* [PATCH] drm/i915: Fix use after free in logical_render_ring_init
@ 2016-12-16 13:18 Tvrtko Ursulin
2016-12-16 13:24 ` Chris Wilson
2016-12-16 13:53 ` ✓ Fi.CI.BAT: success for " Patchwork
0 siblings, 2 replies; 4+ messages in thread
From: Tvrtko Ursulin @ 2016-12-16 13:18 UTC (permalink / raw)
To: Intel-gfx; +Cc: Daniel Vetter
From: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Commit 3b3f1650b1ca ("drm/i915: Allocate intel_engine_cs
structure only for the enabled engines") introduced the
dynanically allocated engine instances and created an
potential use after free scenario in logical_render_ring_init
where lrc_destroy_wa_ctx_obj could be called after the engine
instance has been freed.
This can only happen during engine setup/init error handling
which luckily does not happen ever in practice.
Fix is to not call lrc_destroy_wa_ctx_obj since it would have
already been executed from the preceding engine cleanup.
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 3b3f1650b1ca ("drm/i915: Allocate intel_engine_cs structure only for the enabled engines")
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Daniel Vetter <daniel.vetter@intel.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
---
drivers/gpu/drm/i915/intel_lrc.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 8b412880e88c..877adedbf833 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -1965,12 +1965,7 @@ int logical_render_ring_init(struct intel_engine_cs *engine)
ret);
}
- ret = logical_ring_init(engine);
- if (ret) {
- lrc_destroy_wa_ctx_obj(engine);
- }
-
- return ret;
+ return logical_ring_init(engine);
}
int logical_xcs_ring_init(struct intel_engine_cs *engine)
--
2.7.4
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] drm/i915: Fix use after free in logical_render_ring_init
2016-12-16 13:18 [PATCH] drm/i915: Fix use after free in logical_render_ring_init Tvrtko Ursulin
@ 2016-12-16 13:24 ` Chris Wilson
2016-12-16 13:53 ` ✓ Fi.CI.BAT: success for " Patchwork
1 sibling, 0 replies; 4+ messages in thread
From: Chris Wilson @ 2016-12-16 13:24 UTC (permalink / raw)
To: Tvrtko Ursulin; +Cc: Daniel Vetter, Intel-gfx
On Fri, Dec 16, 2016 at 01:18:42PM +0000, Tvrtko Ursulin wrote:
> From: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
>
> Commit 3b3f1650b1ca ("drm/i915: Allocate intel_engine_cs
> structure only for the enabled engines") introduced the
> dynanically allocated engine instances and created an
> potential use after free scenario in logical_render_ring_init
> where lrc_destroy_wa_ctx_obj could be called after the engine
> instance has been freed.
>
> This can only happen during engine setup/init error handling
> which luckily does not happen ever in practice.
>
> Fix is to not call lrc_destroy_wa_ctx_obj since it would have
> already been executed from the preceding engine cleanup.
>
> Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Fixes: 3b3f1650b1ca ("drm/i915: Allocate intel_engine_cs structure only for the enabled engines")
> Cc: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
> Cc: Daniel Vetter <daniel.vetter@intel.com>
> Cc: Jani Nikula <jani.nikula@linux.intel.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
-Chris
--
Chris Wilson, Intel Open Source Technology Centre
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 4+ messages in thread
* ✓ Fi.CI.BAT: success for drm/i915: Fix use after free in logical_render_ring_init
2016-12-16 13:18 [PATCH] drm/i915: Fix use after free in logical_render_ring_init Tvrtko Ursulin
2016-12-16 13:24 ` Chris Wilson
@ 2016-12-16 13:53 ` Patchwork
2016-12-16 14:32 ` Tvrtko Ursulin
1 sibling, 1 reply; 4+ messages in thread
From: Patchwork @ 2016-12-16 13:53 UTC (permalink / raw)
To: Tvrtko Ursulin; +Cc: intel-gfx
== Series Details ==
Series: drm/i915: Fix use after free in logical_render_ring_init
URL : https://patchwork.freedesktop.org/series/16918/
State : success
== Summary ==
Series 16918v1 drm/i915: Fix use after free in logical_render_ring_init
https://patchwork.freedesktop.org/api/1.0/series/16918/revisions/1/mbox/
Test gem_busy:
Subgroup basic-hang-default:
fail -> PASS (fi-hsw-4770r)
fi-bdw-5557u total:247 pass:233 dwarn:0 dfail:0 fail:0 skip:14
fi-bsw-n3050 total:247 pass:208 dwarn:0 dfail:0 fail:0 skip:39
fi-bxt-j4205 total:247 pass:222 dwarn:0 dfail:0 fail:0 skip:25
fi-bxt-t5700 total:247 pass:220 dwarn:0 dfail:0 fail:0 skip:27
fi-byt-j1900 total:247 pass:220 dwarn:0 dfail:0 fail:0 skip:27
fi-byt-n2820 total:247 pass:216 dwarn:0 dfail:0 fail:0 skip:31
fi-hsw-4770 total:247 pass:228 dwarn:0 dfail:0 fail:0 skip:19
fi-hsw-4770r total:247 pass:228 dwarn:0 dfail:0 fail:0 skip:19
fi-ilk-650 total:247 pass:195 dwarn:0 dfail:0 fail:0 skip:52
fi-ivb-3520m total:247 pass:226 dwarn:0 dfail:0 fail:0 skip:21
fi-ivb-3770 total:247 pass:226 dwarn:0 dfail:0 fail:0 skip:21
fi-kbl-7500u total:247 pass:226 dwarn:0 dfail:0 fail:0 skip:21
fi-skl-6260u total:247 pass:234 dwarn:0 dfail:0 fail:0 skip:13
fi-skl-6700hq total:247 pass:227 dwarn:0 dfail:0 fail:0 skip:20
fi-skl-6700k total:247 pass:224 dwarn:3 dfail:0 fail:0 skip:20
fi-skl-6770hq total:247 pass:234 dwarn:0 dfail:0 fail:0 skip:13
fi-snb-2520m total:247 pass:216 dwarn:0 dfail:0 fail:0 skip:31
fi-snb-2600 total:247 pass:215 dwarn:0 dfail:0 fail:0 skip:32
e5dd5ad8937cd82ea07bde765bde5b4c09d81dcb drm-tip: 2016y-12m-16d-09h-25m-11s UTC integration manifest
899a8cc4 drm/i915: Fix use after free in logical_render_ring_init
== Logs ==
For more details see: https://intel-gfx-ci.01.org/CI/Patchwork_3308/
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: ✓ Fi.CI.BAT: success for drm/i915: Fix use after free in logical_render_ring_init
2016-12-16 13:53 ` ✓ Fi.CI.BAT: success for " Patchwork
@ 2016-12-16 14:32 ` Tvrtko Ursulin
0 siblings, 0 replies; 4+ messages in thread
From: Tvrtko Ursulin @ 2016-12-16 14:32 UTC (permalink / raw)
To: intel-gfx, Tvrtko Ursulin
On 16/12/2016 13:53, Patchwork wrote:
> == Series Details ==
>
> Series: drm/i915: Fix use after free in logical_render_ring_init
> URL : https://patchwork.freedesktop.org/series/16918/
> State : success
>
> == Summary ==
>
> Series 16918v1 drm/i915: Fix use after free in logical_render_ring_init
> https://patchwork.freedesktop.org/api/1.0/series/16918/revisions/1/mbox/
>
> Test gem_busy:
> Subgroup basic-hang-default:
> fail -> PASS (fi-hsw-4770r)
>
> fi-bdw-5557u total:247 pass:233 dwarn:0 dfail:0 fail:0 skip:14
> fi-bsw-n3050 total:247 pass:208 dwarn:0 dfail:0 fail:0 skip:39
> fi-bxt-j4205 total:247 pass:222 dwarn:0 dfail:0 fail:0 skip:25
> fi-bxt-t5700 total:247 pass:220 dwarn:0 dfail:0 fail:0 skip:27
> fi-byt-j1900 total:247 pass:220 dwarn:0 dfail:0 fail:0 skip:27
> fi-byt-n2820 total:247 pass:216 dwarn:0 dfail:0 fail:0 skip:31
> fi-hsw-4770 total:247 pass:228 dwarn:0 dfail:0 fail:0 skip:19
> fi-hsw-4770r total:247 pass:228 dwarn:0 dfail:0 fail:0 skip:19
> fi-ilk-650 total:247 pass:195 dwarn:0 dfail:0 fail:0 skip:52
> fi-ivb-3520m total:247 pass:226 dwarn:0 dfail:0 fail:0 skip:21
> fi-ivb-3770 total:247 pass:226 dwarn:0 dfail:0 fail:0 skip:21
> fi-kbl-7500u total:247 pass:226 dwarn:0 dfail:0 fail:0 skip:21
> fi-skl-6260u total:247 pass:234 dwarn:0 dfail:0 fail:0 skip:13
> fi-skl-6700hq total:247 pass:227 dwarn:0 dfail:0 fail:0 skip:20
> fi-skl-6700k total:247 pass:224 dwarn:3 dfail:0 fail:0 skip:20
> fi-skl-6770hq total:247 pass:234 dwarn:0 dfail:0 fail:0 skip:13
> fi-snb-2520m total:247 pass:216 dwarn:0 dfail:0 fail:0 skip:31
> fi-snb-2600 total:247 pass:215 dwarn:0 dfail:0 fail:0 skip:32
>
> e5dd5ad8937cd82ea07bde765bde5b4c09d81dcb drm-tip: 2016y-12m-16d-09h-25m-11s UTC integration manifest
> 899a8cc4 drm/i915: Fix use after free in logical_render_ring_init
Pushed, thanks for the review.
Regards,
Tvrtko
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-12-16 14:32 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-12-16 13:18 [PATCH] drm/i915: Fix use after free in logical_render_ring_init Tvrtko Ursulin
2016-12-16 13:24 ` Chris Wilson
2016-12-16 13:53 ` ✓ Fi.CI.BAT: success for " Patchwork
2016-12-16 14:32 ` Tvrtko Ursulin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.