* [PATCH] drm/i915: Use the active reference on the vma while capturing
@ 2020-10-16 9:25 ` Chris Wilson
0 siblings, 0 replies; 7+ messages in thread
From: Chris Wilson @ 2020-10-16 9:25 UTC (permalink / raw)
To: intel-gfx
Cc: Chris Wilson, Mika Kuoppala, Tvrtko Ursulin, Joonas Lahtinen, stable
During error capture, we need to take a reference to the vma from the
before the reset in order to catpure the contents of the vma later.
Currently we are using both an active reference and a kref, but due to
nature of the i915_vma reference handling, that kref is on the vma->obj
and not the vma itself. This means the vma may be destroyed as soon as
it is idle, that is in between the i915_active_release(&vma->active) and
the i915_vma_put(vma);
<3> [197.866181] BUG: KASAN: use-after-free in intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
<3> [197.866339] Read of size 8 at addr ffff8881258cb800 by task gem_exec_captur/1041
<3> [197.866467]
<4> [197.866512] CPU: 2 PID: 1041 Comm: gem_exec_captur Not tainted 5.9.0-g5e4234f97efba-kasan_200+ #1
<4> [197.866521] Hardware name: Intel Corp. Broxton P/Apollolake RVP1A, BIOS APLKRVPA.X64.0150.B11.1608081044 08/08/2016
<4> [197.866530] Call Trace:
<4> [197.866549] dump_stack+0x99/0xd0
<4> [197.866760] ? intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
<4> [197.866783] print_address_description.constprop.8+0x3e/0x60
<4> [197.866797] ? kmsg_dump_rewind_nolock+0xd4/0xd4
<4> [197.866819] ? lockdep_hardirqs_off+0xd4/0x120
<4> [197.867037] ? intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
<4> [197.867249] ? intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
<4> [197.867270] kasan_report.cold.10+0x1f/0x37
<4> [197.867492] ? intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
<4> [197.867710] intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
<4> [197.867949] i915_gpu_coredump.part.29+0x150/0x7b0 [i915]
<4> [197.868186] i915_capture_error_state+0x5e/0xc0 [i915]
<4> [197.868396] intel_gt_handle_error+0x6eb/0xa20 [i915]
<4> [197.868624] ? intel_gt_reset_global+0x370/0x370 [i915]
<4> [197.868644] ? check_flags+0x50/0x50
<4> [197.868662] ? __lock_acquire+0xd59/0x6b00
<4> [197.868678] ? register_lock_class+0x1ad0/0x1ad0
<4> [197.868944] i915_wedged_set+0xcf/0x1b0 [i915]
<4> [197.869147] ? i915_wedged_get+0x90/0x90 [i915]
<4> [197.869371] ? i915_wedged_get+0x90/0x90 [i915]
<4> [197.869398] simple_attr_write+0x153/0x1c0
<4> [197.869428] full_proxy_write+0xee/0x180
<4> [197.869442] ? __sb_start_write+0x1f3/0x310
<4> [197.869465] vfs_write+0x1a3/0x640
<4> [197.869492] ksys_write+0xec/0x1c0
<4> [197.869507] ? __ia32_sys_read+0xa0/0xa0
<4> [197.869525] ? lockdep_hardirqs_on_prepare+0x32b/0x4e0
<4> [197.869541] ? syscall_enter_from_user_mode+0x1c/0x50
<4> [197.869566] do_syscall_64+0x33/0x80
<4> [197.869579] entry_SYSCALL_64_after_hwframe+0x44/0xa9
<4> [197.869590] RIP: 0033:0x7fd8b7aee281
<4> [197.869604] Code: c3 0f 1f 84 00 00 00 00 00 48 8b 05 59 8d 20 00 c3 0f 1f 84 00 00 00 00 00 8b 05 8a d1 20 00 85 c0 75 16 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 41 54 55 49 89 d4 53
<4> [197.869613] RSP: 002b:00007ffea3b72008 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
<4> [197.869625] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd8b7aee281
<4> [197.869633] RDX: 0000000000000002 RSI: 00007fd8b81a82e7 RDI: 000000000000000d
<4> [197.869641] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000034
<4> [197.869650] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd8b81a82e7
<4> [197.869658] R13: 000000000000000d R14: 0000000000000000 R15: 0000000000000000
<3> [197.869707]
<3> [197.869757] Allocated by task 1041:
<4> [197.869833] kasan_save_stack+0x19/0x40
<4> [197.869843] __kasan_kmalloc.constprop.5+0xc1/0xd0
<4> [197.869853] kmem_cache_alloc+0x106/0x8e0
<4> [197.870059] i915_vma_instance+0x212/0x1930 [i915]
<4> [197.870270] eb_lookup_vmas+0xe06/0x1d10 [i915]
<4> [197.870475] i915_gem_do_execbuffer+0x131d/0x4080 [i915]
<4> [197.870682] i915_gem_execbuffer2_ioctl+0x103/0x5d0 [i915]
<4> [197.870701] drm_ioctl_kernel+0x1d2/0x270
<4> [197.870710] drm_ioctl+0x40d/0x85c
<4> [197.870721] __x64_sys_ioctl+0x10d/0x170
<4> [197.870731] do_syscall_64+0x33/0x80
<4> [197.870740] entry_SYSCALL_64_after_hwframe+0x44/0xa9
<3> [197.870748]
<3> [197.870798] Freed by task 22:
<4> [197.870865] kasan_save_stack+0x19/0x40
<4> [197.870875] kasan_set_track+0x1c/0x30
<4> [197.870884] kasan_set_free_info+0x1b/0x30
<4> [197.870894] __kasan_slab_free+0x111/0x160
<4> [197.870903] kmem_cache_free+0xcd/0x710
<4> [197.871109] i915_vma_parked+0x618/0x800 [i915]
<4> [197.871307] __gt_park+0xdb/0x1e0 [i915]
<4> [197.871501] ____intel_wakeref_put_last+0xb1/0x190 [i915]
<4> [197.871516] process_one_work+0x8dc/0x15d0
<4> [197.871525] worker_thread+0x82/0xb30
<4> [197.871535] kthread+0x36d/0x440
<4> [197.871545] ret_from_fork+0x22/0x30
<3> [197.871553]
<3> [197.871602] The buggy address belongs to the object at ffff8881258cb740
which belongs to the cache i915_vma of size 968
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2553
Fixes: 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: <stable@vger.kernel.org> # v5.5+
---
drivers/gpu/drm/i915/i915_gpu_error.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index 2d0c4b8d9e3c..b3f3a2e07408 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -1317,7 +1317,7 @@ capture_vma(struct intel_engine_capture_vma *next,
}
strcpy(c->name, name);
- c->vma = i915_vma_get(vma);
+ c->vma = vma; /* reference held while active */
c->next = next;
return c;
@@ -1407,7 +1407,6 @@ intel_engine_coredump_add_vma(struct intel_engine_coredump *ee,
compress));
i915_active_release(&vma->active);
- i915_vma_put(vma);
capture = this->next;
kfree(this);
--
2.20.1
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [Intel-gfx] [PATCH] drm/i915: Use the active reference on the vma while capturing
@ 2020-10-16 9:25 ` Chris Wilson
0 siblings, 0 replies; 7+ messages in thread
From: Chris Wilson @ 2020-10-16 9:25 UTC (permalink / raw)
To: intel-gfx; +Cc: stable, Chris Wilson
During error capture, we need to take a reference to the vma from the
before the reset in order to catpure the contents of the vma later.
Currently we are using both an active reference and a kref, but due to
nature of the i915_vma reference handling, that kref is on the vma->obj
and not the vma itself. This means the vma may be destroyed as soon as
it is idle, that is in between the i915_active_release(&vma->active) and
the i915_vma_put(vma);
<3> [197.866181] BUG: KASAN: use-after-free in intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
<3> [197.866339] Read of size 8 at addr ffff8881258cb800 by task gem_exec_captur/1041
<3> [197.866467]
<4> [197.866512] CPU: 2 PID: 1041 Comm: gem_exec_captur Not tainted 5.9.0-g5e4234f97efba-kasan_200+ #1
<4> [197.866521] Hardware name: Intel Corp. Broxton P/Apollolake RVP1A, BIOS APLKRVPA.X64.0150.B11.1608081044 08/08/2016
<4> [197.866530] Call Trace:
<4> [197.866549] dump_stack+0x99/0xd0
<4> [197.866760] ? intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
<4> [197.866783] print_address_description.constprop.8+0x3e/0x60
<4> [197.866797] ? kmsg_dump_rewind_nolock+0xd4/0xd4
<4> [197.866819] ? lockdep_hardirqs_off+0xd4/0x120
<4> [197.867037] ? intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
<4> [197.867249] ? intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
<4> [197.867270] kasan_report.cold.10+0x1f/0x37
<4> [197.867492] ? intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
<4> [197.867710] intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
<4> [197.867949] i915_gpu_coredump.part.29+0x150/0x7b0 [i915]
<4> [197.868186] i915_capture_error_state+0x5e/0xc0 [i915]
<4> [197.868396] intel_gt_handle_error+0x6eb/0xa20 [i915]
<4> [197.868624] ? intel_gt_reset_global+0x370/0x370 [i915]
<4> [197.868644] ? check_flags+0x50/0x50
<4> [197.868662] ? __lock_acquire+0xd59/0x6b00
<4> [197.868678] ? register_lock_class+0x1ad0/0x1ad0
<4> [197.868944] i915_wedged_set+0xcf/0x1b0 [i915]
<4> [197.869147] ? i915_wedged_get+0x90/0x90 [i915]
<4> [197.869371] ? i915_wedged_get+0x90/0x90 [i915]
<4> [197.869398] simple_attr_write+0x153/0x1c0
<4> [197.869428] full_proxy_write+0xee/0x180
<4> [197.869442] ? __sb_start_write+0x1f3/0x310
<4> [197.869465] vfs_write+0x1a3/0x640
<4> [197.869492] ksys_write+0xec/0x1c0
<4> [197.869507] ? __ia32_sys_read+0xa0/0xa0
<4> [197.869525] ? lockdep_hardirqs_on_prepare+0x32b/0x4e0
<4> [197.869541] ? syscall_enter_from_user_mode+0x1c/0x50
<4> [197.869566] do_syscall_64+0x33/0x80
<4> [197.869579] entry_SYSCALL_64_after_hwframe+0x44/0xa9
<4> [197.869590] RIP: 0033:0x7fd8b7aee281
<4> [197.869604] Code: c3 0f 1f 84 00 00 00 00 00 48 8b 05 59 8d 20 00 c3 0f 1f 84 00 00 00 00 00 8b 05 8a d1 20 00 85 c0 75 16 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 41 54 55 49 89 d4 53
<4> [197.869613] RSP: 002b:00007ffea3b72008 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
<4> [197.869625] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd8b7aee281
<4> [197.869633] RDX: 0000000000000002 RSI: 00007fd8b81a82e7 RDI: 000000000000000d
<4> [197.869641] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000034
<4> [197.869650] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd8b81a82e7
<4> [197.869658] R13: 000000000000000d R14: 0000000000000000 R15: 0000000000000000
<3> [197.869707]
<3> [197.869757] Allocated by task 1041:
<4> [197.869833] kasan_save_stack+0x19/0x40
<4> [197.869843] __kasan_kmalloc.constprop.5+0xc1/0xd0
<4> [197.869853] kmem_cache_alloc+0x106/0x8e0
<4> [197.870059] i915_vma_instance+0x212/0x1930 [i915]
<4> [197.870270] eb_lookup_vmas+0xe06/0x1d10 [i915]
<4> [197.870475] i915_gem_do_execbuffer+0x131d/0x4080 [i915]
<4> [197.870682] i915_gem_execbuffer2_ioctl+0x103/0x5d0 [i915]
<4> [197.870701] drm_ioctl_kernel+0x1d2/0x270
<4> [197.870710] drm_ioctl+0x40d/0x85c
<4> [197.870721] __x64_sys_ioctl+0x10d/0x170
<4> [197.870731] do_syscall_64+0x33/0x80
<4> [197.870740] entry_SYSCALL_64_after_hwframe+0x44/0xa9
<3> [197.870748]
<3> [197.870798] Freed by task 22:
<4> [197.870865] kasan_save_stack+0x19/0x40
<4> [197.870875] kasan_set_track+0x1c/0x30
<4> [197.870884] kasan_set_free_info+0x1b/0x30
<4> [197.870894] __kasan_slab_free+0x111/0x160
<4> [197.870903] kmem_cache_free+0xcd/0x710
<4> [197.871109] i915_vma_parked+0x618/0x800 [i915]
<4> [197.871307] __gt_park+0xdb/0x1e0 [i915]
<4> [197.871501] ____intel_wakeref_put_last+0xb1/0x190 [i915]
<4> [197.871516] process_one_work+0x8dc/0x15d0
<4> [197.871525] worker_thread+0x82/0xb30
<4> [197.871535] kthread+0x36d/0x440
<4> [197.871545] ret_from_fork+0x22/0x30
<3> [197.871553]
<3> [197.871602] The buggy address belongs to the object at ffff8881258cb740
which belongs to the cache i915_vma of size 968
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2553
Fixes: 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: <stable@vger.kernel.org> # v5.5+
---
drivers/gpu/drm/i915/i915_gpu_error.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
index 2d0c4b8d9e3c..b3f3a2e07408 100644
--- a/drivers/gpu/drm/i915/i915_gpu_error.c
+++ b/drivers/gpu/drm/i915/i915_gpu_error.c
@@ -1317,7 +1317,7 @@ capture_vma(struct intel_engine_capture_vma *next,
}
strcpy(c->name, name);
- c->vma = i915_vma_get(vma);
+ c->vma = vma; /* reference held while active */
c->next = next;
return c;
@@ -1407,7 +1407,6 @@ intel_engine_coredump_add_vma(struct intel_engine_coredump *ee,
compress));
i915_active_release(&vma->active);
- i915_vma_put(vma);
capture = this->next;
kfree(this);
--
2.20.1
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply related [flat|nested] 7+ messages in thread
* [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for drm/i915: Use the active reference on the vma while capturing
2020-10-16 9:25 ` [Intel-gfx] " Chris Wilson
(?)
@ 2020-10-16 9:46 ` Patchwork
-1 siblings, 0 replies; 7+ messages in thread
From: Patchwork @ 2020-10-16 9:46 UTC (permalink / raw)
To: Chris Wilson; +Cc: intel-gfx
== Series Details ==
Series: drm/i915: Use the active reference on the vma while capturing
URL : https://patchwork.freedesktop.org/series/82763/
State : warning
== Summary ==
$ dim checkpatch origin/drm-tip
edea817e95d8 drm/i915: Use the active reference on the vma while capturing
-:14: WARNING:COMMIT_LOG_LONG_LINE: Possible unwrapped commit description (prefer a maximum 75 chars per line)
#14:
<3> [197.866181] BUG: KASAN: use-after-free in intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
total: 0 errors, 1 warnings, 0 checks, 15 lines checked
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Intel-gfx] ✓ Fi.CI.BAT: success for drm/i915: Use the active reference on the vma while capturing
2020-10-16 9:25 ` [Intel-gfx] " Chris Wilson
(?)
(?)
@ 2020-10-16 10:12 ` Patchwork
-1 siblings, 0 replies; 7+ messages in thread
From: Patchwork @ 2020-10-16 10:12 UTC (permalink / raw)
To: Chris Wilson; +Cc: intel-gfx
[-- Attachment #1.1: Type: text/plain, Size: 6334 bytes --]
== Series Details ==
Series: drm/i915: Use the active reference on the vma while capturing
URL : https://patchwork.freedesktop.org/series/82763/
State : success
== Summary ==
CI Bug Log - changes from CI_DRM_9145 -> Patchwork_18711
====================================================
Summary
-------
**SUCCESS**
No regressions found.
External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/index.html
Known issues
------------
Here are the changes found in Patchwork_18711 that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@core_hotunplug@unbind-rebind:
- fi-tgl-y: [PASS][1] -> [DMESG-WARN][2] ([i915#1982])
[1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/fi-tgl-y/igt@core_hotunplug@unbind-rebind.html
[2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/fi-tgl-y/igt@core_hotunplug@unbind-rebind.html
* igt@gem_sync@basic-all:
- fi-tgl-y: [PASS][3] -> [DMESG-WARN][4] ([i915#402])
[3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/fi-tgl-y/igt@gem_sync@basic-all.html
[4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/fi-tgl-y/igt@gem_sync@basic-all.html
* igt@i915_module_load@reload:
- fi-tgl-y: [PASS][5] -> [DMESG-WARN][6] ([i915#1982] / [k.org#205379])
[5]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/fi-tgl-y/igt@i915_module_load@reload.html
[6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/fi-tgl-y/igt@i915_module_load@reload.html
* igt@i915_selftest@live@gt_heartbeat:
- fi-tgl-u2: [PASS][7] -> [INCOMPLETE][8] ([i915#2557])
[7]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/fi-tgl-u2/igt@i915_selftest@live@gt_heartbeat.html
[8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/fi-tgl-u2/igt@i915_selftest@live@gt_heartbeat.html
* igt@kms_cursor_legacy@basic-flip-before-cursor-atomic:
- fi-icl-u2: [PASS][9] -> [DMESG-WARN][10] ([i915#1982]) +1 similar issue
[9]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/fi-icl-u2/igt@kms_cursor_legacy@basic-flip-before-cursor-atomic.html
[10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/fi-icl-u2/igt@kms_cursor_legacy@basic-flip-before-cursor-atomic.html
#### Possible fixes ####
* igt@i915_module_load@reload:
- fi-tgl-u2: [DMESG-WARN][11] ([i915#1982] / [k.org#205379]) -> [PASS][12]
[11]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/fi-tgl-u2/igt@i915_module_load@reload.html
[12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/fi-tgl-u2/igt@i915_module_load@reload.html
* igt@i915_selftest@live@execlists:
- {fi-tgl-dsi}: [INCOMPLETE][13] ([i915#2268]) -> [PASS][14]
[13]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/fi-tgl-dsi/igt@i915_selftest@live@execlists.html
[14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/fi-tgl-dsi/igt@i915_selftest@live@execlists.html
* igt@kms_chamelium@dp-crc-fast:
- fi-kbl-7500u: [FAIL][15] ([i915#1161] / [i915#262]) -> [PASS][16]
[15]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/fi-kbl-7500u/igt@kms_chamelium@dp-crc-fast.html
[16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/fi-kbl-7500u/igt@kms_chamelium@dp-crc-fast.html
* igt@kms_cursor_legacy@basic-busy-flip-before-cursor-atomic:
- fi-bsw-kefka: [DMESG-WARN][17] ([i915#1982]) -> [PASS][18]
[17]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor-atomic.html
[18]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor-atomic.html
* igt@kms_cursor_legacy@basic-busy-flip-before-cursor-legacy:
- fi-icl-u2: [DMESG-WARN][19] ([i915#1982]) -> [PASS][20]
[19]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/fi-icl-u2/igt@kms_cursor_legacy@basic-busy-flip-before-cursor-legacy.html
[20]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/fi-icl-u2/igt@kms_cursor_legacy@basic-busy-flip-before-cursor-legacy.html
* igt@vgem_basic@dmabuf-fence:
- fi-tgl-y: [DMESG-WARN][21] ([i915#402]) -> [PASS][22] +1 similar issue
[21]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/fi-tgl-y/igt@vgem_basic@dmabuf-fence.html
[22]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/fi-tgl-y/igt@vgem_basic@dmabuf-fence.html
#### Warnings ####
* igt@i915_module_load@reload:
- fi-icl-u2: [DMESG-WARN][23] ([i915#289]) -> [DMESG-WARN][24] ([i915#1982] / [i915#289])
[23]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/fi-icl-u2/igt@i915_module_load@reload.html
[24]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/fi-icl-u2/igt@i915_module_load@reload.html
{name}: This element is suppressed. This means it is ignored when computing
the status of the difference (SUCCESS, WARNING, or FAILURE).
[i915#1161]: https://gitlab.freedesktop.org/drm/intel/issues/1161
[i915#1982]: https://gitlab.freedesktop.org/drm/intel/issues/1982
[i915#2268]: https://gitlab.freedesktop.org/drm/intel/issues/2268
[i915#2557]: https://gitlab.freedesktop.org/drm/intel/issues/2557
[i915#262]: https://gitlab.freedesktop.org/drm/intel/issues/262
[i915#289]: https://gitlab.freedesktop.org/drm/intel/issues/289
[i915#402]: https://gitlab.freedesktop.org/drm/intel/issues/402
[k.org#205379]: https://bugzilla.kernel.org/show_bug.cgi?id=205379
Participating hosts (44 -> 38)
------------------------------
Missing (6): fi-ilk-m540 fi-hsw-4200u fi-byt-squawks fi-bsw-cyan fi-byt-clapper fi-bdw-samus
Build changes
-------------
* Linux: CI_DRM_9145 -> Patchwork_18711
CI-20190529: 20190529
CI_DRM_9145: 1b4f5161759852616a451c1366b95ff2ab8a1263 @ git://anongit.freedesktop.org/gfx-ci/linux
IGT_5820: 520f88d7817ebb7464907252a32e8e747429102b @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools
Patchwork_18711: edea817e95d88e29c60732897288b3afd5cfcbf7 @ git://anongit.freedesktop.org/gfx-ci/linux
== Linux commits ==
edea817e95d8 drm/i915: Use the active reference on the vma while capturing
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/index.html
[-- Attachment #1.2: Type: text/html, Size: 7830 bytes --]
[-- Attachment #2: Type: text/plain, Size: 160 bytes --]
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 7+ messages in thread
* [Intel-gfx] ✗ Fi.CI.IGT: failure for drm/i915: Use the active reference on the vma while capturing
2020-10-16 9:25 ` [Intel-gfx] " Chris Wilson
` (2 preceding siblings ...)
(?)
@ 2020-10-16 11:20 ` Patchwork
-1 siblings, 0 replies; 7+ messages in thread
From: Patchwork @ 2020-10-16 11:20 UTC (permalink / raw)
To: Chris Wilson; +Cc: intel-gfx
[-- Attachment #1.1: Type: text/plain, Size: 17378 bytes --]
== Series Details ==
Series: drm/i915: Use the active reference on the vma while capturing
URL : https://patchwork.freedesktop.org/series/82763/
State : failure
== Summary ==
CI Bug Log - changes from CI_DRM_9145_full -> Patchwork_18711_full
====================================================
Summary
-------
**FAILURE**
Serious unknown changes coming with Patchwork_18711_full absolutely need to be
verified manually.
If you think the reported changes have nothing to do with the changes
introduced in Patchwork_18711_full, please notify your bug team to allow them
to document this new failure mode, which will reduce false positives in CI.
Possible new issues
-------------------
Here are the unknown changes that may have been introduced in Patchwork_18711_full:
### IGT changes ###
#### Possible regressions ####
* igt@kms_big_fb@x-tiled-64bpp-rotate-180:
- shard-snb: [PASS][1] -> [FAIL][2]
[1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-snb6/igt@kms_big_fb@x-tiled-64bpp-rotate-180.html
[2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-snb7/igt@kms_big_fb@x-tiled-64bpp-rotate-180.html
* igt@prime_vgem@basic-gtt:
- shard-iclb: [PASS][3] -> [INCOMPLETE][4]
[3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-iclb7/igt@prime_vgem@basic-gtt.html
[4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-iclb7/igt@prime_vgem@basic-gtt.html
#### Suppressed ####
The following results come from untrusted machines, tests, or statuses.
They do not affect the overall result.
* {igt@core_hotunplug@hotrebind}:
- shard-hsw: NOTRUN -> [WARN][5]
[5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-hsw5/igt@core_hotunplug@hotrebind.html
Known issues
------------
Here are the changes found in Patchwork_18711_full that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@core_hotunplug@hotrebind-lateclose:
- shard-snb: [PASS][6] -> [INCOMPLETE][7] ([i915#82])
[6]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-snb4/igt@core_hotunplug@hotrebind-lateclose.html
[7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-snb4/igt@core_hotunplug@hotrebind-lateclose.html
* igt@gem_ctx_isolation@preservation-s3@vecs0:
- shard-skl: [PASS][8] -> [INCOMPLETE][9] ([i915#198])
[8]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-skl2/igt@gem_ctx_isolation@preservation-s3@vecs0.html
[9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-skl4/igt@gem_ctx_isolation@preservation-s3@vecs0.html
* igt@gem_exec_whisper@basic-contexts-all:
- shard-glk: [PASS][10] -> [DMESG-WARN][11] ([i915#118] / [i915#95])
[10]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-glk2/igt@gem_exec_whisper@basic-contexts-all.html
[11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-glk2/igt@gem_exec_whisper@basic-contexts-all.html
* igt@kms_big_fb@linear-8bpp-rotate-0:
- shard-apl: [PASS][12] -> [DMESG-WARN][13] ([i915#1635] / [i915#1982]) +1 similar issue
[12]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-apl7/igt@kms_big_fb@linear-8bpp-rotate-0.html
[13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-apl4/igt@kms_big_fb@linear-8bpp-rotate-0.html
* igt@kms_big_fb@x-tiled-64bpp-rotate-180:
- shard-skl: [PASS][14] -> [FAIL][15] ([i915#1119])
[14]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-skl10/igt@kms_big_fb@x-tiled-64bpp-rotate-180.html
[15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-skl10/igt@kms_big_fb@x-tiled-64bpp-rotate-180.html
* igt@kms_cursor_crc@pipe-b-cursor-256x256-onscreen:
- shard-snb: [PASS][16] -> [SKIP][17] ([fdo#109271])
[16]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-snb7/igt@kms_cursor_crc@pipe-b-cursor-256x256-onscreen.html
[17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-snb4/igt@kms_cursor_crc@pipe-b-cursor-256x256-onscreen.html
* igt@kms_flip@2x-wf_vblank-ts-check@ac-hdmi-a1-hdmi-a2:
- shard-glk: [PASS][18] -> [FAIL][19] ([i915#2122])
[18]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-glk4/igt@kms_flip@2x-wf_vblank-ts-check@ac-hdmi-a1-hdmi-a2.html
[19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-glk3/igt@kms_flip@2x-wf_vblank-ts-check@ac-hdmi-a1-hdmi-a2.html
* igt@kms_flip@flip-vs-expired-vblank@c-dp1:
- shard-apl: [PASS][20] -> [FAIL][21] ([i915#1635] / [i915#79])
[20]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-apl4/igt@kms_flip@flip-vs-expired-vblank@c-dp1.html
[21]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-apl6/igt@kms_flip@flip-vs-expired-vblank@c-dp1.html
* igt@kms_flip@plain-flip-fb-recreate@b-edp1:
- shard-skl: [PASS][22] -> [FAIL][23] ([i915#2122])
[22]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-skl5/igt@kms_flip@plain-flip-fb-recreate@b-edp1.html
[23]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-skl8/igt@kms_flip@plain-flip-fb-recreate@b-edp1.html
* igt@kms_frontbuffer_tracking@fbc-1p-primscrn-pri-shrfb-draw-mmap-cpu:
- shard-kbl: [PASS][24] -> [DMESG-WARN][25] ([i915#1982]) +1 similar issue
[24]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-kbl2/igt@kms_frontbuffer_tracking@fbc-1p-primscrn-pri-shrfb-draw-mmap-cpu.html
[25]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-kbl4/igt@kms_frontbuffer_tracking@fbc-1p-primscrn-pri-shrfb-draw-mmap-cpu.html
* igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-spr-indfb-draw-blt:
- shard-iclb: [PASS][26] -> [FAIL][27] ([i915#49])
[26]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-iclb2/igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-spr-indfb-draw-blt.html
[27]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-iclb1/igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-spr-indfb-draw-blt.html
* igt@kms_frontbuffer_tracking@fbcpsr-rgb565-draw-blt:
- shard-tglb: [PASS][28] -> [DMESG-WARN][29] ([i915#1982]) +1 similar issue
[28]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-tglb3/igt@kms_frontbuffer_tracking@fbcpsr-rgb565-draw-blt.html
[29]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-tglb6/igt@kms_frontbuffer_tracking@fbcpsr-rgb565-draw-blt.html
* igt@kms_frontbuffer_tracking@psr-rgb101010-draw-render:
- shard-skl: [PASS][30] -> [FAIL][31] ([i915#49])
[30]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-skl5/igt@kms_frontbuffer_tracking@psr-rgb101010-draw-render.html
[31]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-skl8/igt@kms_frontbuffer_tracking@psr-rgb101010-draw-render.html
* igt@kms_hdr@bpc-switch-dpms:
- shard-skl: [PASS][32] -> [FAIL][33] ([i915#1188]) +1 similar issue
[32]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-skl10/igt@kms_hdr@bpc-switch-dpms.html
[33]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-skl7/igt@kms_hdr@bpc-switch-dpms.html
* igt@kms_plane_alpha_blend@pipe-a-coverage-7efc:
- shard-skl: [PASS][34] -> [DMESG-FAIL][35] ([fdo#108145] / [i915#1982])
[34]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-skl5/igt@kms_plane_alpha_blend@pipe-a-coverage-7efc.html
[35]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-skl8/igt@kms_plane_alpha_blend@pipe-a-coverage-7efc.html
* igt@kms_psr@psr2_cursor_plane_move:
- shard-iclb: [PASS][36] -> [SKIP][37] ([fdo#109441]) +3 similar issues
[36]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-iclb2/igt@kms_psr@psr2_cursor_plane_move.html
[37]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-iclb3/igt@kms_psr@psr2_cursor_plane_move.html
* igt@kms_universal_plane@disable-primary-vs-flip-pipe-c:
- shard-skl: [PASS][38] -> [DMESG-WARN][39] ([i915#1982]) +10 similar issues
[38]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-skl8/igt@kms_universal_plane@disable-primary-vs-flip-pipe-c.html
[39]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-skl10/igt@kms_universal_plane@disable-primary-vs-flip-pipe-c.html
* igt@perf@polling-parameterized:
- shard-tglb: [PASS][40] -> [FAIL][41] ([i915#1542])
[40]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-tglb5/igt@perf@polling-parameterized.html
[41]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-tglb8/igt@perf@polling-parameterized.html
#### Possible fixes ####
* igt@core_hotunplug@unbind-rebind:
- shard-tglb: [DMESG-WARN][42] ([i915#1982]) -> [PASS][43] +5 similar issues
[42]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-tglb2/igt@core_hotunplug@unbind-rebind.html
[43]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-tglb1/igt@core_hotunplug@unbind-rebind.html
* {igt@gem_exec_capture@pi@rcs0}:
- shard-glk: [INCOMPLETE][44] ([i915#2553]) -> [PASS][45]
[44]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-glk4/igt@gem_exec_capture@pi@rcs0.html
[45]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-glk3/igt@gem_exec_capture@pi@rcs0.html
* {igt@gem_exec_capture@pi@vcs0}:
- shard-skl: [INCOMPLETE][46] ([i915#2553]) -> [PASS][47]
[46]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-skl9/igt@gem_exec_capture@pi@vcs0.html
[47]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-skl1/igt@gem_exec_capture@pi@vcs0.html
* igt@gem_exec_whisper@basic-contexts:
- shard-glk: [DMESG-WARN][48] ([i915#118] / [i915#95]) -> [PASS][49] +3 similar issues
[48]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-glk6/igt@gem_exec_whisper@basic-contexts.html
[49]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-glk2/igt@gem_exec_whisper@basic-contexts.html
* igt@gem_userptr_blits@sync-unmap-cycles:
- shard-skl: [TIMEOUT][50] ([i915#2424]) -> [PASS][51]
[50]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-skl8/igt@gem_userptr_blits@sync-unmap-cycles.html
[51]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-skl9/igt@gem_userptr_blits@sync-unmap-cycles.html
* {igt@kms_async_flips@alternate-sync-async-flip}:
- shard-skl: [FAIL][52] ([i915#2521]) -> [PASS][53]
[52]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-skl3/igt@kms_async_flips@alternate-sync-async-flip.html
[53]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-skl2/igt@kms_async_flips@alternate-sync-async-flip.html
* {igt@kms_async_flips@async-flip-with-page-flip-events}:
- shard-kbl: [FAIL][54] ([i915#2521]) -> [PASS][55]
[54]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-kbl6/igt@kms_async_flips@async-flip-with-page-flip-events.html
[55]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-kbl1/igt@kms_async_flips@async-flip-with-page-flip-events.html
* igt@kms_ccs@pipe-a-crc-primary-rotation-180:
- shard-skl: [DMESG-WARN][56] ([i915#1982]) -> [PASS][57] +6 similar issues
[56]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-skl2/igt@kms_ccs@pipe-a-crc-primary-rotation-180.html
[57]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-skl8/igt@kms_ccs@pipe-a-crc-primary-rotation-180.html
* igt@kms_flip@flip-vs-absolute-wf_vblank@a-dp1:
- shard-apl: [DMESG-WARN][58] ([i915#1635] / [i915#1982]) -> [PASS][59] +1 similar issue
[58]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-apl8/igt@kms_flip@flip-vs-absolute-wf_vblank@a-dp1.html
[59]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-apl8/igt@kms_flip@flip-vs-absolute-wf_vblank@a-dp1.html
* igt@kms_frontbuffer_tracking@fbc-1p-offscren-pri-indfb-draw-render:
- shard-kbl: [DMESG-WARN][60] ([i915#1982]) -> [PASS][61] +1 similar issue
[60]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-kbl1/igt@kms_frontbuffer_tracking@fbc-1p-offscren-pri-indfb-draw-render.html
[61]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-kbl6/igt@kms_frontbuffer_tracking@fbc-1p-offscren-pri-indfb-draw-render.html
* igt@kms_frontbuffer_tracking@fbc-stridechange:
- shard-glk: [DMESG-WARN][62] ([i915#1982]) -> [PASS][63]
[62]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-glk5/igt@kms_frontbuffer_tracking@fbc-stridechange.html
[63]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-glk1/igt@kms_frontbuffer_tracking@fbc-stridechange.html
* igt@kms_hdr@bpc-switch:
- shard-skl: [FAIL][64] ([i915#1188]) -> [PASS][65]
[64]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-skl2/igt@kms_hdr@bpc-switch.html
[65]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-skl8/igt@kms_hdr@bpc-switch.html
* igt@kms_plane_alpha_blend@pipe-c-constant-alpha-min:
- shard-skl: [FAIL][66] ([fdo#108145] / [i915#265]) -> [PASS][67] +1 similar issue
[66]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-skl7/igt@kms_plane_alpha_blend@pipe-c-constant-alpha-min.html
[67]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-skl3/igt@kms_plane_alpha_blend@pipe-c-constant-alpha-min.html
* igt@kms_psr@psr2_cursor_render:
- shard-iclb: [SKIP][68] ([fdo#109441]) -> [PASS][69] +4 similar issues
[68]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-iclb8/igt@kms_psr@psr2_cursor_render.html
[69]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-iclb2/igt@kms_psr@psr2_cursor_render.html
* igt@perf@polling-parameterized:
- shard-glk: [FAIL][70] ([i915#1542]) -> [PASS][71]
[70]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-glk7/igt@perf@polling-parameterized.html
[71]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-glk1/igt@perf@polling-parameterized.html
* igt@perf@polling-small-buf:
- shard-skl: [FAIL][72] ([i915#1722]) -> [PASS][73]
[72]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-skl2/igt@perf@polling-small-buf.html
[73]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-skl8/igt@perf@polling-small-buf.html
#### Warnings ####
* igt@i915_pm_dc@dc3co-vpb-simulation:
- shard-iclb: [SKIP][74] ([i915#658]) -> [SKIP][75] ([i915#588])
[74]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_9145/shard-iclb5/igt@i915_pm_dc@dc3co-vpb-simulation.html
[75]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/shard-iclb2/igt@i915_pm_dc@dc3co-vpb-simulation.html
{name}: This element is suppressed. This means it is ignored when computing
the status of the difference (SUCCESS, WARNING, or FAILURE).
[fdo#108145]: https://bugs.freedesktop.org/show_bug.cgi?id=108145
[fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271
[fdo#109441]: https://bugs.freedesktop.org/show_bug.cgi?id=109441
[i915#1119]: https://gitlab.freedesktop.org/drm/intel/issues/1119
[i915#118]: https://gitlab.freedesktop.org/drm/intel/issues/118
[i915#1188]: https://gitlab.freedesktop.org/drm/intel/issues/1188
[i915#1542]: https://gitlab.freedesktop.org/drm/intel/issues/1542
[i915#1635]: https://gitlab.freedesktop.org/drm/intel/issues/1635
[i915#1722]: https://gitlab.freedesktop.org/drm/intel/issues/1722
[i915#198]: https://gitlab.freedesktop.org/drm/intel/issues/198
[i915#1982]: https://gitlab.freedesktop.org/drm/intel/issues/1982
[i915#2122]: https://gitlab.freedesktop.org/drm/intel/issues/2122
[i915#2424]: https://gitlab.freedesktop.org/drm/intel/issues/2424
[i915#2521]: https://gitlab.freedesktop.org/drm/intel/issues/2521
[i915#2553]: https://gitlab.freedesktop.org/drm/intel/issues/2553
[i915#265]: https://gitlab.freedesktop.org/drm/intel/issues/265
[i915#49]: https://gitlab.freedesktop.org/drm/intel/issues/49
[i915#588]: https://gitlab.freedesktop.org/drm/intel/issues/588
[i915#658]: https://gitlab.freedesktop.org/drm/intel/issues/658
[i915#79]: https://gitlab.freedesktop.org/drm/intel/issues/79
[i915#82]: https://gitlab.freedesktop.org/drm/intel/issues/82
[i915#95]: https://gitlab.freedesktop.org/drm/intel/issues/95
Participating hosts (11 -> 11)
------------------------------
No changes in participating hosts
Build changes
-------------
* Linux: CI_DRM_9145 -> Patchwork_18711
CI-20190529: 20190529
CI_DRM_9145: 1b4f5161759852616a451c1366b95ff2ab8a1263 @ git://anongit.freedesktop.org/gfx-ci/linux
IGT_5820: 520f88d7817ebb7464907252a32e8e747429102b @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools
Patchwork_18711: edea817e95d88e29c60732897288b3afd5cfcbf7 @ git://anongit.freedesktop.org/gfx-ci/linux
piglit_4509: fdc5a4ca11124ab8413c7988896eec4c97336694 @ git://anongit.freedesktop.org/piglit
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_18711/index.html
[-- Attachment #1.2: Type: text/html, Size: 20360 bytes --]
[-- Attachment #2: Type: text/plain, Size: 160 bytes --]
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Intel-gfx] [PATCH] drm/i915: Use the active reference on the vma while capturing
2020-10-16 9:25 ` [Intel-gfx] " Chris Wilson
@ 2020-10-16 14:02 ` Matthew Auld
-1 siblings, 0 replies; 7+ messages in thread
From: Matthew Auld @ 2020-10-16 14:02 UTC (permalink / raw)
To: Chris Wilson; +Cc: Intel Graphics Development, stable
On Fri, 16 Oct 2020 at 10:25, Chris Wilson <chris@chris-wilson.co.uk> wrote:
>
> During error capture, we need to take a reference to the vma from the
> before the reset in order to catpure the contents of the vma later.
> Currently we are using both an active reference and a kref, but due to
> nature of the i915_vma reference handling, that kref is on the vma->obj
> and not the vma itself. This means the vma may be destroyed as soon as
> it is idle, that is in between the i915_active_release(&vma->active) and
> the i915_vma_put(vma);
>
> <3> [197.866181] BUG: KASAN: use-after-free in intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
> <3> [197.866339] Read of size 8 at addr ffff8881258cb800 by task gem_exec_captur/1041
> <3> [197.866467]
> <4> [197.866512] CPU: 2 PID: 1041 Comm: gem_exec_captur Not tainted 5.9.0-g5e4234f97efba-kasan_200+ #1
> <4> [197.866521] Hardware name: Intel Corp. Broxton P/Apollolake RVP1A, BIOS APLKRVPA.X64.0150.B11.1608081044 08/08/2016
> <4> [197.866530] Call Trace:
> <4> [197.866549] dump_stack+0x99/0xd0
> <4> [197.866760] ? intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
> <4> [197.866783] print_address_description.constprop.8+0x3e/0x60
> <4> [197.866797] ? kmsg_dump_rewind_nolock+0xd4/0xd4
> <4> [197.866819] ? lockdep_hardirqs_off+0xd4/0x120
> <4> [197.867037] ? intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
> <4> [197.867249] ? intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
> <4> [197.867270] kasan_report.cold.10+0x1f/0x37
> <4> [197.867492] ? intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
> <4> [197.867710] intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
> <4> [197.867949] i915_gpu_coredump.part.29+0x150/0x7b0 [i915]
> <4> [197.868186] i915_capture_error_state+0x5e/0xc0 [i915]
> <4> [197.868396] intel_gt_handle_error+0x6eb/0xa20 [i915]
> <4> [197.868624] ? intel_gt_reset_global+0x370/0x370 [i915]
> <4> [197.868644] ? check_flags+0x50/0x50
> <4> [197.868662] ? __lock_acquire+0xd59/0x6b00
> <4> [197.868678] ? register_lock_class+0x1ad0/0x1ad0
> <4> [197.868944] i915_wedged_set+0xcf/0x1b0 [i915]
> <4> [197.869147] ? i915_wedged_get+0x90/0x90 [i915]
> <4> [197.869371] ? i915_wedged_get+0x90/0x90 [i915]
> <4> [197.869398] simple_attr_write+0x153/0x1c0
> <4> [197.869428] full_proxy_write+0xee/0x180
> <4> [197.869442] ? __sb_start_write+0x1f3/0x310
> <4> [197.869465] vfs_write+0x1a3/0x640
> <4> [197.869492] ksys_write+0xec/0x1c0
> <4> [197.869507] ? __ia32_sys_read+0xa0/0xa0
> <4> [197.869525] ? lockdep_hardirqs_on_prepare+0x32b/0x4e0
> <4> [197.869541] ? syscall_enter_from_user_mode+0x1c/0x50
> <4> [197.869566] do_syscall_64+0x33/0x80
> <4> [197.869579] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> <4> [197.869590] RIP: 0033:0x7fd8b7aee281
> <4> [197.869604] Code: c3 0f 1f 84 00 00 00 00 00 48 8b 05 59 8d 20 00 c3 0f 1f 84 00 00 00 00 00 8b 05 8a d1 20 00 85 c0 75 16 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 41 54 55 49 89 d4 53
> <4> [197.869613] RSP: 002b:00007ffea3b72008 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
> <4> [197.869625] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd8b7aee281
> <4> [197.869633] RDX: 0000000000000002 RSI: 00007fd8b81a82e7 RDI: 000000000000000d
> <4> [197.869641] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000034
> <4> [197.869650] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd8b81a82e7
> <4> [197.869658] R13: 000000000000000d R14: 0000000000000000 R15: 0000000000000000
> <3> [197.869707]
> <3> [197.869757] Allocated by task 1041:
> <4> [197.869833] kasan_save_stack+0x19/0x40
> <4> [197.869843] __kasan_kmalloc.constprop.5+0xc1/0xd0
> <4> [197.869853] kmem_cache_alloc+0x106/0x8e0
> <4> [197.870059] i915_vma_instance+0x212/0x1930 [i915]
> <4> [197.870270] eb_lookup_vmas+0xe06/0x1d10 [i915]
> <4> [197.870475] i915_gem_do_execbuffer+0x131d/0x4080 [i915]
> <4> [197.870682] i915_gem_execbuffer2_ioctl+0x103/0x5d0 [i915]
> <4> [197.870701] drm_ioctl_kernel+0x1d2/0x270
> <4> [197.870710] drm_ioctl+0x40d/0x85c
> <4> [197.870721] __x64_sys_ioctl+0x10d/0x170
> <4> [197.870731] do_syscall_64+0x33/0x80
> <4> [197.870740] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> <3> [197.870748]
> <3> [197.870798] Freed by task 22:
> <4> [197.870865] kasan_save_stack+0x19/0x40
> <4> [197.870875] kasan_set_track+0x1c/0x30
> <4> [197.870884] kasan_set_free_info+0x1b/0x30
> <4> [197.870894] __kasan_slab_free+0x111/0x160
> <4> [197.870903] kmem_cache_free+0xcd/0x710
> <4> [197.871109] i915_vma_parked+0x618/0x800 [i915]
> <4> [197.871307] __gt_park+0xdb/0x1e0 [i915]
> <4> [197.871501] ____intel_wakeref_put_last+0xb1/0x190 [i915]
> <4> [197.871516] process_one_work+0x8dc/0x15d0
> <4> [197.871525] worker_thread+0x82/0xb30
> <4> [197.871535] kthread+0x36d/0x440
> <4> [197.871545] ret_from_fork+0x22/0x30
> <3> [197.871553]
> <3> [197.871602] The buggy address belongs to the object at ffff8881258cb740
> which belongs to the cache i915_vma of size 968
>
> Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2553
> Fixes: 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex")
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
> Cc: <stable@vger.kernel.org> # v5.5+
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Intel-gfx] [PATCH] drm/i915: Use the active reference on the vma while capturing
@ 2020-10-16 14:02 ` Matthew Auld
0 siblings, 0 replies; 7+ messages in thread
From: Matthew Auld @ 2020-10-16 14:02 UTC (permalink / raw)
To: Chris Wilson; +Cc: Intel Graphics Development, stable
On Fri, 16 Oct 2020 at 10:25, Chris Wilson <chris@chris-wilson.co.uk> wrote:
>
> During error capture, we need to take a reference to the vma from the
> before the reset in order to catpure the contents of the vma later.
> Currently we are using both an active reference and a kref, but due to
> nature of the i915_vma reference handling, that kref is on the vma->obj
> and not the vma itself. This means the vma may be destroyed as soon as
> it is idle, that is in between the i915_active_release(&vma->active) and
> the i915_vma_put(vma);
>
> <3> [197.866181] BUG: KASAN: use-after-free in intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
> <3> [197.866339] Read of size 8 at addr ffff8881258cb800 by task gem_exec_captur/1041
> <3> [197.866467]
> <4> [197.866512] CPU: 2 PID: 1041 Comm: gem_exec_captur Not tainted 5.9.0-g5e4234f97efba-kasan_200+ #1
> <4> [197.866521] Hardware name: Intel Corp. Broxton P/Apollolake RVP1A, BIOS APLKRVPA.X64.0150.B11.1608081044 08/08/2016
> <4> [197.866530] Call Trace:
> <4> [197.866549] dump_stack+0x99/0xd0
> <4> [197.866760] ? intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
> <4> [197.866783] print_address_description.constprop.8+0x3e/0x60
> <4> [197.866797] ? kmsg_dump_rewind_nolock+0xd4/0xd4
> <4> [197.866819] ? lockdep_hardirqs_off+0xd4/0x120
> <4> [197.867037] ? intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
> <4> [197.867249] ? intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
> <4> [197.867270] kasan_report.cold.10+0x1f/0x37
> <4> [197.867492] ? intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
> <4> [197.867710] intel_engine_coredump_add_vma+0x36c/0x4a0 [i915]
> <4> [197.867949] i915_gpu_coredump.part.29+0x150/0x7b0 [i915]
> <4> [197.868186] i915_capture_error_state+0x5e/0xc0 [i915]
> <4> [197.868396] intel_gt_handle_error+0x6eb/0xa20 [i915]
> <4> [197.868624] ? intel_gt_reset_global+0x370/0x370 [i915]
> <4> [197.868644] ? check_flags+0x50/0x50
> <4> [197.868662] ? __lock_acquire+0xd59/0x6b00
> <4> [197.868678] ? register_lock_class+0x1ad0/0x1ad0
> <4> [197.868944] i915_wedged_set+0xcf/0x1b0 [i915]
> <4> [197.869147] ? i915_wedged_get+0x90/0x90 [i915]
> <4> [197.869371] ? i915_wedged_get+0x90/0x90 [i915]
> <4> [197.869398] simple_attr_write+0x153/0x1c0
> <4> [197.869428] full_proxy_write+0xee/0x180
> <4> [197.869442] ? __sb_start_write+0x1f3/0x310
> <4> [197.869465] vfs_write+0x1a3/0x640
> <4> [197.869492] ksys_write+0xec/0x1c0
> <4> [197.869507] ? __ia32_sys_read+0xa0/0xa0
> <4> [197.869525] ? lockdep_hardirqs_on_prepare+0x32b/0x4e0
> <4> [197.869541] ? syscall_enter_from_user_mode+0x1c/0x50
> <4> [197.869566] do_syscall_64+0x33/0x80
> <4> [197.869579] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> <4> [197.869590] RIP: 0033:0x7fd8b7aee281
> <4> [197.869604] Code: c3 0f 1f 84 00 00 00 00 00 48 8b 05 59 8d 20 00 c3 0f 1f 84 00 00 00 00 00 8b 05 8a d1 20 00 85 c0 75 16 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 57 f3 c3 0f 1f 44 00 00 41 54 55 49 89 d4 53
> <4> [197.869613] RSP: 002b:00007ffea3b72008 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
> <4> [197.869625] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd8b7aee281
> <4> [197.869633] RDX: 0000000000000002 RSI: 00007fd8b81a82e7 RDI: 000000000000000d
> <4> [197.869641] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000034
> <4> [197.869650] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd8b81a82e7
> <4> [197.869658] R13: 000000000000000d R14: 0000000000000000 R15: 0000000000000000
> <3> [197.869707]
> <3> [197.869757] Allocated by task 1041:
> <4> [197.869833] kasan_save_stack+0x19/0x40
> <4> [197.869843] __kasan_kmalloc.constprop.5+0xc1/0xd0
> <4> [197.869853] kmem_cache_alloc+0x106/0x8e0
> <4> [197.870059] i915_vma_instance+0x212/0x1930 [i915]
> <4> [197.870270] eb_lookup_vmas+0xe06/0x1d10 [i915]
> <4> [197.870475] i915_gem_do_execbuffer+0x131d/0x4080 [i915]
> <4> [197.870682] i915_gem_execbuffer2_ioctl+0x103/0x5d0 [i915]
> <4> [197.870701] drm_ioctl_kernel+0x1d2/0x270
> <4> [197.870710] drm_ioctl+0x40d/0x85c
> <4> [197.870721] __x64_sys_ioctl+0x10d/0x170
> <4> [197.870731] do_syscall_64+0x33/0x80
> <4> [197.870740] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> <3> [197.870748]
> <3> [197.870798] Freed by task 22:
> <4> [197.870865] kasan_save_stack+0x19/0x40
> <4> [197.870875] kasan_set_track+0x1c/0x30
> <4> [197.870884] kasan_set_free_info+0x1b/0x30
> <4> [197.870894] __kasan_slab_free+0x111/0x160
> <4> [197.870903] kmem_cache_free+0xcd/0x710
> <4> [197.871109] i915_vma_parked+0x618/0x800 [i915]
> <4> [197.871307] __gt_park+0xdb/0x1e0 [i915]
> <4> [197.871501] ____intel_wakeref_put_last+0xb1/0x190 [i915]
> <4> [197.871516] process_one_work+0x8dc/0x15d0
> <4> [197.871525] worker_thread+0x82/0xb30
> <4> [197.871535] kthread+0x36d/0x440
> <4> [197.871545] ret_from_fork+0x22/0x30
> <3> [197.871553]
> <3> [197.871602] The buggy address belongs to the object at ffff8881258cb740
> which belongs to the cache i915_vma of size 968
>
> Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2553
> Fixes: 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex")
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
> Cc: <stable@vger.kernel.org> # v5.5+
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2020-10-16 14:02 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-16 9:25 [PATCH] drm/i915: Use the active reference on the vma while capturing Chris Wilson
2020-10-16 9:25 ` [Intel-gfx] " Chris Wilson
2020-10-16 9:46 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for " Patchwork
2020-10-16 10:12 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork
2020-10-16 11:20 ` [Intel-gfx] ✗ Fi.CI.IGT: failure " Patchwork
2020-10-16 14:02 ` [Intel-gfx] [PATCH] " Matthew Auld
2020-10-16 14:02 ` Matthew Auld
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.