[PATCH] drm/i915: Don't deref request->ctx inside unlocked print_request()

[PATCH] drm/i915: Don't deref request->ctx inside unlocked print_request()

[Chris Wilson]

Although we protect the request itself, we don't lock inside
intel_engine_dump() and so the request maybe retired as we peek into it.
One consequence is that the request->ctx may be freed before we
dereference it, leading to a use-after-free. Replace the hw_id we are
peeking from inside request->ctx with the request->fence.context, with
which we can still track from which context the request originated
(although to tie to HW reports requires a little more legwork, but is
good enough to follow the GEM traces).

[52640.729670] general protection fault: 0000 [#2] SMP
[52640.729694] Dumping ftrace buffer:
[52640.729701]    (ftrace buffer empty)
[52640.729705] Modules linked in: vgem snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic x86_pkg_\
temp_thermal intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul snd_hda_intel snd_hda_codec snd_hwdep gha\
sh_clmulni_intel snd_hda_core snd_pcm mei_me mei i915 r8169 mii prime_numbers i2c_hid
[52640.729748] CPU: 2 PID: 4335 Comm: gem_exec_schedu Tainted: G     UD W        4.16.0-rc3+ #7
[52640.729759] Hardware name: Acer Aspire E5-575G/Ironman_SK  , BIOS V1.12 08/02/2016
[52640.729803] RIP: 0010:print_request+0x2b/0xb0 [i915]
[52640.729811] RSP: 0018:ffffc90001453c18 EFLAGS: 00010206
[52640.729820] RAX: 6b6b6b6b6b6b6b6b RBX: ffff8801e0292d40 RCX: 0000000000000006
[52640.729829] RDX: ffffc90001453c60 RSI: ffff8801e0292d40 RDI: 0000000000000003
[52640.729838] RBP: ffffc90001453d80 R08: 0000000000000000 R09: 0000000000000001
[52640.729847] R10: ffffc90001453bd0 R11: ffffc90001453c73 R12: ffffc90001453c60
[52640.729856] R13: ffffc90001453d80 R14: ffff8801d5a683c8 R15: ffff8801e0292d40
[52640.729866] FS:  00007f1ee50548c0(0000) GS:ffff8801e8200000(0000) knlGS:0000000000000000
[52640.729876] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[52640.729884] CR2: 00007f1ee5077000 CR3: 00000001d9411004 CR4: 00000000003606e0
[52640.729893] Call Trace:
[52640.729922]  intel_engine_print_registers+0x623/0x890 [i915]
[52640.729948]  intel_engine_dump+0x4a3/0x590 [i915]
[52640.729957]  ? seq_printf+0x3a/0x50
[52640.729977]  i915_engine_info+0xb8/0xe0 [i915]
[52640.729984]  ? drm_mode_gamma_get_ioctl+0xf0/0xf0
[52640.729990]  seq_read+0xd5/0x410
[52640.729997]  full_proxy_read+0x4b/0x70
[52640.730004]  __vfs_read+0x1e/0x120
[52640.730009]  ? do_sys_open+0x134/0x220
[52640.730015]  ? kmem_cache_free+0x174/0x2b0
[52640.730021]  vfs_read+0xa1/0x150
[52640.730026]  SyS_read+0x40/0xa0
[52640.730032]  do_syscall_64+0x65/0x1a0
[52640.730038]  entry_SYSCALL_64_after_hwframe+0x42/0xb7

Reported-by: Mika Kuoppala <mika.kuoppala@intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala@intel.com>
---
 drivers/gpu/drm/i915/intel_engine_cs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c
index ce7fcf55ba18..3e1107ecb6ee 100644
--- a/drivers/gpu/drm/i915/intel_engine_cs.c
+++ b/drivers/gpu/drm/i915/intel_engine_cs.c
@@ -1668,10 +1668,10 @@ static void print_request(struct drm_printer *m,
 			  struct i915_request *rq,
 			  const char *prefix)
 {
-	drm_printf(m, "%s%x%s [%x:%x] prio=%d @ %dms: %s\n", prefix,
+	drm_printf(m, "%s%x%s [%llx:%x] prio=%d @ %dms: %s\n", prefix,
 		   rq->global_seqno,
 		   i915_request_completed(rq) ? "!" : "",
-		   rq->ctx->hw_id, rq->fence.seqno,
+		   rq->fence.context, rq->fence.seqno,
 		   rq->priotree.priority,
 		   jiffies_to_msecs(jiffies - rq->emitted_jiffies),
 		   rq->timeline->common->name);
-- 
2.16.2

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

✓ Fi.CI.BAT: success for drm/i915: Don't deref request->ctx inside unlocked print_request()

[Patchwork]

== Series Details ==

Series: drm/i915: Don't deref request->ctx inside unlocked print_request()
URL   : https://patchwork.freedesktop.org/series/39098/
State : success

== Summary ==

Series 39098v1 drm/i915: Don't deref request->ctx inside unlocked print_request()
https://patchwork.freedesktop.org/api/1.0/series/39098/revisions/1/mbox/

---- Known issues:

Test kms_pipe_crc_basic:
        Subgroup suspend-read-crc-pipe-b:
                pass       -> DMESG-WARN (fi-cnl-y3) fdo#104951
                pass       -> INCOMPLETE (fi-snb-2520m) fdo#103713

fdo#104951 https://bugs.freedesktop.org/show_bug.cgi?id=104951
fdo#103713 https://bugs.freedesktop.org/show_bug.cgi?id=103713

fi-bdw-5557u     total:288  pass:267  dwarn:0   dfail:0   fail:0   skip:21  time:414s
fi-bdw-gvtdvm    total:288  pass:264  dwarn:0   dfail:0   fail:0   skip:24  time:421s
fi-blb-e6850     total:288  pass:223  dwarn:1   dfail:0   fail:0   skip:64  time:372s
fi-bsw-n3050     total:288  pass:242  dwarn:0   dfail:0   fail:0   skip:46  time:489s
fi-bwr-2160      total:288  pass:183  dwarn:0   dfail:0   fail:0   skip:105 time:283s
fi-bxt-dsi       total:288  pass:258  dwarn:0   dfail:0   fail:0   skip:30  time:475s
fi-bxt-j4205     total:288  pass:259  dwarn:0   dfail:0   fail:0   skip:29  time:480s
fi-byt-j1900     total:288  pass:253  dwarn:0   dfail:0   fail:0   skip:35  time:464s
fi-byt-n2820     total:288  pass:249  dwarn:0   dfail:0   fail:0   skip:39  time:451s
fi-cfl-8700k     total:288  pass:260  dwarn:0   dfail:0   fail:0   skip:28  time:392s
fi-cfl-s2        total:288  pass:262  dwarn:0   dfail:0   fail:0   skip:26  time:562s
fi-cnl-y3        total:288  pass:261  dwarn:1   dfail:0   fail:0   skip:26  time:573s
fi-elk-e7500     total:288  pass:229  dwarn:0   dfail:0   fail:0   skip:59  time:413s
fi-gdg-551       total:288  pass:179  dwarn:0   dfail:0   fail:1   skip:108 time:284s
fi-glk-1         total:288  pass:260  dwarn:0   dfail:0   fail:0   skip:28  time:508s
fi-hsw-4770      total:288  pass:261  dwarn:0   dfail:0   fail:0   skip:27  time:385s
fi-ilk-650       total:288  pass:228  dwarn:0   dfail:0   fail:0   skip:60  time:406s
fi-ivb-3520m     total:288  pass:259  dwarn:0   dfail:0   fail:0   skip:29  time:453s
fi-ivb-3770      total:288  pass:255  dwarn:0   dfail:0   fail:0   skip:33  time:408s
fi-kbl-7500u     total:288  pass:263  dwarn:1   dfail:0   fail:0   skip:24  time:447s
fi-kbl-7560u     total:288  pass:269  dwarn:0   dfail:0   fail:0   skip:19  time:494s
fi-kbl-7567u     total:288  pass:268  dwarn:0   dfail:0   fail:0   skip:20  time:449s
fi-kbl-r         total:288  pass:261  dwarn:0   dfail:0   fail:0   skip:27  time:492s
fi-pnv-d510      total:288  pass:222  dwarn:1   dfail:0   fail:0   skip:65  time:588s
fi-skl-6260u     total:288  pass:268  dwarn:0   dfail:0   fail:0   skip:20  time:424s
fi-skl-6600u     total:288  pass:261  dwarn:0   dfail:0   fail:0   skip:27  time:503s
fi-skl-6700hq    total:288  pass:262  dwarn:0   dfail:0   fail:0   skip:26  time:523s
fi-skl-6700k2    total:288  pass:264  dwarn:0   dfail:0   fail:0   skip:24  time:481s
fi-skl-6770hq    total:288  pass:268  dwarn:0   dfail:0   fail:0   skip:20  time:482s
fi-skl-guc       total:288  pass:260  dwarn:0   dfail:0   fail:0   skip:28  time:406s
fi-skl-gvtdvm    total:288  pass:265  dwarn:0   dfail:0   fail:0   skip:23  time:425s
fi-snb-2520m     total:245  pass:211  dwarn:0   dfail:0   fail:0   skip:33 
fi-snb-2600      total:288  pass:248  dwarn:0   dfail:0   fail:0   skip:40  time:388s

9a02ae14ae024bdbb268333cddccbaf01d8f02ef drm-tip: 2018y-02m-28d-10h-13m-18s UTC integration manifest
90da86ec774d drm/i915: Don't deref request->ctx inside unlocked print_request()

== Logs ==

For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_8184/issues.html
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH] drm/i915: Don't deref request->ctx inside unlocked print_request()

[Mika Kuoppala]

Chris Wilson <chris@chris-wilson.co.uk> writes:

> Although we protect the request itself, we don't lock inside
> intel_engine_dump() and so the request maybe retired as we peek into it.
> One consequence is that the request->ctx may be freed before we
> dereference it, leading to a use-after-free. Replace the hw_id we are
> peeking from inside request->ctx with the request->fence.context, with
> which we can still track from which context the request originated
> (although to tie to HW reports requires a little more legwork, but is
> good enough to follow the GEM traces).

How we do the legwork? I tried to see from the code how we
can associate ctx hw_id with the fence.context id but failed.

-Mika
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH] drm/i915: Don't deref request->ctx inside unlocked print_request()

[Chris Wilson]

Quoting Mika Kuoppala (2018-02-28 12:32:40)
> Chris Wilson <chris@chris-wilson.co.uk> writes:
> 
> > Although we protect the request itself, we don't lock inside
> > intel_engine_dump() and so the request maybe retired as we peek into it.
> > One consequence is that the request->ctx may be freed before we
> > dereference it, leading to a use-after-free. Replace the hw_id we are
> > peeking from inside request->ctx with the request->fence.context, with
> > which we can still track from which context the request originated
> > (although to tie to HW reports requires a little more legwork, but is
> > good enough to follow the GEM traces).
> 
> How we do the legwork? I tried to see from the code how we
> can associate ctx hw_id with the fence.context id but failed.

It's currently inside tracepoints.
-Chris
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH] drm/i915: Don't deref request->ctx inside unlocked print_request()

[Mika Kuoppala]

Chris Wilson <chris@chris-wilson.co.uk> writes:

> Although we protect the request itself, we don't lock inside
> intel_engine_dump() and so the request maybe retired as we peek into it.
> One consequence is that the request->ctx may be freed before we
> dereference it, leading to a use-after-free. Replace the hw_id we are
> peeking from inside request->ctx with the request->fence.context, with
> which we can still track from which context the request originated
> (although to tie to HW reports requires a little more legwork, but is
> good enough to follow the GEM traces).
>
> [52640.729670] general protection fault: 0000 [#2] SMP
> [52640.729694] Dumping ftrace buffer:
> [52640.729701]    (ftrace buffer empty)
> [52640.729705] Modules linked in: vgem snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic x86_pkg_\
> temp_thermal intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul snd_hda_intel snd_hda_codec snd_hwdep gha\
> sh_clmulni_intel snd_hda_core snd_pcm mei_me mei i915 r8169 mii prime_numbers i2c_hid
> [52640.729748] CPU: 2 PID: 4335 Comm: gem_exec_schedu Tainted: G     UD W        4.16.0-rc3+ #7
> [52640.729759] Hardware name: Acer Aspire E5-575G/Ironman_SK  , BIOS V1.12 08/02/2016
> [52640.729803] RIP: 0010:print_request+0x2b/0xb0 [i915]
> [52640.729811] RSP: 0018:ffffc90001453c18 EFLAGS: 00010206
> [52640.729820] RAX: 6b6b6b6b6b6b6b6b RBX: ffff8801e0292d40 RCX: 0000000000000006
> [52640.729829] RDX: ffffc90001453c60 RSI: ffff8801e0292d40 RDI: 0000000000000003
> [52640.729838] RBP: ffffc90001453d80 R08: 0000000000000000 R09: 0000000000000001
> [52640.729847] R10: ffffc90001453bd0 R11: ffffc90001453c73 R12: ffffc90001453c60
> [52640.729856] R13: ffffc90001453d80 R14: ffff8801d5a683c8 R15: ffff8801e0292d40
> [52640.729866] FS:  00007f1ee50548c0(0000) GS:ffff8801e8200000(0000) knlGS:0000000000000000
> [52640.729876] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [52640.729884] CR2: 00007f1ee5077000 CR3: 00000001d9411004 CR4: 00000000003606e0
> [52640.729893] Call Trace:
> [52640.729922]  intel_engine_print_registers+0x623/0x890 [i915]
> [52640.729948]  intel_engine_dump+0x4a3/0x590 [i915]
> [52640.729957]  ? seq_printf+0x3a/0x50
> [52640.729977]  i915_engine_info+0xb8/0xe0 [i915]
> [52640.729984]  ? drm_mode_gamma_get_ioctl+0xf0/0xf0
> [52640.729990]  seq_read+0xd5/0x410
> [52640.729997]  full_proxy_read+0x4b/0x70
> [52640.730004]  __vfs_read+0x1e/0x120
> [52640.730009]  ? do_sys_open+0x134/0x220
> [52640.730015]  ? kmem_cache_free+0x174/0x2b0
> [52640.730021]  vfs_read+0xa1/0x150
> [52640.730026]  SyS_read+0x40/0xa0
> [52640.730032]  do_syscall_64+0x65/0x1a0
> [52640.730038]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
>
> Reported-by: Mika Kuoppala <mika.kuoppala@intel.com>
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Mika Kuoppala <mika.kuoppala@intel.com>

I found how to associate hw_id with fence.context on trace,
so lets fix this race.

Reviewed-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Re: [PATCH] drm/i915: Don't deref request->ctx inside unlocked print_request()

[Chris Wilson]

Quoting Mika Kuoppala (2018-02-28 12:49:00)
> Chris Wilson <chris@chris-wilson.co.uk> writes:
> 
> > Although we protect the request itself, we don't lock inside
> > intel_engine_dump() and so the request maybe retired as we peek into it.
> > One consequence is that the request->ctx may be freed before we
> > dereference it, leading to a use-after-free. Replace the hw_id we are
> > peeking from inside request->ctx with the request->fence.context, with
> > which we can still track from which context the request originated
> > (although to tie to HW reports requires a little more legwork, but is
> > good enough to follow the GEM traces).
> >
> > [52640.729670] general protection fault: 0000 [#2] SMP
> > [52640.729694] Dumping ftrace buffer:
> > [52640.729701]    (ftrace buffer empty)
> > [52640.729705] Modules linked in: vgem snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic x86_pkg_\
> > temp_thermal intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul snd_hda_intel snd_hda_codec snd_hwdep gha\
> > sh_clmulni_intel snd_hda_core snd_pcm mei_me mei i915 r8169 mii prime_numbers i2c_hid
> > [52640.729748] CPU: 2 PID: 4335 Comm: gem_exec_schedu Tainted: G     UD W        4.16.0-rc3+ #7
> > [52640.729759] Hardware name: Acer Aspire E5-575G/Ironman_SK  , BIOS V1.12 08/02/2016
> > [52640.729803] RIP: 0010:print_request+0x2b/0xb0 [i915]
> > [52640.729811] RSP: 0018:ffffc90001453c18 EFLAGS: 00010206
> > [52640.729820] RAX: 6b6b6b6b6b6b6b6b RBX: ffff8801e0292d40 RCX: 0000000000000006
> > [52640.729829] RDX: ffffc90001453c60 RSI: ffff8801e0292d40 RDI: 0000000000000003
> > [52640.729838] RBP: ffffc90001453d80 R08: 0000000000000000 R09: 0000000000000001
> > [52640.729847] R10: ffffc90001453bd0 R11: ffffc90001453c73 R12: ffffc90001453c60
> > [52640.729856] R13: ffffc90001453d80 R14: ffff8801d5a683c8 R15: ffff8801e0292d40
> > [52640.729866] FS:  00007f1ee50548c0(0000) GS:ffff8801e8200000(0000) knlGS:0000000000000000
> > [52640.729876] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > [52640.729884] CR2: 00007f1ee5077000 CR3: 00000001d9411004 CR4: 00000000003606e0
> > [52640.729893] Call Trace:
> > [52640.729922]  intel_engine_print_registers+0x623/0x890 [i915]
> > [52640.729948]  intel_engine_dump+0x4a3/0x590 [i915]
> > [52640.729957]  ? seq_printf+0x3a/0x50
> > [52640.729977]  i915_engine_info+0xb8/0xe0 [i915]
> > [52640.729984]  ? drm_mode_gamma_get_ioctl+0xf0/0xf0
> > [52640.729990]  seq_read+0xd5/0x410
> > [52640.729997]  full_proxy_read+0x4b/0x70
> > [52640.730004]  __vfs_read+0x1e/0x120
> > [52640.730009]  ? do_sys_open+0x134/0x220
> > [52640.730015]  ? kmem_cache_free+0x174/0x2b0
> > [52640.730021]  vfs_read+0xa1/0x150
> > [52640.730026]  SyS_read+0x40/0xa0
> > [52640.730032]  do_syscall_64+0x65/0x1a0
> > [52640.730038]  entry_SYSCALL_64_after_hwframe+0x42/0xb7
> >
> > Reported-by: Mika Kuoppala <mika.kuoppala@intel.com>
> > Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> > Cc: Mika Kuoppala <mika.kuoppala@intel.com>
> 
> I found how to associate hw_id with fence.context on trace,
> so lets fix this race.
> 
> Reviewed-by: Mika Kuoppala <mika.kuoppala@linux.intel.com>

And pushed. Thanks for the report and review,
-Chris
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

✓ Fi.CI.IGT: success for drm/i915: Don't deref request->ctx inside unlocked print_request()

[Patchwork]

== Series Details ==

Series: drm/i915: Don't deref request->ctx inside unlocked print_request()
URL   : https://patchwork.freedesktop.org/series/39098/
State : success

== Summary ==

---- Possible new issues:

Test kms_rotation_crc:
        Subgroup primary-rotation-270:
                fail       -> PASS       (shard-apl)

---- Known issues:

Test gem_eio:
        Subgroup in-flight-contexts:
                pass       -> INCOMPLETE (shard-apl) fdo#104945
Test gem_softpin:
        Subgroup noreloc-s3:
                incomplete -> PASS       (shard-hsw) fdo#103540
Test kms_chv_cursor_fail:
        Subgroup pipe-b-256x256-left-edge:
                dmesg-warn -> PASS       (shard-snb) fdo#105185 +2
Test kms_flip:
        Subgroup flip-vs-modeset-vs-hang:
                pass       -> DMESG-WARN (shard-snb) fdo#103821
        Subgroup plain-flip-ts-check-interruptible:
                fail       -> PASS       (shard-hsw) fdo#100368
Test kms_pipe_crc_basic:
        Subgroup suspend-read-crc-pipe-b:
                pass       -> SKIP       (shard-snb) fdo#103375
Test perf:
        Subgroup enable-disable:
                pass       -> FAIL       (shard-apl) fdo#103715
        Subgroup oa-exponents:
                incomplete -> PASS       (shard-apl) fdo#102254
        Subgroup polling:
                fail       -> PASS       (shard-hsw) fdo#102252

fdo#104945 https://bugs.freedesktop.org/show_bug.cgi?id=104945
fdo#103540 https://bugs.freedesktop.org/show_bug.cgi?id=103540
fdo#105185 https://bugs.freedesktop.org/show_bug.cgi?id=105185
fdo#103821 https://bugs.freedesktop.org/show_bug.cgi?id=103821
fdo#100368 https://bugs.freedesktop.org/show_bug.cgi?id=100368
fdo#103375 https://bugs.freedesktop.org/show_bug.cgi?id=103375
fdo#103715 https://bugs.freedesktop.org/show_bug.cgi?id=103715
fdo#102254 https://bugs.freedesktop.org/show_bug.cgi?id=102254
fdo#102252 https://bugs.freedesktop.org/show_bug.cgi?id=102252

shard-apl        total:3531 pass:1860 dwarn:1   dfail:0   fail:9   skip:1659 time:12200s
shard-hsw        total:3460 pass:1767 dwarn:1   dfail:0   fail:1   skip:1690 time:11716s
shard-snb        total:3460 pass:1354 dwarn:4   dfail:0   fail:2   skip:2100 time:6599s
Blacklisted hosts:
shard-kbl        total:3375 pass:1877 dwarn:18  dfail:2   fail:6   skip:1470 time:8954s

== Logs ==

For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_8184/shards.html
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx