab.freedesktop.org/drm/intel/issues/3987 [i915#4312]: https://gitlab.freedesktop.org/drm/intel/issues/4312 [i915#4418]: https://gitlab.freedesktop.org/drm/intel/issues/4418 [i915#5278]: https://gitlab.freedesktop.org/drm/intel/issues/5278 [i915#6257]: https://gitlab.freedesktop.org/drm/intel/issues/6257 [i915#6298]: https://gitlab.freedesktop.org/drm/intel/issues/6298 [i915#6380]: https://gitlab.freedesktop.org/drm/intel/issues/6380 [i915#6816]: https://gitlab.freedesktop.org/drm/intel/issues/6816 [i915#6818]: https://gitlab.freedesktop.org/drm/intel/issues/6818 Build changes ------------- * Linux: CI_DRM_12173 -> Patchwork_108945v1 CI-20190529: 20190529 CI_DRM_12173: b63a89709735e574aa1d22ec97ae3f9551117fd9 @ git://anongit.freedesktop.org/gfx-ci/linux IGT_6662: dcb1d7a8822e62935f4fe3f2e6a04caaee669369 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git Patchwork_108945v1: b63a89709735e574aa1d22ec97ae3f9551117fd9 @ git://anongit.freedesktop.org/gfx-ci/linux ### Linux commits 6e9d03bddce7 drm/i915: Remove truncation warning for large objects ba2ed99c63b1 drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large b2171683463e drm/i915: Check if the size is too big while creating shmem file 44c322d9a550 drm/i915: Check for integer truncation on the configuration of ttm place ac963e0163e5 drm/i915: Check for integer truncation on scatterlist creation 83bb1e009454 drm/i915/gem: Typecheck page lookups 14a1d55323d2 compiler_types.h: Add assert_same_type to catch type mis-match while compiling 5e8f9aefe867 overflow: Move and add few utility macros into overflow f6c5ddadccee overflow: Allow mixed type arguments == Logs == For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_108945v1/index.html [-- Attachment #2: Type: text/html, Size: 8621 bytes --] ^ permalink raw reply [flat|nested] 23+ messages in thread
* [PATCH v9 0/8] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation @ 2022-08-24 8:45 Gwan-gyeong Mun 2022-08-24 9:36 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 0 siblings, 1 reply; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-08-24 8:45 UTC (permalink / raw) To: intel-gfx Cc: linux-kernel, dri-devel, mchehab, chris, matthew.auld, thomas.hellstrom, jani.nikula, nirmoy.das, airlied, daniel, andi.shyti, andrzej.hajda, keescook, mauro.chehab, intel-gfx-trybot This patch series fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation, etc. We need to check that we avoid integer overflows when looking up a page, and so fix all the instances where we have mistakenly used a plain integer instead of a more suitable long. And there is an impedance mismatch between the scatterlist API using unsigned int and our memory/page accounting in unsigned long. That is we may try to create a scatterlist for a large object that overflows returning a small table into which we try to fit very many pages. As the object size is under the control of userspace, we have to be prudent and catch the conversion errors. To catch the implicit truncation as we switch from unsigned long into the scatterlist's unsigned int, we use improved overflows_type check and report E2BIG prior to the operation. This is already used in our create ioctls to indicate if the uABI request is simply too large for the backing store. And ttm place also has the same problem with scatterlist creation, and we fix the integer truncation problem with the way approached by scatterlist creation. And It corrects the error code to return -E2BIG when creating gem objects using ttm or shmem, if the size is too large in each case. In order to provide a common macro, it moves and adds a few utility macros into overflow/util_macros header v9: Fix overflows_type() to use __builtin_add_overflow() instead of __builtin_add_overflow_p() (Andrzej) Fix overflows_ptr() to use overflows_type() with the unsigned long type (Andrzej) v8: Add check_assign() and remove safe_conversion() (Kees) Replace safe_conversion() with check_assign() (Kees) Fix overflows_type() to use gcc's built-in overflow function (Andrzej) Add overflows_ptr() to allow overflow checking when assigning a value into a pointer variable (G.G.) v7: Fix to use WARN_ON() macro where GEM_BUG_ON() macro was used. (Jani) v6: Move macro addition location so that it can be used by other than drm subsystem (Jani, Mauro, Andi) Fix to follow general use case for GEM_BUG_ON(). (Jani) v5: Fix an alignment to match open parenthesis Fix macros to be enclosed in parentheses for complex values Fix too long line warning v4: Fix build warnins that reported by kernel test robot. (kernel test robot <lkp@intel.com>) Add kernel-doc markups to the kAPI functions and macros (Mauoro) v3: Modify overflows_type() macro to consider signed data types and add is_type_unsigned() macro (Mauro) Make not use the same macro name on a function. (Mauro) For kernel-doc, macros and functions are handled in the same namespace, the same macro name on a function prevents ever adding documentation for it. Not to change execution inside a macro. (Mauro) Fix the problem that safe_conversion() macro always returns true (G.G) Add safe_conversion_gem_bug_on() macro and remove temporal SAFE_CONVERSION() macro. (G.G.) Chris Wilson (3): drm/i915/gem: Typecheck page lookups drm/i915: Check for integer truncation on scatterlist creation drm/i915: Remove truncation warning for large objects Gwan-gyeong Mun (5): overflow: Move and add few utility macros into overflow util_macros: Add exact_type macro to catch type mis-match while compiling drm/i915: Check for integer truncation on the configuration of ttm place drm/i915: Check if the size is too big while creating shmem file drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large drivers/gpu/drm/i915/gem/i915_gem_internal.c | 6 +- drivers/gpu/drm/i915/gem/i915_gem_object.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_object.h | 303 +++++++++++++++--- drivers/gpu/drm/i915/gem/i915_gem_pages.c | 27 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 4 + drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 19 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 23 +- drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 5 +- .../drm/i915/gem/selftests/i915_gem_context.c | 12 +- .../drm/i915/gem/selftests/i915_gem_mman.c | 8 +- .../drm/i915/gem/selftests/i915_gem_object.c | 8 +- drivers/gpu/drm/i915/gvt/dmabuf.c | 9 +- drivers/gpu/drm/i915/i915_gem.c | 18 +- drivers/gpu/drm/i915/i915_scatterlist.h | 11 + drivers/gpu/drm/i915/i915_user_extensions.c | 3 +- drivers/gpu/drm/i915/i915_utils.h | 6 +- drivers/gpu/drm/i915/i915_vma.c | 8 +- drivers/gpu/drm/i915/intel_region_ttm.c | 17 +- include/linux/overflow.h | 62 ++++ include/linux/util_macros.h | 25 ++ 20 files changed, 486 insertions(+), 95 deletions(-) -- 2.37.1 ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] ✓ Fi.CI.BAT: success for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation 2022-08-24 8:45 [PATCH v9 0/8] " Gwan-gyeong Mun @ 2022-08-24 9:36 ` Patchwork 0 siblings, 0 replies; 23+ messages in thread From: Patchwork @ 2022-08-24 9:36 UTC (permalink / raw) To: Gwan-gyeong Mun; +Cc: intel-gfx [-- Attachment #1: Type: text/plain, Size: 6369 bytes --] == Series Details == Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation URL : https://patchwork.freedesktop.org/series/107667/ State : success == Summary == CI Bug Log - changes from CI_DRM_12018 -> Patchwork_107667v1 ==================================================== Summary ------- **SUCCESS** No regressions found. External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107667v1/index.html Participating hosts (38 -> 37) ------------------------------ Missing (1): bat-dg2-8 Possible new issues ------------------- Here are the unknown changes that may have been introduced in Patchwork_107667v1: ### IGT changes ### #### Suppressed #### The following results come from untrusted machines, tests, or statuses. They do not affect the overall result. * igt@i915_pm_rpm@module-reload: - {bat-dg2-10}: NOTRUN -> [INCOMPLETE][1] [1]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107667v1/bat-dg2-10/igt@i915_pm_rpm@module-reload.html Known issues ------------ Here are the changes found in Patchwork_107667v1 that come from known issues: ### IGT changes ### #### Issues hit #### * igt@i915_selftest@live@execlists: - fi-bsw-kefka: [PASS][2] -> [INCOMPLETE][3] ([i915#2940]) [2]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12018/fi-bsw-kefka/igt@i915_selftest@live@execlists.html [3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107667v1/fi-bsw-kefka/igt@i915_selftest@live@execlists.html * igt@i915_suspend@basic-s3-without-i915: - fi-hsw-g3258: NOTRUN -> [INCOMPLETE][4] ([i915#4817] / [i915#6598]) [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107667v1/fi-hsw-g3258/igt@i915_suspend@basic-s3-without-i915.html * igt@runner@aborted: - fi-bsw-kefka: NOTRUN -> [FAIL][5] ([fdo#109271] / [i915#4312]) [5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107667v1/fi-bsw-kefka/igt@runner@aborted.html #### Possible fixes #### * igt@gem_exec_suspend@basic-s3@smem: - {bat-rplp-1}: [DMESG-WARN][6] ([i915#2867]) -> [PASS][7] [6]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12018/bat-rplp-1/igt@gem_exec_suspend@basic-s3@smem.html [7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107667v1/bat-rplp-1/igt@gem_exec_suspend@basic-s3@smem.html * igt@i915_module_load@reload: - {bat-dg2-10}: [DMESG-WARN][8] ([i915#6530]) -> [PASS][9] [8]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12018/bat-dg2-10/igt@i915_module_load@reload.html [9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107667v1/bat-dg2-10/igt@i915_module_load@reload.html * igt@i915_selftest@live@hangcheck: - fi-hsw-g3258: [INCOMPLETE][10] ([i915#3303] / [i915#4785]) -> [PASS][11] [10]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12018/fi-hsw-g3258/igt@i915_selftest@live@hangcheck.html [11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107667v1/fi-hsw-g3258/igt@i915_selftest@live@hangcheck.html * igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions: - fi-bsw-kefka: [FAIL][12] ([i915#6298]) -> [PASS][13] [12]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12018/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions.html [13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107667v1/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions.html #### Warnings #### * igt@i915_suspend@basic-s3-without-i915: - fi-elk-e7500: [INCOMPLETE][14] ([i915#6598] / [i915#6648]) -> [INCOMPLETE][15] ([i915#6598] / [i915#6601] / [i915#6648]) [14]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12018/fi-elk-e7500/igt@i915_suspend@basic-s3-without-i915.html [15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107667v1/fi-elk-e7500/igt@i915_suspend@basic-s3-without-i915.html {name}: This element is suppressed. This means it is ignored when computing the status of the difference (SUCCESS, WARNING, or FAILURE). [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 [i915#2867]: https://gitlab.freedesktop.org/drm/intel/issues/2867 [i915#2940]: https://gitlab.freedesktop.org/drm/intel/issues/2940 [i915#3303]: https://gitlab.freedesktop.org/drm/intel/issues/3303 [i915#4312]: https://gitlab.freedesktop.org/drm/intel/issues/4312 [i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613 [i915#4785]: https://gitlab.freedesktop.org/drm/intel/issues/4785 [i915#4817]: https://gitlab.freedesktop.org/drm/intel/issues/4817 [i915#4983]: https://gitlab.freedesktop.org/drm/intel/issues/4983 [i915#6257]: https://gitlab.freedesktop.org/drm/intel/issues/6257 [i915#6298]: https://gitlab.freedesktop.org/drm/intel/issues/6298 [i915#6380]: https://gitlab.freedesktop.org/drm/intel/issues/6380 [i915#6530]: https://gitlab.freedesktop.org/drm/intel/issues/6530 [i915#6598]: https://gitlab.freedesktop.org/drm/intel/issues/6598 [i915#6601]: https://gitlab.freedesktop.org/drm/intel/issues/6601 [i915#6648]: https://gitlab.freedesktop.org/drm/intel/issues/6648 Build changes ------------- * Linux: CI_DRM_12018 -> Patchwork_107667v1 CI-20190529: 20190529 CI_DRM_12018: b50fa415e25e27958bf55e048d44dad0b2f6a03f @ git://anongit.freedesktop.org/gfx-ci/linux IGT_6634: e01fe99f00692864b709253638c809231d1fb333 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git Patchwork_107667v1: b50fa415e25e27958bf55e048d44dad0b2f6a03f @ git://anongit.freedesktop.org/gfx-ci/linux ### Linux commits 7fbefb3ad312 drm/i915: Remove truncation warning for large objects fe5ef1df92fe drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large 3ab38342d149 drm/i915: Check if the size is too big while creating shmem file d7c2ae49fe26 drm/i915: Check for integer truncation on the configuration of ttm place 7c41c79e1c77 drm/i915: Check for integer truncation on scatterlist creation 3e1e0952b248 drm/i915/gem: Typecheck page lookups 583a25decef2 util_macros: Add exact_type macro to catch type mis-match while compiling cdfdc571bf06 overflow: Move and add few utility macros into overflow == Logs == For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107667v1/index.html [-- Attachment #2: Type: text/html, Size: 7157 bytes --] ^ permalink raw reply [flat|nested] 23+ messages in thread
* [PATCH v8 0/8] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation @ 2022-08-23 10:17 Gwan-gyeong Mun 2022-08-23 12:40 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 0 siblings, 1 reply; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-08-23 10:17 UTC (permalink / raw) To: intel-gfx Cc: thomas.hellstrom, mauro.chehab, andi.shyti, keescook, jani.nikula, linux-kernel, dri-devel, chris, airlied, andrzej.hajda, matthew.auld, intel-gfx-trybot, mchehab, nirmoy.das This patch series fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation, etc. We need to check that we avoid integer overflows when looking up a page, and so fix all the instances where we have mistakenly used a plain integer instead of a more suitable long. And there is an impedance mismatch between the scatterlist API using unsigned int and our memory/page accounting in unsigned long. That is we may try to create a scatterlist for a large object that overflows returning a small table into which we try to fit very many pages. As the object size is under the control of userspace, we have to be prudent and catch the conversion errors. To catch the implicit truncation as we switch from unsigned long into the scatterlist's unsigned int, we use improved overflows_type check and report E2BIG prior to the operation. This is already used in our create ioctls to indicate if the uABI request is simply too large for the backing store. And ttm place also has the same problem with scatterlist creation, and we fix the integer truncation problem with the way approached by scatterlist creation. And It corrects the error code to return -E2BIG when creating gem objects using ttm or shmem, if the size is too large in each case. In order to provide a common macro, it moves and adds a few utility macros into overflow/util_macros header v8: Add check_assign() and remove safe_conversion() (Kees) Replace safe_conversion() with check_assign() (Kees) Fix overflows_type() to use gcc's built-in overflow function (Andrzej) Add overflows_ptr() to allow overflow checking when assigning a value into a pointer variable (G.G.) v7: Fix to use WARN_ON() macro where GEM_BUG_ON() macro was used. (Jani) v6: Move macro addition location so that it can be used by other than drm subsystem (Jani, Mauro, Andi) Fix to follow general use case for GEM_BUG_ON(). (Jani) v5: Fix an alignment to match open parenthesis Fix macros to be enclosed in parentheses for complex values Fix too long line warning v4: Fix build warnins that reported by kernel test robot. (kernel test robot <lkp@intel.com>) Add kernel-doc markups to the kAPI functions and macros (Mauoro) v3: Modify overflows_type() macro to consider signed data types and add is_type_unsigned() macro (Mauro) Make not use the same macro name on a function. (Mauro) For kernel-doc, macros and functions are handled in the same namespace, the same macro name on a function prevents ever adding documentation for it. Not to change execution inside a macro. (Mauro) Fix the problem that safe_conversion() macro always returns true (G.G) Add safe_conversion_gem_bug_on() macro and remove temporal SAFE_CONVERSION() macro. (G.G.) Chris Wilson (3): drm/i915/gem: Typecheck page lookups drm/i915: Check for integer truncation on scatterlist creation drm/i915: Remove truncation warning for large objects Gwan-gyeong Mun (5): overflow: Move and add few utility macros into overflow util_macros: Add exact_type macro to catch type mis-match while compiling drm/i915: Check for integer truncation on the configuration of ttm place drm/i915: Check if the size is too big while creating shmem file drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large drivers/gpu/drm/i915/gem/i915_gem_internal.c | 6 +- drivers/gpu/drm/i915/gem/i915_gem_object.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_object.h | 303 +++++++++++++++--- drivers/gpu/drm/i915/gem/i915_gem_pages.c | 27 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 4 + drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 19 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 23 +- drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 5 +- .../drm/i915/gem/selftests/i915_gem_context.c | 12 +- .../drm/i915/gem/selftests/i915_gem_mman.c | 8 +- .../drm/i915/gem/selftests/i915_gem_object.c | 8 +- drivers/gpu/drm/i915/gvt/dmabuf.c | 9 +- drivers/gpu/drm/i915/i915_gem.c | 18 +- drivers/gpu/drm/i915/i915_scatterlist.h | 11 + drivers/gpu/drm/i915/i915_user_extensions.c | 2 +- drivers/gpu/drm/i915/i915_utils.h | 6 +- drivers/gpu/drm/i915/i915_vma.c | 8 +- drivers/gpu/drm/i915/intel_region_ttm.c | 17 +- include/linux/overflow.h | 67 ++++ include/linux/util_macros.h | 25 ++ 20 files changed, 491 insertions(+), 94 deletions(-) -- 2.37.1 ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] ✓ Fi.CI.BAT: success for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation 2022-08-23 10:17 [PATCH v8 0/8] " Gwan-gyeong Mun @ 2022-08-23 12:40 ` Patchwork 0 siblings, 0 replies; 23+ messages in thread From: Patchwork @ 2022-08-23 12:40 UTC (permalink / raw) To: Gwan-gyeong Mun; +Cc: intel-gfx [-- Attachment #1: Type: text/plain, Size: 15336 bytes --] == Series Details == Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation URL : https://patchwork.freedesktop.org/series/107615/ State : success == Summary == CI Bug Log - changes from CI_DRM_12014 -> Patchwork_107615v1 ==================================================== Summary ------- **SUCCESS** No regressions found. External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/index.html Participating hosts (30 -> 36) ------------------------------ Additional (6): bat-dg1-5 bat-adlp-4 bat-jsl-3 bat-rplp-1 bat-rpls-1 bat-dg2-10 Possible new issues ------------------- Here are the unknown changes that may have been introduced in Patchwork_107615v1: ### IGT changes ### #### Suppressed #### The following results come from untrusted machines, tests, or statuses. They do not affect the overall result. * igt@i915_selftest@live@gt_contexts: - {bat-dg2-10}: NOTRUN -> [DMESG-FAIL][1] [1]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg2-10/igt@i915_selftest@live@gt_contexts.html Known issues ------------ Here are the changes found in Patchwork_107615v1 that come from known issues: ### IGT changes ### #### Issues hit #### * igt@fbdev@info: - bat-adlp-4: NOTRUN -> [SKIP][2] ([i915#2582]) +4 similar issues [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-adlp-4/igt@fbdev@info.html * igt@fbdev@read: - bat-dg1-5: NOTRUN -> [SKIP][3] ([i915#2582]) +4 similar issues [3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@fbdev@read.html * igt@gem_lmem_swapping@verify-random: - bat-adlp-4: NOTRUN -> [SKIP][4] ([i915#4613]) +3 similar issues [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-adlp-4/igt@gem_lmem_swapping@verify-random.html * igt@gem_mmap@basic: - bat-dg1-5: NOTRUN -> [SKIP][5] ([i915#4083]) [5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@gem_mmap@basic.html * igt@gem_tiled_fence_blits@basic: - bat-dg1-5: NOTRUN -> [SKIP][6] ([i915#4077]) +2 similar issues [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@gem_tiled_fence_blits@basic.html * igt@gem_tiled_pread_basic: - bat-dg1-5: NOTRUN -> [SKIP][7] ([i915#4079]) +1 similar issue [7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@gem_tiled_pread_basic.html - bat-adlp-4: NOTRUN -> [SKIP][8] ([i915#3282]) [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-adlp-4/igt@gem_tiled_pread_basic.html * igt@i915_pm_backlight@basic-brightness: - bat-dg1-5: NOTRUN -> [SKIP][9] ([i915#1155]) [9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@i915_pm_backlight@basic-brightness.html - bat-adlp-4: NOTRUN -> [SKIP][10] ([i915#1155]) [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-adlp-4/igt@i915_pm_backlight@basic-brightness.html * igt@i915_pm_rps@basic-api: - bat-dg1-5: NOTRUN -> [SKIP][11] ([i915#6621]) [11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@i915_pm_rps@basic-api.html - bat-adlp-4: NOTRUN -> [SKIP][12] ([i915#6621]) [12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-adlp-4/igt@i915_pm_rps@basic-api.html * igt@i915_selftest@live@hangcheck: - bat-dg1-5: NOTRUN -> [DMESG-FAIL][13] ([i915#4494] / [i915#4957]) [13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@i915_selftest@live@hangcheck.html * igt@i915_suspend@basic-s2idle-without-i915: - bat-dg1-5: NOTRUN -> [INCOMPLETE][14] ([i915#6011]) [14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@i915_suspend@basic-s2idle-without-i915.html * igt@i915_suspend@basic-s3-without-i915: - fi-hsw-4770: NOTRUN -> [INCOMPLETE][15] ([i915#4817] / [i915#6598]) [15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/fi-hsw-4770/igt@i915_suspend@basic-s3-without-i915.html * igt@kms_addfb_basic@basic-x-tiled-legacy: - bat-dg1-5: NOTRUN -> [SKIP][16] ([i915#4212]) +7 similar issues [16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@kms_addfb_basic@basic-x-tiled-legacy.html * igt@kms_addfb_basic@basic-y-tiled-legacy: - bat-dg1-5: NOTRUN -> [SKIP][17] ([i915#4215]) [17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@kms_addfb_basic@basic-y-tiled-legacy.html * igt@kms_busy@basic: - bat-dg1-5: NOTRUN -> [SKIP][18] ([i915#1845] / [i915#4303]) [18]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@kms_busy@basic.html * igt@kms_chamelium@dp-crc-fast: - bat-adlp-4: NOTRUN -> [SKIP][19] ([fdo#111827]) +8 similar issues [19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-adlp-4/igt@kms_chamelium@dp-crc-fast.html * igt@kms_chamelium@hdmi-hpd-fast: - bat-dg1-5: NOTRUN -> [SKIP][20] ([fdo#111827]) +7 similar issues [20]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@kms_chamelium@hdmi-hpd-fast.html * igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions: - fi-bsw-kefka: [PASS][21] -> [FAIL][22] ([i915#6298]) [21]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12014/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions.html [22]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions.html * igt@kms_flip@basic-plain-flip: - bat-adlp-4: NOTRUN -> [SKIP][23] ([i915#3637]) +3 similar issues [23]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-adlp-4/igt@kms_flip@basic-plain-flip.html * igt@kms_force_connector_basic@force-load-detect: - bat-dg1-5: NOTRUN -> [SKIP][24] ([fdo#109285]) [24]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@kms_force_connector_basic@force-load-detect.html * igt@kms_force_connector_basic@prune-stale-modes: - bat-adlp-4: NOTRUN -> [SKIP][25] ([i915#4093]) +3 similar issues [25]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-adlp-4/igt@kms_force_connector_basic@prune-stale-modes.html * igt@kms_frontbuffer_tracking@basic: - bat-adlp-4: NOTRUN -> [SKIP][26] ([i915#4342]) [26]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-adlp-4/igt@kms_frontbuffer_tracking@basic.html * igt@kms_pipe_crc_basic@nonblocking-crc: - bat-dg1-5: NOTRUN -> [SKIP][27] ([i915#4078]) +13 similar issues [27]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@kms_pipe_crc_basic@nonblocking-crc.html * igt@kms_pipe_crc_basic@read-crc: - bat-adlp-4: NOTRUN -> [SKIP][28] ([i915#3546]) +10 similar issues [28]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-adlp-4/igt@kms_pipe_crc_basic@read-crc.html * igt@kms_psr@sprite_plane_onoff: - bat-dg1-5: NOTRUN -> [SKIP][29] ([i915#1072] / [i915#4078]) +3 similar issues [29]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@kms_psr@sprite_plane_onoff.html - bat-adlp-4: NOTRUN -> [SKIP][30] ([i915#1072]) +3 similar issues [30]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-adlp-4/igt@kms_psr@sprite_plane_onoff.html * igt@kms_setmode@basic-clone-single-crtc: - bat-dg1-5: NOTRUN -> [SKIP][31] ([i915#3555]) [31]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@kms_setmode@basic-clone-single-crtc.html - bat-adlp-4: NOTRUN -> [SKIP][32] ([i915#3555] / [i915#4579]) [32]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-adlp-4/igt@kms_setmode@basic-clone-single-crtc.html * igt@prime_vgem@basic-fence-flip: - bat-adlp-4: NOTRUN -> [SKIP][33] ([fdo#109295] / [i915#3546] / [i915#3708]) [33]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-adlp-4/igt@prime_vgem@basic-fence-flip.html - bat-dg1-5: NOTRUN -> [SKIP][34] ([i915#1845] / [i915#3708]) [34]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@prime_vgem@basic-fence-flip.html * igt@prime_vgem@basic-fence-read: - bat-dg1-5: NOTRUN -> [SKIP][35] ([i915#3708]) +2 similar issues [35]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@prime_vgem@basic-fence-read.html * igt@prime_vgem@basic-gtt: - bat-dg1-5: NOTRUN -> [SKIP][36] ([i915#3708] / [i915#4077]) +1 similar issue [36]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@prime_vgem@basic-gtt.html * igt@prime_vgem@basic-userptr: - bat-adlp-4: NOTRUN -> [SKIP][37] ([fdo#109295] / [i915#3301] / [i915#3708]) [37]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-adlp-4/igt@prime_vgem@basic-userptr.html - bat-dg1-5: NOTRUN -> [SKIP][38] ([i915#3708] / [i915#4873]) [38]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@prime_vgem@basic-userptr.html * igt@prime_vgem@basic-write: - bat-adlp-4: NOTRUN -> [SKIP][39] ([fdo#109295] / [i915#3291] / [i915#3708]) +2 similar issues [39]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-adlp-4/igt@prime_vgem@basic-write.html * igt@runner@aborted: - bat-dg1-5: NOTRUN -> [FAIL][40] ([i915#4312] / [i915#5257]) [40]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/bat-dg1-5/igt@runner@aborted.html #### Possible fixes #### * igt@i915_selftest@live@hangcheck: - fi-hsw-4770: [INCOMPLETE][41] ([i915#4785]) -> [PASS][42] [41]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12014/fi-hsw-4770/igt@i915_selftest@live@hangcheck.html [42]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/fi-hsw-4770/igt@i915_selftest@live@hangcheck.html #### Warnings #### * igt@i915_suspend@basic-s3-without-i915: - fi-elk-e7500: [INCOMPLETE][43] ([i915#6648]) -> [INCOMPLETE][44] ([i915#6598] / [i915#6601] / [i915#6648]) [43]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12014/fi-elk-e7500/igt@i915_suspend@basic-s3-without-i915.html [44]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/fi-elk-e7500/igt@i915_suspend@basic-s3-without-i915.html {name}: This element is suppressed. This means it is ignored when computing the status of the difference (SUCCESS, WARNING, or FAILURE). [fdo#109285]: https://bugs.freedesktop.org/show_bug.cgi?id=109285 [fdo#109295]: https://bugs.freedesktop.org/show_bug.cgi?id=109295 [fdo#111827]: https://bugs.freedesktop.org/show_bug.cgi?id=111827 [i915#1072]: https://gitlab.freedesktop.org/drm/intel/issues/1072 [i915#1155]: https://gitlab.freedesktop.org/drm/intel/issues/1155 [i915#1845]: https://gitlab.freedesktop.org/drm/intel/issues/1845 [i915#1849]: https://gitlab.freedesktop.org/drm/intel/issues/1849 [i915#2190]: https://gitlab.freedesktop.org/drm/intel/issues/2190 [i915#2582]: https://gitlab.freedesktop.org/drm/intel/issues/2582 [i915#2867]: https://gitlab.freedesktop.org/drm/intel/issues/2867 [i915#3003]: https://gitlab.freedesktop.org/drm/intel/issues/3003 [i915#3282]: https://gitlab.freedesktop.org/drm/intel/issues/3282 [i915#3291]: https://gitlab.freedesktop.org/drm/intel/issues/3291 [i915#3301]: https://gitlab.freedesktop.org/drm/intel/issues/3301 [i915#3546]: https://gitlab.freedesktop.org/drm/intel/issues/3546 [i915#3555]: https://gitlab.freedesktop.org/drm/intel/issues/3555 [i915#3637]: https://gitlab.freedesktop.org/drm/intel/issues/3637 [i915#3708]: https://gitlab.freedesktop.org/drm/intel/issues/3708 [i915#4077]: https://gitlab.freedesktop.org/drm/intel/issues/4077 [i915#4078]: https://gitlab.freedesktop.org/drm/intel/issues/4078 [i915#4079]: https://gitlab.freedesktop.org/drm/intel/issues/4079 [i915#4083]: https://gitlab.freedesktop.org/drm/intel/issues/4083 [i915#4093]: https://gitlab.freedesktop.org/drm/intel/issues/4093 [i915#4103]: https://gitlab.freedesktop.org/drm/intel/issues/4103 [i915#4212]: https://gitlab.freedesktop.org/drm/intel/issues/4212 [i915#4213]: https://gitlab.freedesktop.org/drm/intel/issues/4213 [i915#4215]: https://gitlab.freedesktop.org/drm/intel/issues/4215 [i915#4303]: https://gitlab.freedesktop.org/drm/intel/issues/4303 [i915#4312]: https://gitlab.freedesktop.org/drm/intel/issues/4312 [i915#4342]: https://gitlab.freedesktop.org/drm/intel/issues/4342 [i915#4494]: https://gitlab.freedesktop.org/drm/intel/issues/4494 [i915#4579]: https://gitlab.freedesktop.org/drm/intel/issues/4579 [i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613 [i915#4785]: https://gitlab.freedesktop.org/drm/intel/issues/4785 [i915#4817]: https://gitlab.freedesktop.org/drm/intel/issues/4817 [i915#4873]: https://gitlab.freedesktop.org/drm/intel/issues/4873 [i915#4957]: https://gitlab.freedesktop.org/drm/intel/issues/4957 [i915#5257]: https://gitlab.freedesktop.org/drm/intel/issues/5257 [i915#5354]: https://gitlab.freedesktop.org/drm/intel/issues/5354 [i915#6011]: https://gitlab.freedesktop.org/drm/intel/issues/6011 [i915#6257]: https://gitlab.freedesktop.org/drm/intel/issues/6257 [i915#6298]: https://gitlab.freedesktop.org/drm/intel/issues/6298 [i915#6380]: https://gitlab.freedesktop.org/drm/intel/issues/6380 [i915#6598]: https://gitlab.freedesktop.org/drm/intel/issues/6598 [i915#6601]: https://gitlab.freedesktop.org/drm/intel/issues/6601 [i915#6621]: https://gitlab.freedesktop.org/drm/intel/issues/6621 [i915#6642]: https://gitlab.freedesktop.org/drm/intel/issues/6642 [i915#6648]: https://gitlab.freedesktop.org/drm/intel/issues/6648 Build changes ------------- * Linux: CI_DRM_12014 -> Patchwork_107615v1 CI-20190529: 20190529 CI_DRM_12014: 1de33826aa86910c175ca773bc8f92d5948d094e @ git://anongit.freedesktop.org/gfx-ci/linux IGT_6634: e01fe99f00692864b709253638c809231d1fb333 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git Patchwork_107615v1: 1de33826aa86910c175ca773bc8f92d5948d094e @ git://anongit.freedesktop.org/gfx-ci/linux ### Linux commits 6021f04c2e2c drm/i915: Remove truncation warning for large objects 7ea6d2149013 drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large 9e40f0391132 drm/i915: Check if the size is too big while creating shmem file 98a0e157a15a drm/i915: Check for integer truncation on the configuration of ttm place 905651841c29 drm/i915: Check for integer truncation on scatterlist creation 3f27acfd4a53 drm/i915/gem: Typecheck page lookups 8cafb0a8412f util_macros: Add exact_type macro to catch type mis-match while compiling 8a08f6e74468 overflow: Move and add few utility macros into overflow == Logs == For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107615v1/index.html [-- Attachment #2: Type: text/html, Size: 17618 bytes --] ^ permalink raw reply [flat|nested] 23+ messages in thread
* [PATCH v7 0/8] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation @ 2022-08-16 9:35 Gwan-gyeong Mun 2022-08-24 19:27 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 0 siblings, 1 reply; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-08-16 9:35 UTC (permalink / raw) To: intel-gfx Cc: thomas.hellstrom, andi.shyti, jani.nikula, linux-kernel, dri-devel, chris, airlied, andrzej.hajda, matthew.auld, mchehab, nirmoy.das This patch series fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation, etc. We need to check that we avoid integer overflows when looking up a page, and so fix all the instances where we have mistakenly used a plain integer instead of a more suitable long. And there is an impedance mismatch between the scatterlist API using unsigned int and our memory/page accounting in unsigned long. That is we may try to create a scatterlist for a large object that overflows returning a small table into which we try to fit very many pages. As the object size is under the control of userspace, we have to be prudent and catch the conversion errors. To catch the implicit truncation as we switch from unsigned long into the scatterlist's unsigned int, we use our overflows_type check and report E2BIG prior to the operation. This is already used in our create ioctls to indicate if the uABI request is simply too large for the backing store. And ttm place also has the same problem with scatterlist creation, and we fix the integer truncation problem with the way approached by scatterlist creation. And It corrects the error code to return -E2BIG when creating gem objects using ttm or shmem, if the size is too large in each case. In order to provide a common macro, it moves and adds a few utility macros into overflow/util_macros header v7: Fix to use WARN_ON() macro where GEM_BUG_ON() macro was used. (Jani) v6: Move macro addition location so that it can be used by other than drm subsystem (Jani, Mauro, Andi) Fix to follow general use case for GEM_BUG_ON(). (Jani) v5: Fix an alignment to match open parenthesis Fix macros to be enclosed in parentheses for complex values Fix too long line warning v4: Fix build warnins that reported by kernel test robot. (kernel test robot <lkp@intel.com>) Add kernel-doc markups to the kAPI functions and macros (Mauoro) v3: Modify overflows_type() macro to consider signed data types and add is_type_unsigned() macro (Mauro) Make not use the same macro name on a function. (Mauro) For kernel-doc, macros and functions are handled in the same namespace, the same macro name on a function prevents ever adding documentation for it. Not to change execution inside a macro. (Mauro) Fix the problem that safe_conversion() macro always returns true (G.G) Add safe_conversion_gem_bug_on() macro and remove temporal SAFE_CONVERSION() macro. (G.G.) Chris Wilson (3): drm/i915/gem: Typecheck page lookups drm/i915: Check for integer truncation on scatterlist creation drm/i915: Remove truncation warning for large objects Gwan-gyeong Mun (5): overflow: Move and add few utility macros into overflow util_macros: Add exact_type macro to catch type mis-match while compiling drm/i915: Check for integer truncation on the configuration of ttm place drm/i915: Check if the size is too big while creating shmem file drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large drivers/gpu/drm/i915/gem/i915_gem_internal.c | 6 +- drivers/gpu/drm/i915/gem/i915_gem_object.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_object.h | 303 +++++++++++++++--- drivers/gpu/drm/i915/gem/i915_gem_pages.c | 27 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 4 + drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 19 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 23 +- drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 5 +- .../drm/i915/gem/selftests/i915_gem_context.c | 12 +- .../drm/i915/gem/selftests/i915_gem_mman.c | 8 +- .../drm/i915/gem/selftests/i915_gem_object.c | 8 +- drivers/gpu/drm/i915/gvt/dmabuf.c | 9 +- drivers/gpu/drm/i915/i915_gem.c | 18 +- drivers/gpu/drm/i915/i915_scatterlist.h | 11 + drivers/gpu/drm/i915/i915_utils.h | 6 +- drivers/gpu/drm/i915/i915_vma.c | 8 +- drivers/gpu/drm/i915/intel_region_ttm.c | 17 +- include/linux/overflow.h | 54 ++++ include/linux/util_macros.h | 25 ++ 19 files changed, 477 insertions(+), 93 deletions(-) -- 2.37.1 ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] ✓ Fi.CI.BAT: success for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation 2022-08-16 9:35 [PATCH v7 0/8] " Gwan-gyeong Mun @ 2022-08-24 19:27 ` Patchwork 0 siblings, 0 replies; 23+ messages in thread From: Patchwork @ 2022-08-24 19:27 UTC (permalink / raw) To: Gwan-gyeong Mun; +Cc: intel-gfx [-- Attachment #1: Type: text/plain, Size: 4898 bytes --] == Series Details == Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation URL : https://patchwork.freedesktop.org/series/107318/ State : success == Summary == CI Bug Log - changes from CI_DRM_12021 -> Patchwork_107318v1 ==================================================== Summary ------- **SUCCESS** No regressions found. External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107318v1/index.html Participating hosts (37 -> 34) ------------------------------ Additional (1): fi-kbl-soraka Missing (4): bat-dg2-8 bat-dg2-10 fi-rkl-11600 bat-jsl-3 Known issues ------------ Here are the changes found in Patchwork_107318v1 that come from known issues: ### IGT changes ### #### Issues hit #### * igt@i915_selftest@live@hangcheck: - bat-dg1-6: [PASS][1] -> [DMESG-FAIL][2] ([i915#4494] / [i915#4957]) [1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12021/bat-dg1-6/igt@i915_selftest@live@hangcheck.html [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107318v1/bat-dg1-6/igt@i915_selftest@live@hangcheck.html * igt@runner@aborted: - fi-hsw-4770: NOTRUN -> [FAIL][3] ([fdo#109271] / [i915#4312] / [i915#5594] / [i915#6246]) [3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107318v1/fi-hsw-4770/igt@runner@aborted.html - fi-kbl-soraka: NOTRUN -> [FAIL][4] ([i915#6219]) [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107318v1/fi-kbl-soraka/igt@runner@aborted.html #### Possible fixes #### * igt@gem_exec_suspend@basic-s3@smem: - {bat-rplp-1}: [DMESG-WARN][5] ([i915#2867]) -> [PASS][6] [5]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12021/bat-rplp-1/igt@gem_exec_suspend@basic-s3@smem.html [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107318v1/bat-rplp-1/igt@gem_exec_suspend@basic-s3@smem.html * igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions: - fi-bsw-kefka: [FAIL][7] -> [PASS][8] [7]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12021/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions.html [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107318v1/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions.html #### Warnings #### * igt@i915_suspend@basic-s3-without-i915: - fi-hsw-g3258: [INCOMPLETE][9] ([i915#4817] / [i915#6598]) -> [INCOMPLETE][10] ([i915#6598]) [9]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12021/fi-hsw-g3258/igt@i915_suspend@basic-s3-without-i915.html [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107318v1/fi-hsw-g3258/igt@i915_suspend@basic-s3-without-i915.html {name}: This element is suppressed. This means it is ignored when computing the status of the difference (SUCCESS, WARNING, or FAILURE). [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 [i915#2867]: https://gitlab.freedesktop.org/drm/intel/issues/2867 [i915#4312]: https://gitlab.freedesktop.org/drm/intel/issues/4312 [i915#4494]: https://gitlab.freedesktop.org/drm/intel/issues/4494 [i915#4817]: https://gitlab.freedesktop.org/drm/intel/issues/4817 [i915#4957]: https://gitlab.freedesktop.org/drm/intel/issues/4957 [i915#5594]: https://gitlab.freedesktop.org/drm/intel/issues/5594 [i915#6219]: https://gitlab.freedesktop.org/drm/intel/issues/6219 [i915#6246]: https://gitlab.freedesktop.org/drm/intel/issues/6246 [i915#6257]: https://gitlab.freedesktop.org/drm/intel/issues/6257 [i915#6380]: https://gitlab.freedesktop.org/drm/intel/issues/6380 [i915#6598]: https://gitlab.freedesktop.org/drm/intel/issues/6598 Build changes ------------- * Linux: CI_DRM_12021 -> Patchwork_107318v1 CI-20190529: 20190529 CI_DRM_12021: 078959b4819e4e0ab8cf2965e7bfd98278c0b35d @ git://anongit.freedesktop.org/gfx-ci/linux IGT_6636: 1298b5f0e1b3e010657ffba41d2e775fab028e08 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git Patchwork_107318v1: 078959b4819e4e0ab8cf2965e7bfd98278c0b35d @ git://anongit.freedesktop.org/gfx-ci/linux ### Linux commits daa36a5708a4 drm/i915: Remove truncation warning for large objects ea5b72557899 drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large be7935ba9db6 drm/i915: Check if the size is too big while creating shmem file c59302b9e88f drm/i915: Check for integer truncation on the configuration of ttm place 900599b671ec drm/i915: Check for integer truncation on scatterlist creation f638dc9a27cd drm/i915/gem: Typecheck page lookups a9e09d773594 util_macros: Add exact_type macro to catch type mis-match while compiling a766d32c3c88 overflow: Move and add few utility macros into overflow == Logs == For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107318v1/index.html [-- Attachment #2: Type: text/html, Size: 5614 bytes --] ^ permalink raw reply [flat|nested] 23+ messages in thread
* [PATCH v6 0/8] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation @ 2022-08-13 1:08 Gwan-gyeong Mun 2022-08-24 18:23 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 0 siblings, 1 reply; 23+ messages in thread From: Gwan-gyeong Mun @ 2022-08-13 1:08 UTC (permalink / raw) To: intel-gfx Cc: linux-kernel, dri-devel, mchehab, chris, matthew.auld, thomas.hellstrom, jani.nikula, nirmoy.das, airlied, daniel, andi.shyti, andrzej.hajda This patch series fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation, etc. We need to check that we avoid integer overflows when looking up a page, and so fix all the instances where we have mistakenly used a plain integer instead of a more suitable long. And there is an impedance mismatch between the scatterlist API using unsigned int and our memory/page accounting in unsigned long. That is we may try to create a scatterlist for a large object that overflows returning a small table into which we try to fit very many pages. As the object size is under the control of userspace, we have to be prudent and catch the conversion errors. To catch the implicit truncation as we switch from unsigned long into the scatterlist's unsigned int, we use our overflows_type check and report E2BIG prior to the operation. This is already used in our create ioctls to indicate if the uABI request is simply too large for the backing store. And ttm place also has the same problem with scatterlist creation, and we fix the integer truncation problem with the way approached by scatterlist creation. And It corrects the error code to return -E2BIG when creating gem objects using ttm or shmem, if the size is too large in each case. In order to provide a common macro, it moves and adds a few utility macros into overflow/util_macros header v6: Move macro addition location so that it can be used by other than drm subsystem (Jani, Mauro, Andi) Fix to follow general use case for GEM_BUG_ON(). (Jani) v5: Fix an alignment to match open parenthesis Fix macros to be enclosed in parentheses for complex values Fix too long line warning v4: Fix build warnins that reported by kernel test robot. (kernel test robot <lkp@intel.com>) Add kernel-doc markups to the kAPI functions and macros (Mauoro) v3: Modify overflows_type() macro to consider signed data types and add is_type_unsigned() macro (Mauro) Make not use the same macro name on a function. (Mauro) For kernel-doc, macros and functions are handled in the same namespace, the same macro name on a function prevents ever adding documentation for it. Not to change execution inside a macro. (Mauro) Fix the problem that safe_conversion() macro always returns true (G.G) Add safe_conversion_gem_bug_on() macro and remove temporal SAFE_CONVERSION() macro. (G.G.) Chris Wilson (3): drm/i915/gem: Typecheck page lookups drm/i915: Check for integer truncation on scatterlist creation drm/i915: Remove truncation warning for large objects Gwan-gyeong Mun (5): overflow: Move and add few utility macros into overflow util_macros: Add exact_type macro to catch type mis-match while compiling drm/i915: Check for integer truncation on the configuration of ttm place drm/i915: Check if the size is too big while creating shmem file drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large drivers/gpu/drm/i915/gem/i915_gem_internal.c | 6 +- drivers/gpu/drm/i915/gem/i915_gem_object.c | 7 +- drivers/gpu/drm/i915/gem/i915_gem_object.h | 303 +++++++++++++++--- drivers/gpu/drm/i915/gem/i915_gem_pages.c | 27 +- drivers/gpu/drm/i915/gem/i915_gem_phys.c | 4 + drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 19 +- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 23 +- drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 5 +- .../drm/i915/gem/selftests/i915_gem_context.c | 12 +- .../drm/i915/gem/selftests/i915_gem_mman.c | 8 +- .../drm/i915/gem/selftests/i915_gem_object.c | 8 +- drivers/gpu/drm/i915/gvt/dmabuf.c | 9 +- drivers/gpu/drm/i915/i915_gem.c | 18 +- drivers/gpu/drm/i915/i915_scatterlist.h | 11 + drivers/gpu/drm/i915/i915_utils.h | 6 +- drivers/gpu/drm/i915/i915_vma.c | 8 +- drivers/gpu/drm/i915/intel_region_ttm.c | 22 +- include/linux/overflow.h | 54 ++++ include/linux/util_macros.h | 25 ++ 19 files changed, 482 insertions(+), 93 deletions(-) -- 2.34.1 ^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] ✓ Fi.CI.BAT: success for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation 2022-08-13 1:08 [PATCH v6 0/8] " Gwan-gyeong Mun @ 2022-08-24 18:23 ` Patchwork 0 siblings, 0 replies; 23+ messages in thread From: Patchwork @ 2022-08-24 18:23 UTC (permalink / raw) To: Gwan-gyeong Mun; +Cc: intel-gfx [-- Attachment #1: Type: text/plain, Size: 5725 bytes --] == Series Details == Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation URL : https://patchwork.freedesktop.org/series/107231/ State : success == Summary == CI Bug Log - changes from CI_DRM_12021 -> Patchwork_107231v1 ==================================================== Summary ------- **SUCCESS** No regressions found. External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107231v1/index.html Participating hosts (37 -> 38) ------------------------------ Additional (1): fi-kbl-soraka Known issues ------------ Here are the changes found in Patchwork_107231v1 that come from known issues: ### IGT changes ### #### Issues hit #### * igt@i915_selftest@live@gt_engines: - bat-dg1-5: [PASS][1] -> [INCOMPLETE][2] ([i915#4418]) [1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12021/bat-dg1-5/igt@i915_selftest@live@gt_engines.html [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107231v1/bat-dg1-5/igt@i915_selftest@live@gt_engines.html * igt@i915_selftest@live@hangcheck: - bat-dg1-6: [PASS][3] -> [DMESG-FAIL][4] ([i915#4494] / [i915#4957]) [3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12021/bat-dg1-6/igt@i915_selftest@live@hangcheck.html [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107231v1/bat-dg1-6/igt@i915_selftest@live@hangcheck.html * igt@runner@aborted: - fi-hsw-4770: NOTRUN -> [FAIL][5] ([fdo#109271] / [i915#4312] / [i915#5594] / [i915#6246]) [5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107231v1/fi-hsw-4770/igt@runner@aborted.html - fi-kbl-soraka: NOTRUN -> [FAIL][6] ([i915#6219]) [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107231v1/fi-kbl-soraka/igt@runner@aborted.html #### Possible fixes #### * igt@gem_exec_suspend@basic-s3@smem: - {bat-rplp-1}: [DMESG-WARN][7] ([i915#2867]) -> [PASS][8] [7]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12021/bat-rplp-1/igt@gem_exec_suspend@basic-s3@smem.html [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107231v1/bat-rplp-1/igt@gem_exec_suspend@basic-s3@smem.html * igt@i915_pm_rpm@module-reload: - {bat-dg2-10}: [INCOMPLETE][9] -> [PASS][10] [9]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12021/bat-dg2-10/igt@i915_pm_rpm@module-reload.html [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107231v1/bat-dg2-10/igt@i915_pm_rpm@module-reload.html * igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions: - fi-bsw-kefka: [FAIL][11] -> [PASS][12] [11]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12021/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions.html [12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107231v1/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions.html #### Warnings #### * igt@i915_suspend@basic-s3-without-i915: - fi-elk-e7500: [INCOMPLETE][13] ([i915#6598] / [i915#6601] / [i915#6648]) -> [INCOMPLETE][14] ([i915#6598] / [i915#6648]) [13]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12021/fi-elk-e7500/igt@i915_suspend@basic-s3-without-i915.html [14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107231v1/fi-elk-e7500/igt@i915_suspend@basic-s3-without-i915.html {name}: This element is suppressed. This means it is ignored when computing the status of the difference (SUCCESS, WARNING, or FAILURE). [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 [i915#2867]: https://gitlab.freedesktop.org/drm/intel/issues/2867 [i915#4312]: https://gitlab.freedesktop.org/drm/intel/issues/4312 [i915#4418]: https://gitlab.freedesktop.org/drm/intel/issues/4418 [i915#4494]: https://gitlab.freedesktop.org/drm/intel/issues/4494 [i915#4957]: https://gitlab.freedesktop.org/drm/intel/issues/4957 [i915#5594]: https://gitlab.freedesktop.org/drm/intel/issues/5594 [i915#6219]: https://gitlab.freedesktop.org/drm/intel/issues/6219 [i915#6246]: https://gitlab.freedesktop.org/drm/intel/issues/6246 [i915#6257]: https://gitlab.freedesktop.org/drm/intel/issues/6257 [i915#6380]: https://gitlab.freedesktop.org/drm/intel/issues/6380 [i915#6598]: https://gitlab.freedesktop.org/drm/intel/issues/6598 [i915#6601]: https://gitlab.freedesktop.org/drm/intel/issues/6601 [i915#6642]: https://gitlab.freedesktop.org/drm/intel/issues/6642 [i915#6648]: https://gitlab.freedesktop.org/drm/intel/issues/6648 Build changes ------------- * Linux: CI_DRM_12021 -> Patchwork_107231v1 CI-20190529: 20190529 CI_DRM_12021: 078959b4819e4e0ab8cf2965e7bfd98278c0b35d @ git://anongit.freedesktop.org/gfx-ci/linux IGT_6636: 1298b5f0e1b3e010657ffba41d2e775fab028e08 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git Patchwork_107231v1: 078959b4819e4e0ab8cf2965e7bfd98278c0b35d @ git://anongit.freedesktop.org/gfx-ci/linux ### Linux commits cc7a5389a8a8 drm/i915: Remove truncation warning for large objects 1990fb8f917f drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large 755ed2170d64 drm/i915: Check if the size is too big while creating shmem file 0f7af4d3decb drm/i915: Check for integer truncation on the configuration of ttm place 2f954aa60424 drm/i915: Check for integer truncation on scatterlist creation baee40aab437 drm/i915/gem: Typecheck page lookups 418efba273b5 util_macros: Add exact_type macro to catch type mis-match while compiling 72e7eb0cb571 overflow: Move and add few utility macros into overflow == Logs == For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_107231v1/index.html [-- Attachment #2: Type: text/html, Size: 6482 bytes --] ^ permalink raw reply [flat|nested] 23+ messages in thread
end of thread, other threads:[~2022-12-30 9:31 UTC | newest] Thread overview: 23+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2022-12-28 19:22 [Intel-gfx] [PATCH v16 0/6] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 1/6] drm/i915/gem: Typecheck page lookups Gwan-gyeong Mun 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 2/6] drm/i915: Check for integer truncation on scatterlist creation Gwan-gyeong Mun 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 3/6] drm/i915: Check for integer truncation on the configuration of ttm place Gwan-gyeong Mun 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 4/6] drm/i915: Check if the size is too big while creating shmem file Gwan-gyeong Mun 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 5/6] drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large Gwan-gyeong Mun 2022-12-28 19:22 ` [Intel-gfx] [PATCH v16 6/6] drm/i915: Remove truncation warning for large objects Gwan-gyeong Mun 2022-12-28 19:51 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Patchwork 2022-12-29 8:35 ` Gwan-gyeong Mun 2022-12-28 19:51 ` [Intel-gfx] ✗ Fi.CI.SPARSE: " Patchwork 2022-12-28 20:19 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork 2022-12-28 21:35 ` [Intel-gfx] ✓ Fi.CI.IGT: " Patchwork 2022-12-30 9:31 ` [Intel-gfx] [PATCH v16 0/6] " Rodrigo Vivi -- strict thread matches above, loose matches on Subject: below -- 2022-12-28 14:25 [Intel-gfx] [PATCH v15 " Gwan-gyeong Mun 2022-12-28 15:03 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 2022-12-15 12:52 [Intel-gfx] [PATCH v15 0/7] " Gwan-gyeong Mun 2022-12-15 15:20 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 2022-11-02 14:53 [Intel-gfx] [PATCH v14 0/7] " Gwan-gyeong Mun 2022-11-02 16:43 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 2022-09-28 8:12 [PATCH v13 0/9] " Gwan-gyeong Mun 2022-09-28 14:59 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 2022-09-26 15:39 [PATCH v12 0/9] " Gwan-gyeong Mun 2022-09-26 22:53 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 2022-09-23 8:26 [PATCH v11 0/9] " Gwan-gyeong Mun 2022-09-23 11:13 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 2022-08-24 8:45 [PATCH v9 0/8] " Gwan-gyeong Mun 2022-08-24 9:36 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 2022-08-23 10:17 [PATCH v8 0/8] " Gwan-gyeong Mun 2022-08-23 12:40 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 2022-08-16 9:35 [PATCH v7 0/8] " Gwan-gyeong Mun 2022-08-24 19:27 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork 2022-08-13 1:08 [PATCH v6 0/8] " Gwan-gyeong Mun 2022-08-24 18:23 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.