* [Intel-gfx] [PATCH v6 0/4] drm: address potential UAF bugs with drm_master ptrs
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
0 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: gregkh, intel-gfx, linux-kernel, dri-devel, linaro-mm-sig, skhan,
Desmond Cheong Zhi Xi, linux-kernel-mentees, linux-media
This patch series addresses potential use-after-free errors when dereferencing pointers to struct drm_master. These were identified after one such bug was caught by Syzbot in drm_getunique():
https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803
The series is broken up into four patches:
1. Move a call to drm_is_current_master() out from a section locked by &dev->mode_config.mutex in drm_mode_getconnector(). This patch does not apply to stable.
2. Move a call to _drm_lease_held() out from the section locked by &dev->mode_config.idr_mutex in __drm_mode_object_find().
3. Implement a locked version of drm_is_current_master() function that's used within drm_auth.c.
4. Identify areas in drm_lease.c where pointers to struct drm_master are dereferenced, and ensure that the master pointers are not freed during use.
Changes in v5 -> v6:
- Patch 2:
Add patch 2 to the series. This patch moves the call to _drm_lease_held out from the section locked by &dev->mode_config.idr_mutex in __drm_mode_object_find.
- Patch 4:
Clarify the kerneldoc for dereferencing drm_file.master, as suggested by Daniel Vetter.
Refactor error paths with goto labels so that each function only has a single drm_master_put(), as suggested by Emil Velikov.
Modify comparison to NULL into "!master", as suggested by the intel-gfx CI.
Changes in v4 -> v5:
- Patch 1:
Add patch 1 to the series. The changes in patch 1 do not apply to stable because they apply to new changes in the drm-misc-next branch. This patch moves the call to drm_is_current_master in drm_mode_getconnector out from the section locked by &dev->mode_config.mutex.
Additionally, added a missing semicolon to the patch, caught by the intel-gfx CI.
- Patch 3:
Move changes to drm_connector.c into patch 1.
Changes in v3 -> v4:
- Patch 3:
Move the call to drm_is_current_master in drm_mode_getconnector out from the section locked by &dev->mode_config.mutex. As suggested by Daniel Vetter. This avoids a circular lock lock dependency as reported here https://patchwork.freedesktop.org/patch/440406/
Additionally, inside drm_is_current_master, instead of grabbing &fpriv->master->dev->master_mutex, we grab &fpriv->minor->dev->master_mutex to avoid dereferencing a null ptr if fpriv->master is not set.
- Patch 4:
Modify kerneldoc formatting.
Additionally, add a file_priv->master NULL check inside drm_file_get_master, and handle the NULL result accordingly in drm_lease.c. As suggested by Daniel Vetter.
Changes in v2 -> v3:
- Patch 3:
Move the definition of drm_is_current_master and the _locked version higher up in drm_auth.c to avoid needing a forward declaration of drm_is_current_master_locked. As suggested by Daniel Vetter.
- Patch 4:
Instead of leaking drm_device.master_mutex into drm_lease.c to protect drm_master pointers, add a new drm_file_get_master() function that returns drm_file->master while increasing its reference count, to prevent drm_file->master from being freed. As suggested by Daniel Vetter.
Changes in v1 -> v2:
- Patch 4:
Move the lock and assignment before the DRM_DEBUG_LEASE in drm_mode_get_lease_ioctl, as suggested by Emil Velikov.
Desmond Cheong Zhi Xi (4):
drm: avoid circular locks in drm_mode_getconnector
drm: avoid circular locks in __drm_mode_object_find
drm: add a locked version of drm_is_current_master
drm: protect drm_master pointers in drm_lease.c
drivers/gpu/drm/drm_auth.c | 76 +++++++++++++++++++++--------
drivers/gpu/drm/drm_connector.c | 5 +-
drivers/gpu/drm/drm_lease.c | 81 +++++++++++++++++++++++--------
drivers/gpu/drm/drm_mode_object.c | 10 ++--
include/drm/drm_auth.h | 1 +
include/drm/drm_file.h | 15 ++++--
6 files changed, 141 insertions(+), 47 deletions(-)
--
2.25.1
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 23+ messages in thread
* [PATCH v6 0/4] drm: address potential UAF bugs with drm_master ptrs
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
0 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: gregkh, intel-gfx, emil.l.velikov, linux-kernel, dri-devel,
linaro-mm-sig, skhan, Desmond Cheong Zhi Xi,
linux-kernel-mentees, linux-media
This patch series addresses potential use-after-free errors when dereferencing pointers to struct drm_master. These were identified after one such bug was caught by Syzbot in drm_getunique():
https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803
The series is broken up into four patches:
1. Move a call to drm_is_current_master() out from a section locked by &dev->mode_config.mutex in drm_mode_getconnector(). This patch does not apply to stable.
2. Move a call to _drm_lease_held() out from the section locked by &dev->mode_config.idr_mutex in __drm_mode_object_find().
3. Implement a locked version of drm_is_current_master() function that's used within drm_auth.c.
4. Identify areas in drm_lease.c where pointers to struct drm_master are dereferenced, and ensure that the master pointers are not freed during use.
Changes in v5 -> v6:
- Patch 2:
Add patch 2 to the series. This patch moves the call to _drm_lease_held out from the section locked by &dev->mode_config.idr_mutex in __drm_mode_object_find.
- Patch 4:
Clarify the kerneldoc for dereferencing drm_file.master, as suggested by Daniel Vetter.
Refactor error paths with goto labels so that each function only has a single drm_master_put(), as suggested by Emil Velikov.
Modify comparison to NULL into "!master", as suggested by the intel-gfx CI.
Changes in v4 -> v5:
- Patch 1:
Add patch 1 to the series. The changes in patch 1 do not apply to stable because they apply to new changes in the drm-misc-next branch. This patch moves the call to drm_is_current_master in drm_mode_getconnector out from the section locked by &dev->mode_config.mutex.
Additionally, added a missing semicolon to the patch, caught by the intel-gfx CI.
- Patch 3:
Move changes to drm_connector.c into patch 1.
Changes in v3 -> v4:
- Patch 3:
Move the call to drm_is_current_master in drm_mode_getconnector out from the section locked by &dev->mode_config.mutex. As suggested by Daniel Vetter. This avoids a circular lock lock dependency as reported here https://patchwork.freedesktop.org/patch/440406/
Additionally, inside drm_is_current_master, instead of grabbing &fpriv->master->dev->master_mutex, we grab &fpriv->minor->dev->master_mutex to avoid dereferencing a null ptr if fpriv->master is not set.
- Patch 4:
Modify kerneldoc formatting.
Additionally, add a file_priv->master NULL check inside drm_file_get_master, and handle the NULL result accordingly in drm_lease.c. As suggested by Daniel Vetter.
Changes in v2 -> v3:
- Patch 3:
Move the definition of drm_is_current_master and the _locked version higher up in drm_auth.c to avoid needing a forward declaration of drm_is_current_master_locked. As suggested by Daniel Vetter.
- Patch 4:
Instead of leaking drm_device.master_mutex into drm_lease.c to protect drm_master pointers, add a new drm_file_get_master() function that returns drm_file->master while increasing its reference count, to prevent drm_file->master from being freed. As suggested by Daniel Vetter.
Changes in v1 -> v2:
- Patch 4:
Move the lock and assignment before the DRM_DEBUG_LEASE in drm_mode_get_lease_ioctl, as suggested by Emil Velikov.
Desmond Cheong Zhi Xi (4):
drm: avoid circular locks in drm_mode_getconnector
drm: avoid circular locks in __drm_mode_object_find
drm: add a locked version of drm_is_current_master
drm: protect drm_master pointers in drm_lease.c
drivers/gpu/drm/drm_auth.c | 76 +++++++++++++++++++++--------
drivers/gpu/drm/drm_connector.c | 5 +-
drivers/gpu/drm/drm_lease.c | 81 +++++++++++++++++++++++--------
drivers/gpu/drm/drm_mode_object.c | 10 ++--
include/drm/drm_auth.h | 1 +
include/drm/drm_file.h | 15 ++++--
6 files changed, 141 insertions(+), 47 deletions(-)
--
2.25.1
^ permalink raw reply [flat|nested] 23+ messages in thread
* [PATCH v6 0/4] drm: address potential UAF bugs with drm_master ptrs
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
0 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: intel-gfx, emil.l.velikov, linux-kernel, dri-devel,
linaro-mm-sig, Desmond Cheong Zhi Xi, linux-kernel-mentees,
linux-media
This patch series addresses potential use-after-free errors when dereferencing pointers to struct drm_master. These were identified after one such bug was caught by Syzbot in drm_getunique():
https://syzkaller.appspot.com/bug?id=148d2f1dfac64af52ffd27b661981a540724f803
The series is broken up into four patches:
1. Move a call to drm_is_current_master() out from a section locked by &dev->mode_config.mutex in drm_mode_getconnector(). This patch does not apply to stable.
2. Move a call to _drm_lease_held() out from the section locked by &dev->mode_config.idr_mutex in __drm_mode_object_find().
3. Implement a locked version of drm_is_current_master() function that's used within drm_auth.c.
4. Identify areas in drm_lease.c where pointers to struct drm_master are dereferenced, and ensure that the master pointers are not freed during use.
Changes in v5 -> v6:
- Patch 2:
Add patch 2 to the series. This patch moves the call to _drm_lease_held out from the section locked by &dev->mode_config.idr_mutex in __drm_mode_object_find.
- Patch 4:
Clarify the kerneldoc for dereferencing drm_file.master, as suggested by Daniel Vetter.
Refactor error paths with goto labels so that each function only has a single drm_master_put(), as suggested by Emil Velikov.
Modify comparison to NULL into "!master", as suggested by the intel-gfx CI.
Changes in v4 -> v5:
- Patch 1:
Add patch 1 to the series. The changes in patch 1 do not apply to stable because they apply to new changes in the drm-misc-next branch. This patch moves the call to drm_is_current_master in drm_mode_getconnector out from the section locked by &dev->mode_config.mutex.
Additionally, added a missing semicolon to the patch, caught by the intel-gfx CI.
- Patch 3:
Move changes to drm_connector.c into patch 1.
Changes in v3 -> v4:
- Patch 3:
Move the call to drm_is_current_master in drm_mode_getconnector out from the section locked by &dev->mode_config.mutex. As suggested by Daniel Vetter. This avoids a circular lock lock dependency as reported here https://patchwork.freedesktop.org/patch/440406/
Additionally, inside drm_is_current_master, instead of grabbing &fpriv->master->dev->master_mutex, we grab &fpriv->minor->dev->master_mutex to avoid dereferencing a null ptr if fpriv->master is not set.
- Patch 4:
Modify kerneldoc formatting.
Additionally, add a file_priv->master NULL check inside drm_file_get_master, and handle the NULL result accordingly in drm_lease.c. As suggested by Daniel Vetter.
Changes in v2 -> v3:
- Patch 3:
Move the definition of drm_is_current_master and the _locked version higher up in drm_auth.c to avoid needing a forward declaration of drm_is_current_master_locked. As suggested by Daniel Vetter.
- Patch 4:
Instead of leaking drm_device.master_mutex into drm_lease.c to protect drm_master pointers, add a new drm_file_get_master() function that returns drm_file->master while increasing its reference count, to prevent drm_file->master from being freed. As suggested by Daniel Vetter.
Changes in v1 -> v2:
- Patch 4:
Move the lock and assignment before the DRM_DEBUG_LEASE in drm_mode_get_lease_ioctl, as suggested by Emil Velikov.
Desmond Cheong Zhi Xi (4):
drm: avoid circular locks in drm_mode_getconnector
drm: avoid circular locks in __drm_mode_object_find
drm: add a locked version of drm_is_current_master
drm: protect drm_master pointers in drm_lease.c
drivers/gpu/drm/drm_auth.c | 76 +++++++++++++++++++++--------
drivers/gpu/drm/drm_connector.c | 5 +-
drivers/gpu/drm/drm_lease.c | 81 +++++++++++++++++++++++--------
drivers/gpu/drm/drm_mode_object.c | 10 ++--
include/drm/drm_auth.h | 1 +
include/drm/drm_file.h | 15 ++++--
6 files changed, 141 insertions(+), 47 deletions(-)
--
2.25.1
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
^ permalink raw reply [flat|nested] 23+ messages in thread
* [PATCH v6 1/4] drm: avoid circular locks in drm_mode_getconnector
2021-06-30 14:54 ` Desmond Cheong Zhi Xi
(?)
(?)
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
-1 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: Desmond Cheong Zhi Xi, dri-devel, intel-gfx, linux-kernel,
linux-media, linaro-mm-sig, skhan, gregkh, linux-kernel-mentees,
emil.l.velikov, Daniel Vetter
In preparation for a future patch to take a lock on
drm_device.master_mutex inside drm_is_current_master(), we first move
the call to drm_is_current_master() in drm_mode_getconnector out from the
section locked by &dev->mode_config.mutex. This avoids creating a
circular lock dependency.
Failing to avoid this lock dependency produces the following lockdep
splat:
======================================================
WARNING: possible circular locking dependency detected
5.13.0-rc7-CI-CI_DRM_10254+ #1 Not tainted
------------------------------------------------------
kms_frontbuffer/1087 is trying to acquire lock:
ffff88810dcd01a8 (&dev->master_mutex){+.+.}-{3:3}, at: drm_is_current_master+0x1b/0x40
but task is already holding lock:
ffff88810dcd0488 (&dev->mode_config.mutex){+.+.}-{3:3}, at: drm_mode_getconnector+0x1c6/0x4a0
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&dev->mode_config.mutex){+.+.}-{3:3}:
__mutex_lock+0xab/0x970
drm_client_modeset_probe+0x22e/0xca0
__drm_fb_helper_initial_config_and_unlock+0x42/0x540
intel_fbdev_initial_config+0xf/0x20 [i915]
async_run_entry_fn+0x28/0x130
process_one_work+0x26d/0x5c0
worker_thread+0x37/0x380
kthread+0x144/0x170
ret_from_fork+0x1f/0x30
-> #1 (&client->modeset_mutex){+.+.}-{3:3}:
__mutex_lock+0xab/0x970
drm_client_modeset_commit_locked+0x1c/0x180
drm_client_modeset_commit+0x1c/0x40
__drm_fb_helper_restore_fbdev_mode_unlocked+0x88/0xb0
drm_fb_helper_set_par+0x34/0x40
intel_fbdev_set_par+0x11/0x40 [i915]
fbcon_init+0x270/0x4f0
visual_init+0xc6/0x130
do_bind_con_driver+0x1e5/0x2d0
do_take_over_console+0x10e/0x180
do_fbcon_takeover+0x53/0xb0
register_framebuffer+0x22d/0x310
__drm_fb_helper_initial_config_and_unlock+0x36c/0x540
intel_fbdev_initial_config+0xf/0x20 [i915]
async_run_entry_fn+0x28/0x130
process_one_work+0x26d/0x5c0
worker_thread+0x37/0x380
kthread+0x144/0x170
ret_from_fork+0x1f/0x30
-> #0 (&dev->master_mutex){+.+.}-{3:3}:
__lock_acquire+0x151e/0x2590
lock_acquire+0xd1/0x3d0
__mutex_lock+0xab/0x970
drm_is_current_master+0x1b/0x40
drm_mode_getconnector+0x37e/0x4a0
drm_ioctl_kernel+0xa8/0xf0
drm_ioctl+0x1e8/0x390
__x64_sys_ioctl+0x6a/0xa0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
other info that might help us debug this:
Chain exists of: &dev->master_mutex --> &client->modeset_mutex --> &dev->mode_config.mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&dev->mode_config.mutex);
lock(&client->modeset_mutex);
lock(&dev->mode_config.mutex);
lock(&dev->master_mutex);
*** DEADLOCK ***
1 lock held by kms_frontbuffer/1087:
#0: ffff88810dcd0488 (&dev->mode_config.mutex){+.+.}-{3:3}, at: drm_mode_getconnector+0x1c6/0x4a0
stack backtrace:
CPU: 7 PID: 1087 Comm: kms_frontbuffer Not tainted 5.13.0-rc7-CI-CI_DRM_10254+ #1
Hardware name: Intel Corporation Ice Lake Client Platform/IceLake U DDR4 SODIMM PD RVP TLC, BIOS ICLSFWR1.R00.3234.A01.1906141750 06/14/2019
Call Trace:
dump_stack+0x7f/0xad
check_noncircular+0x12e/0x150
__lock_acquire+0x151e/0x2590
lock_acquire+0xd1/0x3d0
__mutex_lock+0xab/0x970
drm_is_current_master+0x1b/0x40
drm_mode_getconnector+0x37e/0x4a0
drm_ioctl_kernel+0xa8/0xf0
drm_ioctl+0x1e8/0x390
__x64_sys_ioctl+0x6a/0xa0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
---
drivers/gpu/drm/drm_connector.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index da39e7ff6965..2ba257b1ae20 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -2414,6 +2414,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
struct drm_mode_modeinfo u_mode;
struct drm_mode_modeinfo __user *mode_ptr;
uint32_t __user *encoder_ptr;
+ bool is_current_master;
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
@@ -2444,9 +2445,11 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
out_resp->connector_type = connector->connector_type;
out_resp->connector_type_id = connector->connector_type_id;
+ is_current_master = drm_is_current_master(file_priv);
+
mutex_lock(&dev->mode_config.mutex);
if (out_resp->count_modes == 0) {
- if (drm_is_current_master(file_priv))
+ if (is_current_master)
connector->funcs->fill_modes(connector,
dev->mode_config.max_width,
dev->mode_config.max_height);
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [Intel-gfx] [PATCH v6 1/4] drm: avoid circular locks in drm_mode_getconnector
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
0 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: Daniel Vetter, gregkh, intel-gfx, linux-kernel, dri-devel,
linaro-mm-sig, skhan, Desmond Cheong Zhi Xi,
linux-kernel-mentees, linux-media
In preparation for a future patch to take a lock on
drm_device.master_mutex inside drm_is_current_master(), we first move
the call to drm_is_current_master() in drm_mode_getconnector out from the
section locked by &dev->mode_config.mutex. This avoids creating a
circular lock dependency.
Failing to avoid this lock dependency produces the following lockdep
splat:
======================================================
WARNING: possible circular locking dependency detected
5.13.0-rc7-CI-CI_DRM_10254+ #1 Not tainted
------------------------------------------------------
kms_frontbuffer/1087 is trying to acquire lock:
ffff88810dcd01a8 (&dev->master_mutex){+.+.}-{3:3}, at: drm_is_current_master+0x1b/0x40
but task is already holding lock:
ffff88810dcd0488 (&dev->mode_config.mutex){+.+.}-{3:3}, at: drm_mode_getconnector+0x1c6/0x4a0
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&dev->mode_config.mutex){+.+.}-{3:3}:
__mutex_lock+0xab/0x970
drm_client_modeset_probe+0x22e/0xca0
__drm_fb_helper_initial_config_and_unlock+0x42/0x540
intel_fbdev_initial_config+0xf/0x20 [i915]
async_run_entry_fn+0x28/0x130
process_one_work+0x26d/0x5c0
worker_thread+0x37/0x380
kthread+0x144/0x170
ret_from_fork+0x1f/0x30
-> #1 (&client->modeset_mutex){+.+.}-{3:3}:
__mutex_lock+0xab/0x970
drm_client_modeset_commit_locked+0x1c/0x180
drm_client_modeset_commit+0x1c/0x40
__drm_fb_helper_restore_fbdev_mode_unlocked+0x88/0xb0
drm_fb_helper_set_par+0x34/0x40
intel_fbdev_set_par+0x11/0x40 [i915]
fbcon_init+0x270/0x4f0
visual_init+0xc6/0x130
do_bind_con_driver+0x1e5/0x2d0
do_take_over_console+0x10e/0x180
do_fbcon_takeover+0x53/0xb0
register_framebuffer+0x22d/0x310
__drm_fb_helper_initial_config_and_unlock+0x36c/0x540
intel_fbdev_initial_config+0xf/0x20 [i915]
async_run_entry_fn+0x28/0x130
process_one_work+0x26d/0x5c0
worker_thread+0x37/0x380
kthread+0x144/0x170
ret_from_fork+0x1f/0x30
-> #0 (&dev->master_mutex){+.+.}-{3:3}:
__lock_acquire+0x151e/0x2590
lock_acquire+0xd1/0x3d0
__mutex_lock+0xab/0x970
drm_is_current_master+0x1b/0x40
drm_mode_getconnector+0x37e/0x4a0
drm_ioctl_kernel+0xa8/0xf0
drm_ioctl+0x1e8/0x390
__x64_sys_ioctl+0x6a/0xa0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
other info that might help us debug this:
Chain exists of: &dev->master_mutex --> &client->modeset_mutex --> &dev->mode_config.mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&dev->mode_config.mutex);
lock(&client->modeset_mutex);
lock(&dev->mode_config.mutex);
lock(&dev->master_mutex);
*** DEADLOCK ***
1 lock held by kms_frontbuffer/1087:
#0: ffff88810dcd0488 (&dev->mode_config.mutex){+.+.}-{3:3}, at: drm_mode_getconnector+0x1c6/0x4a0
stack backtrace:
CPU: 7 PID: 1087 Comm: kms_frontbuffer Not tainted 5.13.0-rc7-CI-CI_DRM_10254+ #1
Hardware name: Intel Corporation Ice Lake Client Platform/IceLake U DDR4 SODIMM PD RVP TLC, BIOS ICLSFWR1.R00.3234.A01.1906141750 06/14/2019
Call Trace:
dump_stack+0x7f/0xad
check_noncircular+0x12e/0x150
__lock_acquire+0x151e/0x2590
lock_acquire+0xd1/0x3d0
__mutex_lock+0xab/0x970
drm_is_current_master+0x1b/0x40
drm_mode_getconnector+0x37e/0x4a0
drm_ioctl_kernel+0xa8/0xf0
drm_ioctl+0x1e8/0x390
__x64_sys_ioctl+0x6a/0xa0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
---
drivers/gpu/drm/drm_connector.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index da39e7ff6965..2ba257b1ae20 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -2414,6 +2414,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
struct drm_mode_modeinfo u_mode;
struct drm_mode_modeinfo __user *mode_ptr;
uint32_t __user *encoder_ptr;
+ bool is_current_master;
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
@@ -2444,9 +2445,11 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
out_resp->connector_type = connector->connector_type;
out_resp->connector_type_id = connector->connector_type_id;
+ is_current_master = drm_is_current_master(file_priv);
+
mutex_lock(&dev->mode_config.mutex);
if (out_resp->count_modes == 0) {
- if (drm_is_current_master(file_priv))
+ if (is_current_master)
connector->funcs->fill_modes(connector,
dev->mode_config.max_width,
dev->mode_config.max_height);
--
2.25.1
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 1/4] drm: avoid circular locks in drm_mode_getconnector
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
0 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: Daniel Vetter, gregkh, intel-gfx, emil.l.velikov, linux-kernel,
dri-devel, linaro-mm-sig, skhan, Desmond Cheong Zhi Xi,
linux-kernel-mentees, linux-media
In preparation for a future patch to take a lock on
drm_device.master_mutex inside drm_is_current_master(), we first move
the call to drm_is_current_master() in drm_mode_getconnector out from the
section locked by &dev->mode_config.mutex. This avoids creating a
circular lock dependency.
Failing to avoid this lock dependency produces the following lockdep
splat:
======================================================
WARNING: possible circular locking dependency detected
5.13.0-rc7-CI-CI_DRM_10254+ #1 Not tainted
------------------------------------------------------
kms_frontbuffer/1087 is trying to acquire lock:
ffff88810dcd01a8 (&dev->master_mutex){+.+.}-{3:3}, at: drm_is_current_master+0x1b/0x40
but task is already holding lock:
ffff88810dcd0488 (&dev->mode_config.mutex){+.+.}-{3:3}, at: drm_mode_getconnector+0x1c6/0x4a0
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&dev->mode_config.mutex){+.+.}-{3:3}:
__mutex_lock+0xab/0x970
drm_client_modeset_probe+0x22e/0xca0
__drm_fb_helper_initial_config_and_unlock+0x42/0x540
intel_fbdev_initial_config+0xf/0x20 [i915]
async_run_entry_fn+0x28/0x130
process_one_work+0x26d/0x5c0
worker_thread+0x37/0x380
kthread+0x144/0x170
ret_from_fork+0x1f/0x30
-> #1 (&client->modeset_mutex){+.+.}-{3:3}:
__mutex_lock+0xab/0x970
drm_client_modeset_commit_locked+0x1c/0x180
drm_client_modeset_commit+0x1c/0x40
__drm_fb_helper_restore_fbdev_mode_unlocked+0x88/0xb0
drm_fb_helper_set_par+0x34/0x40
intel_fbdev_set_par+0x11/0x40 [i915]
fbcon_init+0x270/0x4f0
visual_init+0xc6/0x130
do_bind_con_driver+0x1e5/0x2d0
do_take_over_console+0x10e/0x180
do_fbcon_takeover+0x53/0xb0
register_framebuffer+0x22d/0x310
__drm_fb_helper_initial_config_and_unlock+0x36c/0x540
intel_fbdev_initial_config+0xf/0x20 [i915]
async_run_entry_fn+0x28/0x130
process_one_work+0x26d/0x5c0
worker_thread+0x37/0x380
kthread+0x144/0x170
ret_from_fork+0x1f/0x30
-> #0 (&dev->master_mutex){+.+.}-{3:3}:
__lock_acquire+0x151e/0x2590
lock_acquire+0xd1/0x3d0
__mutex_lock+0xab/0x970
drm_is_current_master+0x1b/0x40
drm_mode_getconnector+0x37e/0x4a0
drm_ioctl_kernel+0xa8/0xf0
drm_ioctl+0x1e8/0x390
__x64_sys_ioctl+0x6a/0xa0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
other info that might help us debug this:
Chain exists of: &dev->master_mutex --> &client->modeset_mutex --> &dev->mode_config.mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&dev->mode_config.mutex);
lock(&client->modeset_mutex);
lock(&dev->mode_config.mutex);
lock(&dev->master_mutex);
*** DEADLOCK ***
1 lock held by kms_frontbuffer/1087:
#0: ffff88810dcd0488 (&dev->mode_config.mutex){+.+.}-{3:3}, at: drm_mode_getconnector+0x1c6/0x4a0
stack backtrace:
CPU: 7 PID: 1087 Comm: kms_frontbuffer Not tainted 5.13.0-rc7-CI-CI_DRM_10254+ #1
Hardware name: Intel Corporation Ice Lake Client Platform/IceLake U DDR4 SODIMM PD RVP TLC, BIOS ICLSFWR1.R00.3234.A01.1906141750 06/14/2019
Call Trace:
dump_stack+0x7f/0xad
check_noncircular+0x12e/0x150
__lock_acquire+0x151e/0x2590
lock_acquire+0xd1/0x3d0
__mutex_lock+0xab/0x970
drm_is_current_master+0x1b/0x40
drm_mode_getconnector+0x37e/0x4a0
drm_ioctl_kernel+0xa8/0xf0
drm_ioctl+0x1e8/0x390
__x64_sys_ioctl+0x6a/0xa0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
---
drivers/gpu/drm/drm_connector.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index da39e7ff6965..2ba257b1ae20 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -2414,6 +2414,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
struct drm_mode_modeinfo u_mode;
struct drm_mode_modeinfo __user *mode_ptr;
uint32_t __user *encoder_ptr;
+ bool is_current_master;
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
@@ -2444,9 +2445,11 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
out_resp->connector_type = connector->connector_type;
out_resp->connector_type_id = connector->connector_type_id;
+ is_current_master = drm_is_current_master(file_priv);
+
mutex_lock(&dev->mode_config.mutex);
if (out_resp->count_modes == 0) {
- if (drm_is_current_master(file_priv))
+ if (is_current_master)
connector->funcs->fill_modes(connector,
dev->mode_config.max_width,
dev->mode_config.max_height);
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 1/4] drm: avoid circular locks in drm_mode_getconnector
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
0 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: Daniel Vetter, intel-gfx, emil.l.velikov, linux-kernel,
dri-devel, linaro-mm-sig, Desmond Cheong Zhi Xi,
linux-kernel-mentees, linux-media
In preparation for a future patch to take a lock on
drm_device.master_mutex inside drm_is_current_master(), we first move
the call to drm_is_current_master() in drm_mode_getconnector out from the
section locked by &dev->mode_config.mutex. This avoids creating a
circular lock dependency.
Failing to avoid this lock dependency produces the following lockdep
splat:
======================================================
WARNING: possible circular locking dependency detected
5.13.0-rc7-CI-CI_DRM_10254+ #1 Not tainted
------------------------------------------------------
kms_frontbuffer/1087 is trying to acquire lock:
ffff88810dcd01a8 (&dev->master_mutex){+.+.}-{3:3}, at: drm_is_current_master+0x1b/0x40
but task is already holding lock:
ffff88810dcd0488 (&dev->mode_config.mutex){+.+.}-{3:3}, at: drm_mode_getconnector+0x1c6/0x4a0
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&dev->mode_config.mutex){+.+.}-{3:3}:
__mutex_lock+0xab/0x970
drm_client_modeset_probe+0x22e/0xca0
__drm_fb_helper_initial_config_and_unlock+0x42/0x540
intel_fbdev_initial_config+0xf/0x20 [i915]
async_run_entry_fn+0x28/0x130
process_one_work+0x26d/0x5c0
worker_thread+0x37/0x380
kthread+0x144/0x170
ret_from_fork+0x1f/0x30
-> #1 (&client->modeset_mutex){+.+.}-{3:3}:
__mutex_lock+0xab/0x970
drm_client_modeset_commit_locked+0x1c/0x180
drm_client_modeset_commit+0x1c/0x40
__drm_fb_helper_restore_fbdev_mode_unlocked+0x88/0xb0
drm_fb_helper_set_par+0x34/0x40
intel_fbdev_set_par+0x11/0x40 [i915]
fbcon_init+0x270/0x4f0
visual_init+0xc6/0x130
do_bind_con_driver+0x1e5/0x2d0
do_take_over_console+0x10e/0x180
do_fbcon_takeover+0x53/0xb0
register_framebuffer+0x22d/0x310
__drm_fb_helper_initial_config_and_unlock+0x36c/0x540
intel_fbdev_initial_config+0xf/0x20 [i915]
async_run_entry_fn+0x28/0x130
process_one_work+0x26d/0x5c0
worker_thread+0x37/0x380
kthread+0x144/0x170
ret_from_fork+0x1f/0x30
-> #0 (&dev->master_mutex){+.+.}-{3:3}:
__lock_acquire+0x151e/0x2590
lock_acquire+0xd1/0x3d0
__mutex_lock+0xab/0x970
drm_is_current_master+0x1b/0x40
drm_mode_getconnector+0x37e/0x4a0
drm_ioctl_kernel+0xa8/0xf0
drm_ioctl+0x1e8/0x390
__x64_sys_ioctl+0x6a/0xa0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
other info that might help us debug this:
Chain exists of: &dev->master_mutex --> &client->modeset_mutex --> &dev->mode_config.mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&dev->mode_config.mutex);
lock(&client->modeset_mutex);
lock(&dev->mode_config.mutex);
lock(&dev->master_mutex);
*** DEADLOCK ***
1 lock held by kms_frontbuffer/1087:
#0: ffff88810dcd0488 (&dev->mode_config.mutex){+.+.}-{3:3}, at: drm_mode_getconnector+0x1c6/0x4a0
stack backtrace:
CPU: 7 PID: 1087 Comm: kms_frontbuffer Not tainted 5.13.0-rc7-CI-CI_DRM_10254+ #1
Hardware name: Intel Corporation Ice Lake Client Platform/IceLake U DDR4 SODIMM PD RVP TLC, BIOS ICLSFWR1.R00.3234.A01.1906141750 06/14/2019
Call Trace:
dump_stack+0x7f/0xad
check_noncircular+0x12e/0x150
__lock_acquire+0x151e/0x2590
lock_acquire+0xd1/0x3d0
__mutex_lock+0xab/0x970
drm_is_current_master+0x1b/0x40
drm_mode_getconnector+0x37e/0x4a0
drm_ioctl_kernel+0xa8/0xf0
drm_ioctl+0x1e8/0x390
__x64_sys_ioctl+0x6a/0xa0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
---
drivers/gpu/drm/drm_connector.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index da39e7ff6965..2ba257b1ae20 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -2414,6 +2414,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
struct drm_mode_modeinfo u_mode;
struct drm_mode_modeinfo __user *mode_ptr;
uint32_t __user *encoder_ptr;
+ bool is_current_master;
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
@@ -2444,9 +2445,11 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
out_resp->connector_type = connector->connector_type;
out_resp->connector_type_id = connector->connector_type_id;
+ is_current_master = drm_is_current_master(file_priv);
+
mutex_lock(&dev->mode_config.mutex);
if (out_resp->count_modes == 0) {
- if (drm_is_current_master(file_priv))
+ if (is_current_master)
connector->funcs->fill_modes(connector,
dev->mode_config.max_width,
dev->mode_config.max_height);
--
2.25.1
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 2/4] drm: avoid circular locks in __drm_mode_object_find
2021-06-30 14:54 ` Desmond Cheong Zhi Xi
(?)
(?)
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
-1 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: Desmond Cheong Zhi Xi, dri-devel, intel-gfx, linux-kernel,
linux-media, linaro-mm-sig, skhan, gregkh, linux-kernel-mentees,
emil.l.velikov
In a future patch, _drm_lease_held will dereference drm_file->master
only after making a call to drm_file_get_master which increments the
reference count of drm_file->master while holding a lock on
drm_device.master_mutex.
In preparation for this, the call to _drm_lease_held should be moved
out from the section locked by &dev->mode_config.idr_mutex. This
avoids inverting the lock hierarchy for
&dev->master_mutex --> &dev->mode_config.idr_mutex
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
---
drivers/gpu/drm/drm_mode_object.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/drm_mode_object.c b/drivers/gpu/drm/drm_mode_object.c
index b26588b52795..63d35f1f98dd 100644
--- a/drivers/gpu/drm/drm_mode_object.c
+++ b/drivers/gpu/drm/drm_mode_object.c
@@ -146,16 +146,18 @@ struct drm_mode_object *__drm_mode_object_find(struct drm_device *dev,
if (obj && obj->id != id)
obj = NULL;
- if (obj && drm_mode_object_lease_required(obj->type) &&
- !_drm_lease_held(file_priv, obj->id))
- obj = NULL;
-
if (obj && obj->free_cb) {
if (!kref_get_unless_zero(&obj->refcount))
obj = NULL;
}
mutex_unlock(&dev->mode_config.idr_mutex);
+ if (obj && drm_mode_object_lease_required(obj->type) &&
+ !_drm_lease_held(file_priv, obj->id)) {
+ drm_mode_object_put(obj);
+ obj = NULL;
+ }
+
return obj;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [Intel-gfx] [PATCH v6 2/4] drm: avoid circular locks in __drm_mode_object_find
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
0 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: gregkh, intel-gfx, linux-kernel, dri-devel, linaro-mm-sig, skhan,
Desmond Cheong Zhi Xi, linux-kernel-mentees, linux-media
In a future patch, _drm_lease_held will dereference drm_file->master
only after making a call to drm_file_get_master which increments the
reference count of drm_file->master while holding a lock on
drm_device.master_mutex.
In preparation for this, the call to _drm_lease_held should be moved
out from the section locked by &dev->mode_config.idr_mutex. This
avoids inverting the lock hierarchy for
&dev->master_mutex --> &dev->mode_config.idr_mutex
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
---
drivers/gpu/drm/drm_mode_object.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/drm_mode_object.c b/drivers/gpu/drm/drm_mode_object.c
index b26588b52795..63d35f1f98dd 100644
--- a/drivers/gpu/drm/drm_mode_object.c
+++ b/drivers/gpu/drm/drm_mode_object.c
@@ -146,16 +146,18 @@ struct drm_mode_object *__drm_mode_object_find(struct drm_device *dev,
if (obj && obj->id != id)
obj = NULL;
- if (obj && drm_mode_object_lease_required(obj->type) &&
- !_drm_lease_held(file_priv, obj->id))
- obj = NULL;
-
if (obj && obj->free_cb) {
if (!kref_get_unless_zero(&obj->refcount))
obj = NULL;
}
mutex_unlock(&dev->mode_config.idr_mutex);
+ if (obj && drm_mode_object_lease_required(obj->type) &&
+ !_drm_lease_held(file_priv, obj->id)) {
+ drm_mode_object_put(obj);
+ obj = NULL;
+ }
+
return obj;
}
--
2.25.1
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 2/4] drm: avoid circular locks in __drm_mode_object_find
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
0 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: gregkh, intel-gfx, emil.l.velikov, linux-kernel, dri-devel,
linaro-mm-sig, skhan, Desmond Cheong Zhi Xi,
linux-kernel-mentees, linux-media
In a future patch, _drm_lease_held will dereference drm_file->master
only after making a call to drm_file_get_master which increments the
reference count of drm_file->master while holding a lock on
drm_device.master_mutex.
In preparation for this, the call to _drm_lease_held should be moved
out from the section locked by &dev->mode_config.idr_mutex. This
avoids inverting the lock hierarchy for
&dev->master_mutex --> &dev->mode_config.idr_mutex
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
---
drivers/gpu/drm/drm_mode_object.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/drm_mode_object.c b/drivers/gpu/drm/drm_mode_object.c
index b26588b52795..63d35f1f98dd 100644
--- a/drivers/gpu/drm/drm_mode_object.c
+++ b/drivers/gpu/drm/drm_mode_object.c
@@ -146,16 +146,18 @@ struct drm_mode_object *__drm_mode_object_find(struct drm_device *dev,
if (obj && obj->id != id)
obj = NULL;
- if (obj && drm_mode_object_lease_required(obj->type) &&
- !_drm_lease_held(file_priv, obj->id))
- obj = NULL;
-
if (obj && obj->free_cb) {
if (!kref_get_unless_zero(&obj->refcount))
obj = NULL;
}
mutex_unlock(&dev->mode_config.idr_mutex);
+ if (obj && drm_mode_object_lease_required(obj->type) &&
+ !_drm_lease_held(file_priv, obj->id)) {
+ drm_mode_object_put(obj);
+ obj = NULL;
+ }
+
return obj;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 2/4] drm: avoid circular locks in __drm_mode_object_find
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
0 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: intel-gfx, emil.l.velikov, linux-kernel, dri-devel,
linaro-mm-sig, Desmond Cheong Zhi Xi, linux-kernel-mentees,
linux-media
In a future patch, _drm_lease_held will dereference drm_file->master
only after making a call to drm_file_get_master which increments the
reference count of drm_file->master while holding a lock on
drm_device.master_mutex.
In preparation for this, the call to _drm_lease_held should be moved
out from the section locked by &dev->mode_config.idr_mutex. This
avoids inverting the lock hierarchy for
&dev->master_mutex --> &dev->mode_config.idr_mutex
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
---
drivers/gpu/drm/drm_mode_object.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/drm_mode_object.c b/drivers/gpu/drm/drm_mode_object.c
index b26588b52795..63d35f1f98dd 100644
--- a/drivers/gpu/drm/drm_mode_object.c
+++ b/drivers/gpu/drm/drm_mode_object.c
@@ -146,16 +146,18 @@ struct drm_mode_object *__drm_mode_object_find(struct drm_device *dev,
if (obj && obj->id != id)
obj = NULL;
- if (obj && drm_mode_object_lease_required(obj->type) &&
- !_drm_lease_held(file_priv, obj->id))
- obj = NULL;
-
if (obj && obj->free_cb) {
if (!kref_get_unless_zero(&obj->refcount))
obj = NULL;
}
mutex_unlock(&dev->mode_config.idr_mutex);
+ if (obj && drm_mode_object_lease_required(obj->type) &&
+ !_drm_lease_held(file_priv, obj->id)) {
+ drm_mode_object_put(obj);
+ obj = NULL;
+ }
+
return obj;
}
--
2.25.1
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 3/4] drm: add a locked version of drm_is_current_master
2021-06-30 14:54 ` Desmond Cheong Zhi Xi
(?)
(?)
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
-1 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: Desmond Cheong Zhi Xi, dri-devel, intel-gfx, linux-kernel,
linux-media, linaro-mm-sig, skhan, gregkh, linux-kernel-mentees,
emil.l.velikov, Daniel Vetter
While checking the master status of the DRM file in
drm_is_current_master(), the device's master mutex should be
held. Without the mutex, the pointer fpriv->master may be freed
concurrently by another process calling drm_setmaster_ioctl(). This
could lead to use-after-free errors when the pointer is subsequently
dereferenced in drm_lease_owner().
The callers of drm_is_current_master() from drm_auth.c hold the
device's master mutex, but external callers do not. Hence, we implement
drm_is_current_master_locked() to be used within drm_auth.c, and
modify drm_is_current_master() to grab the device's master mutex
before checking the master status.
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
---
drivers/gpu/drm/drm_auth.c | 51 ++++++++++++++++++++++++--------------
1 file changed, 32 insertions(+), 19 deletions(-)
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index f00e5abdbbf4..ab1863c5a5a0 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -61,6 +61,35 @@
* trusted clients.
*/
+static bool drm_is_current_master_locked(struct drm_file *fpriv)
+{
+ lockdep_assert_held_once(&fpriv->minor->dev->master_mutex);
+
+ return fpriv->is_master && drm_lease_owner(fpriv->master) == fpriv->minor->dev->master;
+}
+
+/**
+ * drm_is_current_master - checks whether @priv is the current master
+ * @fpriv: DRM file private
+ *
+ * Checks whether @fpriv is current master on its device. This decides whether a
+ * client is allowed to run DRM_MASTER IOCTLs.
+ *
+ * Most of the modern IOCTL which require DRM_MASTER are for kernel modesetting
+ * - the current master is assumed to own the non-shareable display hardware.
+ */
+bool drm_is_current_master(struct drm_file *fpriv)
+{
+ bool ret;
+
+ mutex_lock(&fpriv->minor->dev->master_mutex);
+ ret = drm_is_current_master_locked(fpriv);
+ mutex_unlock(&fpriv->minor->dev->master_mutex);
+
+ return ret;
+}
+EXPORT_SYMBOL(drm_is_current_master);
+
int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
{
struct drm_auth *auth = data;
@@ -223,7 +252,7 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data,
if (ret)
goto out_unlock;
- if (drm_is_current_master(file_priv))
+ if (drm_is_current_master_locked(file_priv))
goto out_unlock;
if (dev->master) {
@@ -272,7 +301,7 @@ int drm_dropmaster_ioctl(struct drm_device *dev, void *data,
if (ret)
goto out_unlock;
- if (!drm_is_current_master(file_priv)) {
+ if (!drm_is_current_master_locked(file_priv)) {
ret = -EINVAL;
goto out_unlock;
}
@@ -321,7 +350,7 @@ void drm_master_release(struct drm_file *file_priv)
if (file_priv->magic)
idr_remove(&file_priv->master->magic_map, file_priv->magic);
- if (!drm_is_current_master(file_priv))
+ if (!drm_is_current_master_locked(file_priv))
goto out;
drm_legacy_lock_master_cleanup(dev, master);
@@ -342,22 +371,6 @@ void drm_master_release(struct drm_file *file_priv)
mutex_unlock(&dev->master_mutex);
}
-/**
- * drm_is_current_master - checks whether @priv is the current master
- * @fpriv: DRM file private
- *
- * Checks whether @fpriv is current master on its device. This decides whether a
- * client is allowed to run DRM_MASTER IOCTLs.
- *
- * Most of the modern IOCTL which require DRM_MASTER are for kernel modesetting
- * - the current master is assumed to own the non-shareable display hardware.
- */
-bool drm_is_current_master(struct drm_file *fpriv)
-{
- return fpriv->is_master && drm_lease_owner(fpriv->master) == fpriv->minor->dev->master;
-}
-EXPORT_SYMBOL(drm_is_current_master);
-
/**
* drm_master_get - reference a master pointer
* @master: &struct drm_master
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [Intel-gfx] [PATCH v6 3/4] drm: add a locked version of drm_is_current_master
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
0 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: Daniel Vetter, gregkh, intel-gfx, linux-kernel, dri-devel,
linaro-mm-sig, skhan, Desmond Cheong Zhi Xi,
linux-kernel-mentees, linux-media
While checking the master status of the DRM file in
drm_is_current_master(), the device's master mutex should be
held. Without the mutex, the pointer fpriv->master may be freed
concurrently by another process calling drm_setmaster_ioctl(). This
could lead to use-after-free errors when the pointer is subsequently
dereferenced in drm_lease_owner().
The callers of drm_is_current_master() from drm_auth.c hold the
device's master mutex, but external callers do not. Hence, we implement
drm_is_current_master_locked() to be used within drm_auth.c, and
modify drm_is_current_master() to grab the device's master mutex
before checking the master status.
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
---
drivers/gpu/drm/drm_auth.c | 51 ++++++++++++++++++++++++--------------
1 file changed, 32 insertions(+), 19 deletions(-)
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index f00e5abdbbf4..ab1863c5a5a0 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -61,6 +61,35 @@
* trusted clients.
*/
+static bool drm_is_current_master_locked(struct drm_file *fpriv)
+{
+ lockdep_assert_held_once(&fpriv->minor->dev->master_mutex);
+
+ return fpriv->is_master && drm_lease_owner(fpriv->master) == fpriv->minor->dev->master;
+}
+
+/**
+ * drm_is_current_master - checks whether @priv is the current master
+ * @fpriv: DRM file private
+ *
+ * Checks whether @fpriv is current master on its device. This decides whether a
+ * client is allowed to run DRM_MASTER IOCTLs.
+ *
+ * Most of the modern IOCTL which require DRM_MASTER are for kernel modesetting
+ * - the current master is assumed to own the non-shareable display hardware.
+ */
+bool drm_is_current_master(struct drm_file *fpriv)
+{
+ bool ret;
+
+ mutex_lock(&fpriv->minor->dev->master_mutex);
+ ret = drm_is_current_master_locked(fpriv);
+ mutex_unlock(&fpriv->minor->dev->master_mutex);
+
+ return ret;
+}
+EXPORT_SYMBOL(drm_is_current_master);
+
int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
{
struct drm_auth *auth = data;
@@ -223,7 +252,7 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data,
if (ret)
goto out_unlock;
- if (drm_is_current_master(file_priv))
+ if (drm_is_current_master_locked(file_priv))
goto out_unlock;
if (dev->master) {
@@ -272,7 +301,7 @@ int drm_dropmaster_ioctl(struct drm_device *dev, void *data,
if (ret)
goto out_unlock;
- if (!drm_is_current_master(file_priv)) {
+ if (!drm_is_current_master_locked(file_priv)) {
ret = -EINVAL;
goto out_unlock;
}
@@ -321,7 +350,7 @@ void drm_master_release(struct drm_file *file_priv)
if (file_priv->magic)
idr_remove(&file_priv->master->magic_map, file_priv->magic);
- if (!drm_is_current_master(file_priv))
+ if (!drm_is_current_master_locked(file_priv))
goto out;
drm_legacy_lock_master_cleanup(dev, master);
@@ -342,22 +371,6 @@ void drm_master_release(struct drm_file *file_priv)
mutex_unlock(&dev->master_mutex);
}
-/**
- * drm_is_current_master - checks whether @priv is the current master
- * @fpriv: DRM file private
- *
- * Checks whether @fpriv is current master on its device. This decides whether a
- * client is allowed to run DRM_MASTER IOCTLs.
- *
- * Most of the modern IOCTL which require DRM_MASTER are for kernel modesetting
- * - the current master is assumed to own the non-shareable display hardware.
- */
-bool drm_is_current_master(struct drm_file *fpriv)
-{
- return fpriv->is_master && drm_lease_owner(fpriv->master) == fpriv->minor->dev->master;
-}
-EXPORT_SYMBOL(drm_is_current_master);
-
/**
* drm_master_get - reference a master pointer
* @master: &struct drm_master
--
2.25.1
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 3/4] drm: add a locked version of drm_is_current_master
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
0 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: Daniel Vetter, gregkh, intel-gfx, emil.l.velikov, linux-kernel,
dri-devel, linaro-mm-sig, skhan, Desmond Cheong Zhi Xi,
linux-kernel-mentees, linux-media
While checking the master status of the DRM file in
drm_is_current_master(), the device's master mutex should be
held. Without the mutex, the pointer fpriv->master may be freed
concurrently by another process calling drm_setmaster_ioctl(). This
could lead to use-after-free errors when the pointer is subsequently
dereferenced in drm_lease_owner().
The callers of drm_is_current_master() from drm_auth.c hold the
device's master mutex, but external callers do not. Hence, we implement
drm_is_current_master_locked() to be used within drm_auth.c, and
modify drm_is_current_master() to grab the device's master mutex
before checking the master status.
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
---
drivers/gpu/drm/drm_auth.c | 51 ++++++++++++++++++++++++--------------
1 file changed, 32 insertions(+), 19 deletions(-)
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index f00e5abdbbf4..ab1863c5a5a0 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -61,6 +61,35 @@
* trusted clients.
*/
+static bool drm_is_current_master_locked(struct drm_file *fpriv)
+{
+ lockdep_assert_held_once(&fpriv->minor->dev->master_mutex);
+
+ return fpriv->is_master && drm_lease_owner(fpriv->master) == fpriv->minor->dev->master;
+}
+
+/**
+ * drm_is_current_master - checks whether @priv is the current master
+ * @fpriv: DRM file private
+ *
+ * Checks whether @fpriv is current master on its device. This decides whether a
+ * client is allowed to run DRM_MASTER IOCTLs.
+ *
+ * Most of the modern IOCTL which require DRM_MASTER are for kernel modesetting
+ * - the current master is assumed to own the non-shareable display hardware.
+ */
+bool drm_is_current_master(struct drm_file *fpriv)
+{
+ bool ret;
+
+ mutex_lock(&fpriv->minor->dev->master_mutex);
+ ret = drm_is_current_master_locked(fpriv);
+ mutex_unlock(&fpriv->minor->dev->master_mutex);
+
+ return ret;
+}
+EXPORT_SYMBOL(drm_is_current_master);
+
int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
{
struct drm_auth *auth = data;
@@ -223,7 +252,7 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data,
if (ret)
goto out_unlock;
- if (drm_is_current_master(file_priv))
+ if (drm_is_current_master_locked(file_priv))
goto out_unlock;
if (dev->master) {
@@ -272,7 +301,7 @@ int drm_dropmaster_ioctl(struct drm_device *dev, void *data,
if (ret)
goto out_unlock;
- if (!drm_is_current_master(file_priv)) {
+ if (!drm_is_current_master_locked(file_priv)) {
ret = -EINVAL;
goto out_unlock;
}
@@ -321,7 +350,7 @@ void drm_master_release(struct drm_file *file_priv)
if (file_priv->magic)
idr_remove(&file_priv->master->magic_map, file_priv->magic);
- if (!drm_is_current_master(file_priv))
+ if (!drm_is_current_master_locked(file_priv))
goto out;
drm_legacy_lock_master_cleanup(dev, master);
@@ -342,22 +371,6 @@ void drm_master_release(struct drm_file *file_priv)
mutex_unlock(&dev->master_mutex);
}
-/**
- * drm_is_current_master - checks whether @priv is the current master
- * @fpriv: DRM file private
- *
- * Checks whether @fpriv is current master on its device. This decides whether a
- * client is allowed to run DRM_MASTER IOCTLs.
- *
- * Most of the modern IOCTL which require DRM_MASTER are for kernel modesetting
- * - the current master is assumed to own the non-shareable display hardware.
- */
-bool drm_is_current_master(struct drm_file *fpriv)
-{
- return fpriv->is_master && drm_lease_owner(fpriv->master) == fpriv->minor->dev->master;
-}
-EXPORT_SYMBOL(drm_is_current_master);
-
/**
* drm_master_get - reference a master pointer
* @master: &struct drm_master
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 3/4] drm: add a locked version of drm_is_current_master
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
0 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: Daniel Vetter, intel-gfx, emil.l.velikov, linux-kernel,
dri-devel, linaro-mm-sig, Desmond Cheong Zhi Xi,
linux-kernel-mentees, linux-media
While checking the master status of the DRM file in
drm_is_current_master(), the device's master mutex should be
held. Without the mutex, the pointer fpriv->master may be freed
concurrently by another process calling drm_setmaster_ioctl(). This
could lead to use-after-free errors when the pointer is subsequently
dereferenced in drm_lease_owner().
The callers of drm_is_current_master() from drm_auth.c hold the
device's master mutex, but external callers do not. Hence, we implement
drm_is_current_master_locked() to be used within drm_auth.c, and
modify drm_is_current_master() to grab the device's master mutex
before checking the master status.
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
---
drivers/gpu/drm/drm_auth.c | 51 ++++++++++++++++++++++++--------------
1 file changed, 32 insertions(+), 19 deletions(-)
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index f00e5abdbbf4..ab1863c5a5a0 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -61,6 +61,35 @@
* trusted clients.
*/
+static bool drm_is_current_master_locked(struct drm_file *fpriv)
+{
+ lockdep_assert_held_once(&fpriv->minor->dev->master_mutex);
+
+ return fpriv->is_master && drm_lease_owner(fpriv->master) == fpriv->minor->dev->master;
+}
+
+/**
+ * drm_is_current_master - checks whether @priv is the current master
+ * @fpriv: DRM file private
+ *
+ * Checks whether @fpriv is current master on its device. This decides whether a
+ * client is allowed to run DRM_MASTER IOCTLs.
+ *
+ * Most of the modern IOCTL which require DRM_MASTER are for kernel modesetting
+ * - the current master is assumed to own the non-shareable display hardware.
+ */
+bool drm_is_current_master(struct drm_file *fpriv)
+{
+ bool ret;
+
+ mutex_lock(&fpriv->minor->dev->master_mutex);
+ ret = drm_is_current_master_locked(fpriv);
+ mutex_unlock(&fpriv->minor->dev->master_mutex);
+
+ return ret;
+}
+EXPORT_SYMBOL(drm_is_current_master);
+
int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
{
struct drm_auth *auth = data;
@@ -223,7 +252,7 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data,
if (ret)
goto out_unlock;
- if (drm_is_current_master(file_priv))
+ if (drm_is_current_master_locked(file_priv))
goto out_unlock;
if (dev->master) {
@@ -272,7 +301,7 @@ int drm_dropmaster_ioctl(struct drm_device *dev, void *data,
if (ret)
goto out_unlock;
- if (!drm_is_current_master(file_priv)) {
+ if (!drm_is_current_master_locked(file_priv)) {
ret = -EINVAL;
goto out_unlock;
}
@@ -321,7 +350,7 @@ void drm_master_release(struct drm_file *file_priv)
if (file_priv->magic)
idr_remove(&file_priv->master->magic_map, file_priv->magic);
- if (!drm_is_current_master(file_priv))
+ if (!drm_is_current_master_locked(file_priv))
goto out;
drm_legacy_lock_master_cleanup(dev, master);
@@ -342,22 +371,6 @@ void drm_master_release(struct drm_file *file_priv)
mutex_unlock(&dev->master_mutex);
}
-/**
- * drm_is_current_master - checks whether @priv is the current master
- * @fpriv: DRM file private
- *
- * Checks whether @fpriv is current master on its device. This decides whether a
- * client is allowed to run DRM_MASTER IOCTLs.
- *
- * Most of the modern IOCTL which require DRM_MASTER are for kernel modesetting
- * - the current master is assumed to own the non-shareable display hardware.
- */
-bool drm_is_current_master(struct drm_file *fpriv)
-{
- return fpriv->is_master && drm_lease_owner(fpriv->master) == fpriv->minor->dev->master;
-}
-EXPORT_SYMBOL(drm_is_current_master);
-
/**
* drm_master_get - reference a master pointer
* @master: &struct drm_master
--
2.25.1
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 4/4] drm: protect drm_master pointers in drm_lease.c
2021-06-30 14:54 ` Desmond Cheong Zhi Xi
(?)
(?)
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
-1 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: Desmond Cheong Zhi Xi, dri-devel, intel-gfx, linux-kernel,
linux-media, linaro-mm-sig, skhan, gregkh, linux-kernel-mentees,
emil.l.velikov, Daniel Vetter
Currently, direct copies of drm_file->master pointers should be
protected by drm_device.master_mutex when being dereferenced. This is
because drm_file->master is not invariant for the lifetime of
drm_file. If drm_file is not the creator of master, then
drm_file->is_master is false, and a call to drm_setmaster_ioctl will
invoke drm_new_set_master, which then allocates a new master for
drm_file and puts the old master.
Thus, without holding drm_device.master_mutex, the old value of
drm_file->master could be freed while it is being used by another
concurrent process.
In drm_lease.c, there are multiple instances where drm_file->master is
accessed and dereferenced while drm_device.master_mutex is not
held. This makes drm_lease.c vulnerable to use-after-free bugs.
We address this issue in 3 ways:
1. Clarify in the kerneldoc that drm_file->master is protected by
drm_device.master_mutex.
2. Add a new drm_file_get_master() function that calls drm_master_get
on drm_file->master while holding on to drm_device.master_mutex. Since
drm_master_get increments the reference count of master, this
prevents master from being freed until we unreference it with
drm_master_put.
3. In each case where drm_file->master is directly accessed and
eventually dereferenced in drm_lease.c, we wrap the access in a call
to the new drm_file_get_master function, then unreference the master
pointer once we are done using it.
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
---
drivers/gpu/drm/drm_auth.c | 25 ++++++++++++
drivers/gpu/drm/drm_lease.c | 81 ++++++++++++++++++++++++++++---------
include/drm/drm_auth.h | 1 +
include/drm/drm_file.h | 15 +++++--
4 files changed, 99 insertions(+), 23 deletions(-)
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index ab1863c5a5a0..c36a0b72be26 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -384,6 +384,31 @@ struct drm_master *drm_master_get(struct drm_master *master)
}
EXPORT_SYMBOL(drm_master_get);
+/**
+ * drm_file_get_master - reference &drm_file.master of @file_priv
+ * @file_priv: DRM file private
+ *
+ * Increments the reference count of @file_priv's &drm_file.master and returns
+ * the &drm_file.master. If @file_priv has no &drm_file.master, returns NULL.
+ *
+ * Master pointers returned from this function should be unreferenced using
+ * drm_master_put().
+ */
+struct drm_master *drm_file_get_master(struct drm_file *file_priv)
+{
+ struct drm_master *master = NULL;
+
+ mutex_lock(&file_priv->minor->dev->master_mutex);
+ if (!file_priv->master)
+ goto unlock;
+ master = drm_master_get(file_priv->master);
+
+unlock:
+ mutex_unlock(&file_priv->minor->dev->master_mutex);
+ return master;
+}
+EXPORT_SYMBOL(drm_file_get_master);
+
static void drm_master_destroy(struct kref *kref)
{
struct drm_master *master = container_of(kref, struct drm_master, refcount);
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index 00fb433bcef1..92eac73d9001 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -106,10 +106,19 @@ static bool _drm_has_leased(struct drm_master *master, int id)
*/
bool _drm_lease_held(struct drm_file *file_priv, int id)
{
- if (!file_priv || !file_priv->master)
+ bool ret;
+ struct drm_master *master;
+
+ if (!file_priv)
return true;
- return _drm_lease_held_master(file_priv->master, id);
+ master = drm_file_get_master(file_priv);
+ if (!master)
+ return true;
+ ret = _drm_lease_held_master(master, id);
+ drm_master_put(&master);
+
+ return ret;
}
/**
@@ -128,13 +137,22 @@ bool drm_lease_held(struct drm_file *file_priv, int id)
struct drm_master *master;
bool ret;
- if (!file_priv || !file_priv->master || !file_priv->master->lessor)
+ if (!file_priv)
return true;
- master = file_priv->master;
+ master = drm_file_get_master(file_priv);
+ if (!master)
+ return true;
+ if (!master->lessor) {
+ ret = true;
+ goto out;
+ }
mutex_lock(&master->dev->mode_config.idr_mutex);
ret = _drm_lease_held_master(master, id);
mutex_unlock(&master->dev->mode_config.idr_mutex);
+
+out:
+ drm_master_put(&master);
return ret;
}
@@ -154,10 +172,16 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
int count_in, count_out;
uint32_t crtcs_out = 0;
- if (!file_priv || !file_priv->master || !file_priv->master->lessor)
+ if (!file_priv)
return crtcs_in;
- master = file_priv->master;
+ master = drm_file_get_master(file_priv);
+ if (!master)
+ return crtcs_in;
+ if (!master->lessor) {
+ crtcs_out = crtcs_in;
+ goto out;
+ }
dev = master->dev;
count_in = count_out = 0;
@@ -176,6 +200,9 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
count_in++;
}
mutex_unlock(&master->dev->mode_config.idr_mutex);
+
+out:
+ drm_master_put(&master);
return crtcs_out;
}
@@ -489,7 +516,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
size_t object_count;
int ret = 0;
struct idr leases;
- struct drm_master *lessor = lessor_priv->master;
+ struct drm_master *lessor;
struct drm_master *lessee = NULL;
struct file *lessee_file = NULL;
struct file *lessor_file = lessor_priv->filp;
@@ -501,12 +528,6 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
- /* Do not allow sub-leases */
- if (lessor->lessor) {
- DRM_DEBUG_LEASE("recursive leasing not allowed\n");
- return -EINVAL;
- }
-
/* need some objects */
if (cl->object_count == 0) {
DRM_DEBUG_LEASE("no objects in lease\n");
@@ -518,12 +539,22 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
return -EINVAL;
}
+ lessor = drm_file_get_master(lessor_priv);
+ /* Do not allow sub-leases */
+ if (lessor->lessor) {
+ DRM_DEBUG_LEASE("recursive leasing not allowed\n");
+ ret = -EINVAL;
+ goto out_lessor;
+ }
+
object_count = cl->object_count;
object_ids = memdup_user(u64_to_user_ptr(cl->object_ids),
array_size(object_count, sizeof(__u32)));
- if (IS_ERR(object_ids))
- return PTR_ERR(object_ids);
+ if (IS_ERR(object_ids)) {
+ ret = PTR_ERR(object_ids);
+ goto out_lessor;
+ }
idr_init(&leases);
@@ -534,14 +565,15 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
if (ret) {
DRM_DEBUG_LEASE("lease object lookup failed: %i\n", ret);
idr_destroy(&leases);
- return ret;
+ goto out_lessor;
}
/* Allocate a file descriptor for the lease */
fd = get_unused_fd_flags(cl->flags & (O_CLOEXEC | O_NONBLOCK));
if (fd < 0) {
idr_destroy(&leases);
- return fd;
+ ret = fd;
+ goto out_lessor;
}
DRM_DEBUG_LEASE("Creating lease\n");
@@ -577,6 +609,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
/* Hook up the fd */
fd_install(fd, lessee_file);
+ drm_master_put(&lessor);
DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl succeeded\n");
return 0;
@@ -586,6 +619,8 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
out_leases:
put_unused_fd(fd);
+out_lessor:
+ drm_master_put(&lessor);
DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl failed: %d\n", ret);
return ret;
}
@@ -608,7 +643,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
struct drm_mode_list_lessees *arg = data;
__u32 __user *lessee_ids = (__u32 __user *) (uintptr_t) (arg->lessees_ptr);
__u32 count_lessees = arg->count_lessees;
- struct drm_master *lessor = lessor_priv->master, *lessee;
+ struct drm_master *lessor, *lessee;
int count;
int ret = 0;
@@ -619,6 +654,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
+ lessor = drm_file_get_master(lessor_priv);
DRM_DEBUG_LEASE("List lessees for %d\n", lessor->lessee_id);
mutex_lock(&dev->mode_config.idr_mutex);
@@ -642,6 +678,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
arg->count_lessees = count;
mutex_unlock(&dev->mode_config.idr_mutex);
+ drm_master_put(&lessor);
return ret;
}
@@ -661,7 +698,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
struct drm_mode_get_lease *arg = data;
__u32 __user *object_ids = (__u32 __user *) (uintptr_t) (arg->objects_ptr);
__u32 count_objects = arg->count_objects;
- struct drm_master *lessee = lessee_priv->master;
+ struct drm_master *lessee;
struct idr *object_idr;
int count;
void *entry;
@@ -675,6 +712,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
+ lessee = drm_file_get_master(lessee_priv);
DRM_DEBUG_LEASE("get lease for %d\n", lessee->lessee_id);
mutex_lock(&dev->mode_config.idr_mutex);
@@ -702,6 +740,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
arg->count_objects = count;
mutex_unlock(&dev->mode_config.idr_mutex);
+ drm_master_put(&lessee);
return ret;
}
@@ -720,7 +759,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
void *data, struct drm_file *lessor_priv)
{
struct drm_mode_revoke_lease *arg = data;
- struct drm_master *lessor = lessor_priv->master;
+ struct drm_master *lessor;
struct drm_master *lessee;
int ret = 0;
@@ -730,6 +769,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
+ lessor = drm_file_get_master(lessor_priv);
mutex_lock(&dev->mode_config.idr_mutex);
lessee = _drm_find_lessee(lessor, arg->lessee_id);
@@ -750,6 +790,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
fail:
mutex_unlock(&dev->mode_config.idr_mutex);
+ drm_master_put(&lessor);
return ret;
}
diff --git a/include/drm/drm_auth.h b/include/drm/drm_auth.h
index 6bf8b2b78991..f99d3417f304 100644
--- a/include/drm/drm_auth.h
+++ b/include/drm/drm_auth.h
@@ -107,6 +107,7 @@ struct drm_master {
};
struct drm_master *drm_master_get(struct drm_master *master);
+struct drm_master *drm_file_get_master(struct drm_file *file_priv);
void drm_master_put(struct drm_master **master);
bool drm_is_current_master(struct drm_file *fpriv);
diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h
index b81b3bfb08c8..d5c3e67134d6 100644
--- a/include/drm/drm_file.h
+++ b/include/drm/drm_file.h
@@ -226,9 +226,18 @@ struct drm_file {
/**
* @master:
*
- * Master this node is currently associated with. Only relevant if
- * drm_is_primary_client() returns true. Note that this only
- * matches &drm_device.master if the master is the currently active one.
+ * Master this node is currently associated with. Protected by struct
+ * &drm_device.master_mutex.
+ *
+ * Only relevant if drm_is_primary_client() returns true. Note that
+ * this only matches &drm_device.master if the master is the currently
+ * active one.
+ *
+ * When dereferencing this pointer, either hold struct
+ * &drm_device.master_mutex for the duration of the pointer's use, or
+ * use drm_file_get_master() if struct &drm_device.master_mutex is not
+ * currently held and there is no other need to hold it. This prevents
+ * @master from being freed during use.
*
* See also @authentication and @is_master and the :ref:`section on
* primary nodes and authentication <drm_primary_node>`.
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [Intel-gfx] [PATCH v6 4/4] drm: protect drm_master pointers in drm_lease.c
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
0 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: Daniel Vetter, gregkh, intel-gfx, linux-kernel, dri-devel,
linaro-mm-sig, skhan, Desmond Cheong Zhi Xi,
linux-kernel-mentees, linux-media
Currently, direct copies of drm_file->master pointers should be
protected by drm_device.master_mutex when being dereferenced. This is
because drm_file->master is not invariant for the lifetime of
drm_file. If drm_file is not the creator of master, then
drm_file->is_master is false, and a call to drm_setmaster_ioctl will
invoke drm_new_set_master, which then allocates a new master for
drm_file and puts the old master.
Thus, without holding drm_device.master_mutex, the old value of
drm_file->master could be freed while it is being used by another
concurrent process.
In drm_lease.c, there are multiple instances where drm_file->master is
accessed and dereferenced while drm_device.master_mutex is not
held. This makes drm_lease.c vulnerable to use-after-free bugs.
We address this issue in 3 ways:
1. Clarify in the kerneldoc that drm_file->master is protected by
drm_device.master_mutex.
2. Add a new drm_file_get_master() function that calls drm_master_get
on drm_file->master while holding on to drm_device.master_mutex. Since
drm_master_get increments the reference count of master, this
prevents master from being freed until we unreference it with
drm_master_put.
3. In each case where drm_file->master is directly accessed and
eventually dereferenced in drm_lease.c, we wrap the access in a call
to the new drm_file_get_master function, then unreference the master
pointer once we are done using it.
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
---
drivers/gpu/drm/drm_auth.c | 25 ++++++++++++
drivers/gpu/drm/drm_lease.c | 81 ++++++++++++++++++++++++++++---------
include/drm/drm_auth.h | 1 +
include/drm/drm_file.h | 15 +++++--
4 files changed, 99 insertions(+), 23 deletions(-)
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index ab1863c5a5a0..c36a0b72be26 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -384,6 +384,31 @@ struct drm_master *drm_master_get(struct drm_master *master)
}
EXPORT_SYMBOL(drm_master_get);
+/**
+ * drm_file_get_master - reference &drm_file.master of @file_priv
+ * @file_priv: DRM file private
+ *
+ * Increments the reference count of @file_priv's &drm_file.master and returns
+ * the &drm_file.master. If @file_priv has no &drm_file.master, returns NULL.
+ *
+ * Master pointers returned from this function should be unreferenced using
+ * drm_master_put().
+ */
+struct drm_master *drm_file_get_master(struct drm_file *file_priv)
+{
+ struct drm_master *master = NULL;
+
+ mutex_lock(&file_priv->minor->dev->master_mutex);
+ if (!file_priv->master)
+ goto unlock;
+ master = drm_master_get(file_priv->master);
+
+unlock:
+ mutex_unlock(&file_priv->minor->dev->master_mutex);
+ return master;
+}
+EXPORT_SYMBOL(drm_file_get_master);
+
static void drm_master_destroy(struct kref *kref)
{
struct drm_master *master = container_of(kref, struct drm_master, refcount);
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index 00fb433bcef1..92eac73d9001 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -106,10 +106,19 @@ static bool _drm_has_leased(struct drm_master *master, int id)
*/
bool _drm_lease_held(struct drm_file *file_priv, int id)
{
- if (!file_priv || !file_priv->master)
+ bool ret;
+ struct drm_master *master;
+
+ if (!file_priv)
return true;
- return _drm_lease_held_master(file_priv->master, id);
+ master = drm_file_get_master(file_priv);
+ if (!master)
+ return true;
+ ret = _drm_lease_held_master(master, id);
+ drm_master_put(&master);
+
+ return ret;
}
/**
@@ -128,13 +137,22 @@ bool drm_lease_held(struct drm_file *file_priv, int id)
struct drm_master *master;
bool ret;
- if (!file_priv || !file_priv->master || !file_priv->master->lessor)
+ if (!file_priv)
return true;
- master = file_priv->master;
+ master = drm_file_get_master(file_priv);
+ if (!master)
+ return true;
+ if (!master->lessor) {
+ ret = true;
+ goto out;
+ }
mutex_lock(&master->dev->mode_config.idr_mutex);
ret = _drm_lease_held_master(master, id);
mutex_unlock(&master->dev->mode_config.idr_mutex);
+
+out:
+ drm_master_put(&master);
return ret;
}
@@ -154,10 +172,16 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
int count_in, count_out;
uint32_t crtcs_out = 0;
- if (!file_priv || !file_priv->master || !file_priv->master->lessor)
+ if (!file_priv)
return crtcs_in;
- master = file_priv->master;
+ master = drm_file_get_master(file_priv);
+ if (!master)
+ return crtcs_in;
+ if (!master->lessor) {
+ crtcs_out = crtcs_in;
+ goto out;
+ }
dev = master->dev;
count_in = count_out = 0;
@@ -176,6 +200,9 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
count_in++;
}
mutex_unlock(&master->dev->mode_config.idr_mutex);
+
+out:
+ drm_master_put(&master);
return crtcs_out;
}
@@ -489,7 +516,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
size_t object_count;
int ret = 0;
struct idr leases;
- struct drm_master *lessor = lessor_priv->master;
+ struct drm_master *lessor;
struct drm_master *lessee = NULL;
struct file *lessee_file = NULL;
struct file *lessor_file = lessor_priv->filp;
@@ -501,12 +528,6 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
- /* Do not allow sub-leases */
- if (lessor->lessor) {
- DRM_DEBUG_LEASE("recursive leasing not allowed\n");
- return -EINVAL;
- }
-
/* need some objects */
if (cl->object_count == 0) {
DRM_DEBUG_LEASE("no objects in lease\n");
@@ -518,12 +539,22 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
return -EINVAL;
}
+ lessor = drm_file_get_master(lessor_priv);
+ /* Do not allow sub-leases */
+ if (lessor->lessor) {
+ DRM_DEBUG_LEASE("recursive leasing not allowed\n");
+ ret = -EINVAL;
+ goto out_lessor;
+ }
+
object_count = cl->object_count;
object_ids = memdup_user(u64_to_user_ptr(cl->object_ids),
array_size(object_count, sizeof(__u32)));
- if (IS_ERR(object_ids))
- return PTR_ERR(object_ids);
+ if (IS_ERR(object_ids)) {
+ ret = PTR_ERR(object_ids);
+ goto out_lessor;
+ }
idr_init(&leases);
@@ -534,14 +565,15 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
if (ret) {
DRM_DEBUG_LEASE("lease object lookup failed: %i\n", ret);
idr_destroy(&leases);
- return ret;
+ goto out_lessor;
}
/* Allocate a file descriptor for the lease */
fd = get_unused_fd_flags(cl->flags & (O_CLOEXEC | O_NONBLOCK));
if (fd < 0) {
idr_destroy(&leases);
- return fd;
+ ret = fd;
+ goto out_lessor;
}
DRM_DEBUG_LEASE("Creating lease\n");
@@ -577,6 +609,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
/* Hook up the fd */
fd_install(fd, lessee_file);
+ drm_master_put(&lessor);
DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl succeeded\n");
return 0;
@@ -586,6 +619,8 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
out_leases:
put_unused_fd(fd);
+out_lessor:
+ drm_master_put(&lessor);
DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl failed: %d\n", ret);
return ret;
}
@@ -608,7 +643,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
struct drm_mode_list_lessees *arg = data;
__u32 __user *lessee_ids = (__u32 __user *) (uintptr_t) (arg->lessees_ptr);
__u32 count_lessees = arg->count_lessees;
- struct drm_master *lessor = lessor_priv->master, *lessee;
+ struct drm_master *lessor, *lessee;
int count;
int ret = 0;
@@ -619,6 +654,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
+ lessor = drm_file_get_master(lessor_priv);
DRM_DEBUG_LEASE("List lessees for %d\n", lessor->lessee_id);
mutex_lock(&dev->mode_config.idr_mutex);
@@ -642,6 +678,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
arg->count_lessees = count;
mutex_unlock(&dev->mode_config.idr_mutex);
+ drm_master_put(&lessor);
return ret;
}
@@ -661,7 +698,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
struct drm_mode_get_lease *arg = data;
__u32 __user *object_ids = (__u32 __user *) (uintptr_t) (arg->objects_ptr);
__u32 count_objects = arg->count_objects;
- struct drm_master *lessee = lessee_priv->master;
+ struct drm_master *lessee;
struct idr *object_idr;
int count;
void *entry;
@@ -675,6 +712,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
+ lessee = drm_file_get_master(lessee_priv);
DRM_DEBUG_LEASE("get lease for %d\n", lessee->lessee_id);
mutex_lock(&dev->mode_config.idr_mutex);
@@ -702,6 +740,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
arg->count_objects = count;
mutex_unlock(&dev->mode_config.idr_mutex);
+ drm_master_put(&lessee);
return ret;
}
@@ -720,7 +759,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
void *data, struct drm_file *lessor_priv)
{
struct drm_mode_revoke_lease *arg = data;
- struct drm_master *lessor = lessor_priv->master;
+ struct drm_master *lessor;
struct drm_master *lessee;
int ret = 0;
@@ -730,6 +769,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
+ lessor = drm_file_get_master(lessor_priv);
mutex_lock(&dev->mode_config.idr_mutex);
lessee = _drm_find_lessee(lessor, arg->lessee_id);
@@ -750,6 +790,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
fail:
mutex_unlock(&dev->mode_config.idr_mutex);
+ drm_master_put(&lessor);
return ret;
}
diff --git a/include/drm/drm_auth.h b/include/drm/drm_auth.h
index 6bf8b2b78991..f99d3417f304 100644
--- a/include/drm/drm_auth.h
+++ b/include/drm/drm_auth.h
@@ -107,6 +107,7 @@ struct drm_master {
};
struct drm_master *drm_master_get(struct drm_master *master);
+struct drm_master *drm_file_get_master(struct drm_file *file_priv);
void drm_master_put(struct drm_master **master);
bool drm_is_current_master(struct drm_file *fpriv);
diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h
index b81b3bfb08c8..d5c3e67134d6 100644
--- a/include/drm/drm_file.h
+++ b/include/drm/drm_file.h
@@ -226,9 +226,18 @@ struct drm_file {
/**
* @master:
*
- * Master this node is currently associated with. Only relevant if
- * drm_is_primary_client() returns true. Note that this only
- * matches &drm_device.master if the master is the currently active one.
+ * Master this node is currently associated with. Protected by struct
+ * &drm_device.master_mutex.
+ *
+ * Only relevant if drm_is_primary_client() returns true. Note that
+ * this only matches &drm_device.master if the master is the currently
+ * active one.
+ *
+ * When dereferencing this pointer, either hold struct
+ * &drm_device.master_mutex for the duration of the pointer's use, or
+ * use drm_file_get_master() if struct &drm_device.master_mutex is not
+ * currently held and there is no other need to hold it. This prevents
+ * @master from being freed during use.
*
* See also @authentication and @is_master and the :ref:`section on
* primary nodes and authentication <drm_primary_node>`.
--
2.25.1
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 4/4] drm: protect drm_master pointers in drm_lease.c
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
0 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: Daniel Vetter, gregkh, intel-gfx, emil.l.velikov, linux-kernel,
dri-devel, linaro-mm-sig, skhan, Desmond Cheong Zhi Xi,
linux-kernel-mentees, linux-media
Currently, direct copies of drm_file->master pointers should be
protected by drm_device.master_mutex when being dereferenced. This is
because drm_file->master is not invariant for the lifetime of
drm_file. If drm_file is not the creator of master, then
drm_file->is_master is false, and a call to drm_setmaster_ioctl will
invoke drm_new_set_master, which then allocates a new master for
drm_file and puts the old master.
Thus, without holding drm_device.master_mutex, the old value of
drm_file->master could be freed while it is being used by another
concurrent process.
In drm_lease.c, there are multiple instances where drm_file->master is
accessed and dereferenced while drm_device.master_mutex is not
held. This makes drm_lease.c vulnerable to use-after-free bugs.
We address this issue in 3 ways:
1. Clarify in the kerneldoc that drm_file->master is protected by
drm_device.master_mutex.
2. Add a new drm_file_get_master() function that calls drm_master_get
on drm_file->master while holding on to drm_device.master_mutex. Since
drm_master_get increments the reference count of master, this
prevents master from being freed until we unreference it with
drm_master_put.
3. In each case where drm_file->master is directly accessed and
eventually dereferenced in drm_lease.c, we wrap the access in a call
to the new drm_file_get_master function, then unreference the master
pointer once we are done using it.
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
---
drivers/gpu/drm/drm_auth.c | 25 ++++++++++++
drivers/gpu/drm/drm_lease.c | 81 ++++++++++++++++++++++++++++---------
include/drm/drm_auth.h | 1 +
include/drm/drm_file.h | 15 +++++--
4 files changed, 99 insertions(+), 23 deletions(-)
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index ab1863c5a5a0..c36a0b72be26 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -384,6 +384,31 @@ struct drm_master *drm_master_get(struct drm_master *master)
}
EXPORT_SYMBOL(drm_master_get);
+/**
+ * drm_file_get_master - reference &drm_file.master of @file_priv
+ * @file_priv: DRM file private
+ *
+ * Increments the reference count of @file_priv's &drm_file.master and returns
+ * the &drm_file.master. If @file_priv has no &drm_file.master, returns NULL.
+ *
+ * Master pointers returned from this function should be unreferenced using
+ * drm_master_put().
+ */
+struct drm_master *drm_file_get_master(struct drm_file *file_priv)
+{
+ struct drm_master *master = NULL;
+
+ mutex_lock(&file_priv->minor->dev->master_mutex);
+ if (!file_priv->master)
+ goto unlock;
+ master = drm_master_get(file_priv->master);
+
+unlock:
+ mutex_unlock(&file_priv->minor->dev->master_mutex);
+ return master;
+}
+EXPORT_SYMBOL(drm_file_get_master);
+
static void drm_master_destroy(struct kref *kref)
{
struct drm_master *master = container_of(kref, struct drm_master, refcount);
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index 00fb433bcef1..92eac73d9001 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -106,10 +106,19 @@ static bool _drm_has_leased(struct drm_master *master, int id)
*/
bool _drm_lease_held(struct drm_file *file_priv, int id)
{
- if (!file_priv || !file_priv->master)
+ bool ret;
+ struct drm_master *master;
+
+ if (!file_priv)
return true;
- return _drm_lease_held_master(file_priv->master, id);
+ master = drm_file_get_master(file_priv);
+ if (!master)
+ return true;
+ ret = _drm_lease_held_master(master, id);
+ drm_master_put(&master);
+
+ return ret;
}
/**
@@ -128,13 +137,22 @@ bool drm_lease_held(struct drm_file *file_priv, int id)
struct drm_master *master;
bool ret;
- if (!file_priv || !file_priv->master || !file_priv->master->lessor)
+ if (!file_priv)
return true;
- master = file_priv->master;
+ master = drm_file_get_master(file_priv);
+ if (!master)
+ return true;
+ if (!master->lessor) {
+ ret = true;
+ goto out;
+ }
mutex_lock(&master->dev->mode_config.idr_mutex);
ret = _drm_lease_held_master(master, id);
mutex_unlock(&master->dev->mode_config.idr_mutex);
+
+out:
+ drm_master_put(&master);
return ret;
}
@@ -154,10 +172,16 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
int count_in, count_out;
uint32_t crtcs_out = 0;
- if (!file_priv || !file_priv->master || !file_priv->master->lessor)
+ if (!file_priv)
return crtcs_in;
- master = file_priv->master;
+ master = drm_file_get_master(file_priv);
+ if (!master)
+ return crtcs_in;
+ if (!master->lessor) {
+ crtcs_out = crtcs_in;
+ goto out;
+ }
dev = master->dev;
count_in = count_out = 0;
@@ -176,6 +200,9 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
count_in++;
}
mutex_unlock(&master->dev->mode_config.idr_mutex);
+
+out:
+ drm_master_put(&master);
return crtcs_out;
}
@@ -489,7 +516,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
size_t object_count;
int ret = 0;
struct idr leases;
- struct drm_master *lessor = lessor_priv->master;
+ struct drm_master *lessor;
struct drm_master *lessee = NULL;
struct file *lessee_file = NULL;
struct file *lessor_file = lessor_priv->filp;
@@ -501,12 +528,6 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
- /* Do not allow sub-leases */
- if (lessor->lessor) {
- DRM_DEBUG_LEASE("recursive leasing not allowed\n");
- return -EINVAL;
- }
-
/* need some objects */
if (cl->object_count == 0) {
DRM_DEBUG_LEASE("no objects in lease\n");
@@ -518,12 +539,22 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
return -EINVAL;
}
+ lessor = drm_file_get_master(lessor_priv);
+ /* Do not allow sub-leases */
+ if (lessor->lessor) {
+ DRM_DEBUG_LEASE("recursive leasing not allowed\n");
+ ret = -EINVAL;
+ goto out_lessor;
+ }
+
object_count = cl->object_count;
object_ids = memdup_user(u64_to_user_ptr(cl->object_ids),
array_size(object_count, sizeof(__u32)));
- if (IS_ERR(object_ids))
- return PTR_ERR(object_ids);
+ if (IS_ERR(object_ids)) {
+ ret = PTR_ERR(object_ids);
+ goto out_lessor;
+ }
idr_init(&leases);
@@ -534,14 +565,15 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
if (ret) {
DRM_DEBUG_LEASE("lease object lookup failed: %i\n", ret);
idr_destroy(&leases);
- return ret;
+ goto out_lessor;
}
/* Allocate a file descriptor for the lease */
fd = get_unused_fd_flags(cl->flags & (O_CLOEXEC | O_NONBLOCK));
if (fd < 0) {
idr_destroy(&leases);
- return fd;
+ ret = fd;
+ goto out_lessor;
}
DRM_DEBUG_LEASE("Creating lease\n");
@@ -577,6 +609,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
/* Hook up the fd */
fd_install(fd, lessee_file);
+ drm_master_put(&lessor);
DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl succeeded\n");
return 0;
@@ -586,6 +619,8 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
out_leases:
put_unused_fd(fd);
+out_lessor:
+ drm_master_put(&lessor);
DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl failed: %d\n", ret);
return ret;
}
@@ -608,7 +643,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
struct drm_mode_list_lessees *arg = data;
__u32 __user *lessee_ids = (__u32 __user *) (uintptr_t) (arg->lessees_ptr);
__u32 count_lessees = arg->count_lessees;
- struct drm_master *lessor = lessor_priv->master, *lessee;
+ struct drm_master *lessor, *lessee;
int count;
int ret = 0;
@@ -619,6 +654,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
+ lessor = drm_file_get_master(lessor_priv);
DRM_DEBUG_LEASE("List lessees for %d\n", lessor->lessee_id);
mutex_lock(&dev->mode_config.idr_mutex);
@@ -642,6 +678,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
arg->count_lessees = count;
mutex_unlock(&dev->mode_config.idr_mutex);
+ drm_master_put(&lessor);
return ret;
}
@@ -661,7 +698,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
struct drm_mode_get_lease *arg = data;
__u32 __user *object_ids = (__u32 __user *) (uintptr_t) (arg->objects_ptr);
__u32 count_objects = arg->count_objects;
- struct drm_master *lessee = lessee_priv->master;
+ struct drm_master *lessee;
struct idr *object_idr;
int count;
void *entry;
@@ -675,6 +712,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
+ lessee = drm_file_get_master(lessee_priv);
DRM_DEBUG_LEASE("get lease for %d\n", lessee->lessee_id);
mutex_lock(&dev->mode_config.idr_mutex);
@@ -702,6 +740,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
arg->count_objects = count;
mutex_unlock(&dev->mode_config.idr_mutex);
+ drm_master_put(&lessee);
return ret;
}
@@ -720,7 +759,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
void *data, struct drm_file *lessor_priv)
{
struct drm_mode_revoke_lease *arg = data;
- struct drm_master *lessor = lessor_priv->master;
+ struct drm_master *lessor;
struct drm_master *lessee;
int ret = 0;
@@ -730,6 +769,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
+ lessor = drm_file_get_master(lessor_priv);
mutex_lock(&dev->mode_config.idr_mutex);
lessee = _drm_find_lessee(lessor, arg->lessee_id);
@@ -750,6 +790,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
fail:
mutex_unlock(&dev->mode_config.idr_mutex);
+ drm_master_put(&lessor);
return ret;
}
diff --git a/include/drm/drm_auth.h b/include/drm/drm_auth.h
index 6bf8b2b78991..f99d3417f304 100644
--- a/include/drm/drm_auth.h
+++ b/include/drm/drm_auth.h
@@ -107,6 +107,7 @@ struct drm_master {
};
struct drm_master *drm_master_get(struct drm_master *master);
+struct drm_master *drm_file_get_master(struct drm_file *file_priv);
void drm_master_put(struct drm_master **master);
bool drm_is_current_master(struct drm_file *fpriv);
diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h
index b81b3bfb08c8..d5c3e67134d6 100644
--- a/include/drm/drm_file.h
+++ b/include/drm/drm_file.h
@@ -226,9 +226,18 @@ struct drm_file {
/**
* @master:
*
- * Master this node is currently associated with. Only relevant if
- * drm_is_primary_client() returns true. Note that this only
- * matches &drm_device.master if the master is the currently active one.
+ * Master this node is currently associated with. Protected by struct
+ * &drm_device.master_mutex.
+ *
+ * Only relevant if drm_is_primary_client() returns true. Note that
+ * this only matches &drm_device.master if the master is the currently
+ * active one.
+ *
+ * When dereferencing this pointer, either hold struct
+ * &drm_device.master_mutex for the duration of the pointer's use, or
+ * use drm_file_get_master() if struct &drm_device.master_mutex is not
+ * currently held and there is no other need to hold it. This prevents
+ * @master from being freed during use.
*
* See also @authentication and @is_master and the :ref:`section on
* primary nodes and authentication <drm_primary_node>`.
--
2.25.1
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [PATCH v6 4/4] drm: protect drm_master pointers in drm_lease.c
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
0 siblings, 0 replies; 23+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: Daniel Vetter, intel-gfx, emil.l.velikov, linux-kernel,
dri-devel, linaro-mm-sig, Desmond Cheong Zhi Xi,
linux-kernel-mentees, linux-media
Currently, direct copies of drm_file->master pointers should be
protected by drm_device.master_mutex when being dereferenced. This is
because drm_file->master is not invariant for the lifetime of
drm_file. If drm_file is not the creator of master, then
drm_file->is_master is false, and a call to drm_setmaster_ioctl will
invoke drm_new_set_master, which then allocates a new master for
drm_file and puts the old master.
Thus, without holding drm_device.master_mutex, the old value of
drm_file->master could be freed while it is being used by another
concurrent process.
In drm_lease.c, there are multiple instances where drm_file->master is
accessed and dereferenced while drm_device.master_mutex is not
held. This makes drm_lease.c vulnerable to use-after-free bugs.
We address this issue in 3 ways:
1. Clarify in the kerneldoc that drm_file->master is protected by
drm_device.master_mutex.
2. Add a new drm_file_get_master() function that calls drm_master_get
on drm_file->master while holding on to drm_device.master_mutex. Since
drm_master_get increments the reference count of master, this
prevents master from being freed until we unreference it with
drm_master_put.
3. In each case where drm_file->master is directly accessed and
eventually dereferenced in drm_lease.c, we wrap the access in a call
to the new drm_file_get_master function, then unreference the master
pointer once we are done using it.
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
---
drivers/gpu/drm/drm_auth.c | 25 ++++++++++++
drivers/gpu/drm/drm_lease.c | 81 ++++++++++++++++++++++++++++---------
include/drm/drm_auth.h | 1 +
include/drm/drm_file.h | 15 +++++--
4 files changed, 99 insertions(+), 23 deletions(-)
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index ab1863c5a5a0..c36a0b72be26 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -384,6 +384,31 @@ struct drm_master *drm_master_get(struct drm_master *master)
}
EXPORT_SYMBOL(drm_master_get);
+/**
+ * drm_file_get_master - reference &drm_file.master of @file_priv
+ * @file_priv: DRM file private
+ *
+ * Increments the reference count of @file_priv's &drm_file.master and returns
+ * the &drm_file.master. If @file_priv has no &drm_file.master, returns NULL.
+ *
+ * Master pointers returned from this function should be unreferenced using
+ * drm_master_put().
+ */
+struct drm_master *drm_file_get_master(struct drm_file *file_priv)
+{
+ struct drm_master *master = NULL;
+
+ mutex_lock(&file_priv->minor->dev->master_mutex);
+ if (!file_priv->master)
+ goto unlock;
+ master = drm_master_get(file_priv->master);
+
+unlock:
+ mutex_unlock(&file_priv->minor->dev->master_mutex);
+ return master;
+}
+EXPORT_SYMBOL(drm_file_get_master);
+
static void drm_master_destroy(struct kref *kref)
{
struct drm_master *master = container_of(kref, struct drm_master, refcount);
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index 00fb433bcef1..92eac73d9001 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -106,10 +106,19 @@ static bool _drm_has_leased(struct drm_master *master, int id)
*/
bool _drm_lease_held(struct drm_file *file_priv, int id)
{
- if (!file_priv || !file_priv->master)
+ bool ret;
+ struct drm_master *master;
+
+ if (!file_priv)
return true;
- return _drm_lease_held_master(file_priv->master, id);
+ master = drm_file_get_master(file_priv);
+ if (!master)
+ return true;
+ ret = _drm_lease_held_master(master, id);
+ drm_master_put(&master);
+
+ return ret;
}
/**
@@ -128,13 +137,22 @@ bool drm_lease_held(struct drm_file *file_priv, int id)
struct drm_master *master;
bool ret;
- if (!file_priv || !file_priv->master || !file_priv->master->lessor)
+ if (!file_priv)
return true;
- master = file_priv->master;
+ master = drm_file_get_master(file_priv);
+ if (!master)
+ return true;
+ if (!master->lessor) {
+ ret = true;
+ goto out;
+ }
mutex_lock(&master->dev->mode_config.idr_mutex);
ret = _drm_lease_held_master(master, id);
mutex_unlock(&master->dev->mode_config.idr_mutex);
+
+out:
+ drm_master_put(&master);
return ret;
}
@@ -154,10 +172,16 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
int count_in, count_out;
uint32_t crtcs_out = 0;
- if (!file_priv || !file_priv->master || !file_priv->master->lessor)
+ if (!file_priv)
return crtcs_in;
- master = file_priv->master;
+ master = drm_file_get_master(file_priv);
+ if (!master)
+ return crtcs_in;
+ if (!master->lessor) {
+ crtcs_out = crtcs_in;
+ goto out;
+ }
dev = master->dev;
count_in = count_out = 0;
@@ -176,6 +200,9 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
count_in++;
}
mutex_unlock(&master->dev->mode_config.idr_mutex);
+
+out:
+ drm_master_put(&master);
return crtcs_out;
}
@@ -489,7 +516,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
size_t object_count;
int ret = 0;
struct idr leases;
- struct drm_master *lessor = lessor_priv->master;
+ struct drm_master *lessor;
struct drm_master *lessee = NULL;
struct file *lessee_file = NULL;
struct file *lessor_file = lessor_priv->filp;
@@ -501,12 +528,6 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
- /* Do not allow sub-leases */
- if (lessor->lessor) {
- DRM_DEBUG_LEASE("recursive leasing not allowed\n");
- return -EINVAL;
- }
-
/* need some objects */
if (cl->object_count == 0) {
DRM_DEBUG_LEASE("no objects in lease\n");
@@ -518,12 +539,22 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
return -EINVAL;
}
+ lessor = drm_file_get_master(lessor_priv);
+ /* Do not allow sub-leases */
+ if (lessor->lessor) {
+ DRM_DEBUG_LEASE("recursive leasing not allowed\n");
+ ret = -EINVAL;
+ goto out_lessor;
+ }
+
object_count = cl->object_count;
object_ids = memdup_user(u64_to_user_ptr(cl->object_ids),
array_size(object_count, sizeof(__u32)));
- if (IS_ERR(object_ids))
- return PTR_ERR(object_ids);
+ if (IS_ERR(object_ids)) {
+ ret = PTR_ERR(object_ids);
+ goto out_lessor;
+ }
idr_init(&leases);
@@ -534,14 +565,15 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
if (ret) {
DRM_DEBUG_LEASE("lease object lookup failed: %i\n", ret);
idr_destroy(&leases);
- return ret;
+ goto out_lessor;
}
/* Allocate a file descriptor for the lease */
fd = get_unused_fd_flags(cl->flags & (O_CLOEXEC | O_NONBLOCK));
if (fd < 0) {
idr_destroy(&leases);
- return fd;
+ ret = fd;
+ goto out_lessor;
}
DRM_DEBUG_LEASE("Creating lease\n");
@@ -577,6 +609,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
/* Hook up the fd */
fd_install(fd, lessee_file);
+ drm_master_put(&lessor);
DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl succeeded\n");
return 0;
@@ -586,6 +619,8 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
out_leases:
put_unused_fd(fd);
+out_lessor:
+ drm_master_put(&lessor);
DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl failed: %d\n", ret);
return ret;
}
@@ -608,7 +643,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
struct drm_mode_list_lessees *arg = data;
__u32 __user *lessee_ids = (__u32 __user *) (uintptr_t) (arg->lessees_ptr);
__u32 count_lessees = arg->count_lessees;
- struct drm_master *lessor = lessor_priv->master, *lessee;
+ struct drm_master *lessor, *lessee;
int count;
int ret = 0;
@@ -619,6 +654,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
+ lessor = drm_file_get_master(lessor_priv);
DRM_DEBUG_LEASE("List lessees for %d\n", lessor->lessee_id);
mutex_lock(&dev->mode_config.idr_mutex);
@@ -642,6 +678,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
arg->count_lessees = count;
mutex_unlock(&dev->mode_config.idr_mutex);
+ drm_master_put(&lessor);
return ret;
}
@@ -661,7 +698,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
struct drm_mode_get_lease *arg = data;
__u32 __user *object_ids = (__u32 __user *) (uintptr_t) (arg->objects_ptr);
__u32 count_objects = arg->count_objects;
- struct drm_master *lessee = lessee_priv->master;
+ struct drm_master *lessee;
struct idr *object_idr;
int count;
void *entry;
@@ -675,6 +712,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
+ lessee = drm_file_get_master(lessee_priv);
DRM_DEBUG_LEASE("get lease for %d\n", lessee->lessee_id);
mutex_lock(&dev->mode_config.idr_mutex);
@@ -702,6 +740,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
arg->count_objects = count;
mutex_unlock(&dev->mode_config.idr_mutex);
+ drm_master_put(&lessee);
return ret;
}
@@ -720,7 +759,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
void *data, struct drm_file *lessor_priv)
{
struct drm_mode_revoke_lease *arg = data;
- struct drm_master *lessor = lessor_priv->master;
+ struct drm_master *lessor;
struct drm_master *lessee;
int ret = 0;
@@ -730,6 +769,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
+ lessor = drm_file_get_master(lessor_priv);
mutex_lock(&dev->mode_config.idr_mutex);
lessee = _drm_find_lessee(lessor, arg->lessee_id);
@@ -750,6 +790,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
fail:
mutex_unlock(&dev->mode_config.idr_mutex);
+ drm_master_put(&lessor);
return ret;
}
diff --git a/include/drm/drm_auth.h b/include/drm/drm_auth.h
index 6bf8b2b78991..f99d3417f304 100644
--- a/include/drm/drm_auth.h
+++ b/include/drm/drm_auth.h
@@ -107,6 +107,7 @@ struct drm_master {
};
struct drm_master *drm_master_get(struct drm_master *master);
+struct drm_master *drm_file_get_master(struct drm_file *file_priv);
void drm_master_put(struct drm_master **master);
bool drm_is_current_master(struct drm_file *fpriv);
diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h
index b81b3bfb08c8..d5c3e67134d6 100644
--- a/include/drm/drm_file.h
+++ b/include/drm/drm_file.h
@@ -226,9 +226,18 @@ struct drm_file {
/**
* @master:
*
- * Master this node is currently associated with. Only relevant if
- * drm_is_primary_client() returns true. Note that this only
- * matches &drm_device.master if the master is the currently active one.
+ * Master this node is currently associated with. Protected by struct
+ * &drm_device.master_mutex.
+ *
+ * Only relevant if drm_is_primary_client() returns true. Note that
+ * this only matches &drm_device.master if the master is the currently
+ * active one.
+ *
+ * When dereferencing this pointer, either hold struct
+ * &drm_device.master_mutex for the duration of the pointer's use, or
+ * use drm_file_get_master() if struct &drm_device.master_mutex is not
+ * currently held and there is no other need to hold it. This prevents
+ * @master from being freed during use.
*
* See also @authentication and @is_master and the :ref:`section on
* primary nodes and authentication <drm_primary_node>`.
--
2.25.1
_______________________________________________
Linux-kernel-mentees mailing list
Linux-kernel-mentees@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/linux-kernel-mentees
^ permalink raw reply related [flat|nested] 23+ messages in thread
* [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for drm: address potential UAF bugs with drm_master ptrs
2021-06-30 14:54 ` Desmond Cheong Zhi Xi
` (6 preceding siblings ...)
(?)
@ 2021-06-30 18:18 ` Patchwork
-1 siblings, 0 replies; 23+ messages in thread
From: Patchwork @ 2021-06-30 18:18 UTC (permalink / raw)
To: Desmond Cheong Zhi Xi; +Cc: intel-gfx
== Series Details ==
Series: drm: address potential UAF bugs with drm_master ptrs
URL : https://patchwork.freedesktop.org/series/92076/
State : warning
== Summary ==
$ dim checkpatch origin/drm-tip
13940bd0a105 drm: avoid circular locks in drm_mode_getconnector
dbd6d7ef5160 drm: avoid circular locks in __drm_mode_object_find
-:37: CHECK:PARENTHESIS_ALIGNMENT: Alignment should match open parenthesis
#37: FILE: drivers/gpu/drm/drm_mode_object.c:156:
+ if (obj && drm_mode_object_lease_required(obj->type) &&
+ !_drm_lease_held(file_priv, obj->id)) {
total: 0 errors, 0 warnings, 1 checks, 22 lines checked
21e2781892f6 drm: add a locked version of drm_is_current_master
057ea9e5fa3c drm: protect drm_master pointers in drm_lease.c
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] ✓ Fi.CI.BAT: success for drm: address potential UAF bugs with drm_master ptrs
2021-06-30 14:54 ` Desmond Cheong Zhi Xi
` (7 preceding siblings ...)
(?)
@ 2021-06-30 18:31 ` Patchwork
-1 siblings, 0 replies; 23+ messages in thread
From: Patchwork @ 2021-06-30 18:31 UTC (permalink / raw)
To: Desmond Cheong Zhi Xi; +Cc: intel-gfx
[-- Attachment #1.1: Type: text/plain, Size: 17995 bytes --]
== Series Details ==
Series: drm: address potential UAF bugs with drm_master ptrs
URL : https://patchwork.freedesktop.org/series/92076/
State : success
== Summary ==
CI Bug Log - changes from CI_DRM_10295 -> Patchwork_20495
====================================================
Summary
-------
**SUCCESS**
No regressions found.
External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/index.html
Possible new issues
-------------------
Here are the unknown changes that may have been introduced in Patchwork_20495:
### IGT changes ###
#### Suppressed ####
The following results come from untrusted machines, tests, or statuses.
They do not affect the overall result.
* igt@runner@aborted:
- {fi-dg1-1}: NOTRUN -> [FAIL][1]
[1]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-dg1-1/igt@runner@aborted.html
Known issues
------------
Here are the changes found in Patchwork_20495 that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@debugfs_test@read_all_entries:
- fi-cml-s: [PASS][2] -> [DMESG-WARN][3] ([i915#3660])
[2]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-cml-s/igt@debugfs_test@read_all_entries.html
[3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-cml-s/igt@debugfs_test@read_all_entries.html
- fi-elk-e7500: [PASS][4] -> [DMESG-WARN][5] ([i915#3660])
[4]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-elk-e7500/igt@debugfs_test@read_all_entries.html
[5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-elk-e7500/igt@debugfs_test@read_all_entries.html
- fi-glk-dsi: [PASS][6] -> [DMESG-WARN][7] ([i915#3660])
[6]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-glk-dsi/igt@debugfs_test@read_all_entries.html
[7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-glk-dsi/igt@debugfs_test@read_all_entries.html
- fi-ivb-3770: [PASS][8] -> [DMESG-WARN][9] ([i915#3660])
[8]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-ivb-3770/igt@debugfs_test@read_all_entries.html
[9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-ivb-3770/igt@debugfs_test@read_all_entries.html
- fi-snb-2600: [PASS][10] -> [DMESG-WARN][11] ([i915#3660])
[10]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-snb-2600/igt@debugfs_test@read_all_entries.html
[11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-snb-2600/igt@debugfs_test@read_all_entries.html
- fi-kbl-guc: [PASS][12] -> [DMESG-WARN][13] ([i915#262] / [i915#3660])
[12]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-kbl-guc/igt@debugfs_test@read_all_entries.html
[13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-kbl-guc/igt@debugfs_test@read_all_entries.html
- fi-bdw-gvtdvm: [PASS][14] -> [DMESG-WARN][15] ([i915#3660])
[14]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-bdw-gvtdvm/igt@debugfs_test@read_all_entries.html
[15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-bdw-gvtdvm/igt@debugfs_test@read_all_entries.html
- fi-bsw-kefka: [PASS][16] -> [DMESG-WARN][17] ([i915#3660])
[16]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-bsw-kefka/igt@debugfs_test@read_all_entries.html
[17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-bsw-kefka/igt@debugfs_test@read_all_entries.html
- fi-kbl-7500u: [PASS][18] -> [DMESG-WARN][19] ([i915#262] / [i915#3660])
[18]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-kbl-7500u/igt@debugfs_test@read_all_entries.html
[19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-kbl-7500u/igt@debugfs_test@read_all_entries.html
- fi-bwr-2160: [PASS][20] -> [DMESG-WARN][21] ([i915#3660])
[20]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-bwr-2160/igt@debugfs_test@read_all_entries.html
[21]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-bwr-2160/igt@debugfs_test@read_all_entries.html
- fi-bdw-5557u: [PASS][22] -> [DMESG-WARN][23] ([i915#3660])
[22]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-bdw-5557u/igt@debugfs_test@read_all_entries.html
[23]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-bdw-5557u/igt@debugfs_test@read_all_entries.html
- fi-kbl-r: [PASS][24] -> [DMESG-WARN][25] ([i915#262] / [i915#3660])
[24]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-kbl-r/igt@debugfs_test@read_all_entries.html
[25]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-kbl-r/igt@debugfs_test@read_all_entries.html
- fi-kbl-7567u: [PASS][26] -> [DMESG-WARN][27] ([i915#262] / [i915#3660])
[26]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-kbl-7567u/igt@debugfs_test@read_all_entries.html
[27]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-kbl-7567u/igt@debugfs_test@read_all_entries.html
- fi-apl-guc: [PASS][28] -> [DMESG-WARN][29] ([i915#3660])
[28]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-apl-guc/igt@debugfs_test@read_all_entries.html
[29]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-apl-guc/igt@debugfs_test@read_all_entries.html
- fi-icl-y: [PASS][30] -> [DMESG-WARN][31] ([i915#3660])
[30]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-icl-y/igt@debugfs_test@read_all_entries.html
[31]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-icl-y/igt@debugfs_test@read_all_entries.html
- fi-snb-2520m: [PASS][32] -> [DMESG-WARN][33] ([i915#3660])
[32]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-snb-2520m/igt@debugfs_test@read_all_entries.html
[33]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-snb-2520m/igt@debugfs_test@read_all_entries.html
- fi-kbl-8809g: [PASS][34] -> [DMESG-WARN][35] ([i915#262] / [i915#3660])
[34]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-kbl-8809g/igt@debugfs_test@read_all_entries.html
[35]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-kbl-8809g/igt@debugfs_test@read_all_entries.html
- fi-bsw-nick: [PASS][36] -> [DMESG-WARN][37] ([i915#3660])
[36]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-bsw-nick/igt@debugfs_test@read_all_entries.html
[37]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-bsw-nick/igt@debugfs_test@read_all_entries.html
- fi-cfl-8109u: [PASS][38] -> [DMESG-WARN][39] ([i915#262] / [i915#3660])
[38]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-cfl-8109u/igt@debugfs_test@read_all_entries.html
[39]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-cfl-8109u/igt@debugfs_test@read_all_entries.html
- fi-skl-6600u: [PASS][40] -> [DMESG-WARN][41] ([i915#3660])
[40]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-skl-6600u/igt@debugfs_test@read_all_entries.html
[41]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-skl-6600u/igt@debugfs_test@read_all_entries.html
- fi-bxt-dsi: [PASS][42] -> [DMESG-WARN][43] ([i915#3660])
[42]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-bxt-dsi/igt@debugfs_test@read_all_entries.html
[43]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-bxt-dsi/igt@debugfs_test@read_all_entries.html
- fi-cfl-8700k: [PASS][44] -> [DMESG-WARN][45] ([i915#3660])
[44]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-cfl-8700k/igt@debugfs_test@read_all_entries.html
[45]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-cfl-8700k/igt@debugfs_test@read_all_entries.html
- fi-pnv-d510: [PASS][46] -> [DMESG-WARN][47] ([i915#3660])
[46]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-pnv-d510/igt@debugfs_test@read_all_entries.html
[47]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-pnv-d510/igt@debugfs_test@read_all_entries.html
- fi-ilk-650: [PASS][48] -> [DMESG-WARN][49] ([i915#3660])
[48]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-ilk-650/igt@debugfs_test@read_all_entries.html
[49]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-ilk-650/igt@debugfs_test@read_all_entries.html
- fi-bsw-n3050: [PASS][50] -> [DMESG-WARN][51] ([i915#3660])
[50]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-bsw-n3050/igt@debugfs_test@read_all_entries.html
[51]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-bsw-n3050/igt@debugfs_test@read_all_entries.html
- fi-skl-6700k2: [PASS][52] -> [DMESG-WARN][53] ([i915#3660])
[52]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-skl-6700k2/igt@debugfs_test@read_all_entries.html
[53]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-skl-6700k2/igt@debugfs_test@read_all_entries.html
- fi-hsw-4770: [PASS][54] -> [DMESG-WARN][55] ([i915#3660])
[54]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-hsw-4770/igt@debugfs_test@read_all_entries.html
[55]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-hsw-4770/igt@debugfs_test@read_all_entries.html
- fi-kbl-soraka: [PASS][56] -> [DMESG-WARN][57] ([i915#262] / [i915#3660])
[56]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-kbl-soraka/igt@debugfs_test@read_all_entries.html
[57]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-kbl-soraka/igt@debugfs_test@read_all_entries.html
- fi-cfl-guc: [PASS][58] -> [DMESG-WARN][59] ([i915#3660])
[58]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-cfl-guc/igt@debugfs_test@read_all_entries.html
[59]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-cfl-guc/igt@debugfs_test@read_all_entries.html
* igt@runner@aborted:
- fi-ilk-650: NOTRUN -> [FAIL][60] ([i915#2426])
[60]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-ilk-650/igt@runner@aborted.html
- fi-pnv-d510: NOTRUN -> [FAIL][61] ([i915#2403] / [i915#2505])
[61]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-pnv-d510/igt@runner@aborted.html
- fi-bsw-kefka: NOTRUN -> [FAIL][62] ([i915#1250] / [i915#3690])
[62]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-bsw-kefka/igt@runner@aborted.html
- fi-bdw-gvtdvm: NOTRUN -> [FAIL][63] ([i915#2426])
[63]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-bdw-gvtdvm/igt@runner@aborted.html
- fi-cfl-8700k: NOTRUN -> [FAIL][64] ([i915#1814] / [i915#2426] / [i915#3363])
[64]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-cfl-8700k/igt@runner@aborted.html
- fi-skl-6600u: NOTRUN -> [FAIL][65] ([i915#1814] / [i915#2426] / [i915#3363])
[65]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-skl-6600u/igt@runner@aborted.html
- fi-cfl-8109u: NOTRUN -> [FAIL][66] ([i915#1814] / [i915#2426] / [i915#3363])
[66]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-cfl-8109u/igt@runner@aborted.html
- fi-glk-dsi: NOTRUN -> [FAIL][67] ([i915#1814] / [i915#2426] / [i915#3363] / [k.org#202321])
[67]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-glk-dsi/igt@runner@aborted.html
- fi-bsw-nick: NOTRUN -> [FAIL][68] ([i915#1250] / [i915#3690])
[68]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-bsw-nick/igt@runner@aborted.html
- fi-kbl-8809g: NOTRUN -> [FAIL][69] ([i915#1814] / [i915#2426] / [i915#3363])
[69]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-kbl-8809g/igt@runner@aborted.html
- fi-snb-2520m: NOTRUN -> [FAIL][70] ([i915#2426])
[70]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-snb-2520m/igt@runner@aborted.html
- fi-kbl-r: NOTRUN -> [FAIL][71] ([i915#1814] / [i915#2426] / [i915#3363])
[71]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-kbl-r/igt@runner@aborted.html
- fi-bdw-5557u: NOTRUN -> [FAIL][72] ([i915#2426])
[72]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-bdw-5557u/igt@runner@aborted.html
- fi-bwr-2160: NOTRUN -> [FAIL][73] ([i915#2505])
[73]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-bwr-2160/igt@runner@aborted.html
- fi-kbl-soraka: NOTRUN -> [FAIL][74] ([i915#1814] / [i915#2426] / [i915#3363])
[74]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-kbl-soraka/igt@runner@aborted.html
- fi-hsw-4770: NOTRUN -> [FAIL][75] ([i915#2505])
[75]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-hsw-4770/igt@runner@aborted.html
- fi-kbl-7500u: NOTRUN -> [FAIL][76] ([i915#1814] / [i915#2426] / [i915#3363])
[76]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-kbl-7500u/igt@runner@aborted.html
- fi-kbl-guc: NOTRUN -> [FAIL][77] ([i915#1814] / [i915#2426] / [i915#3363])
[77]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-kbl-guc/igt@runner@aborted.html
- fi-snb-2600: NOTRUN -> [FAIL][78] ([i915#2426])
[78]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-snb-2600/igt@runner@aborted.html
- fi-ivb-3770: NOTRUN -> [FAIL][79] ([i915#2426])
[79]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-ivb-3770/igt@runner@aborted.html
- fi-bxt-dsi: NOTRUN -> [FAIL][80] ([i915#1814] / [i915#2426] / [i915#3363])
[80]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-bxt-dsi/igt@runner@aborted.html
- fi-elk-e7500: NOTRUN -> [FAIL][81] ([i915#2426])
[81]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-elk-e7500/igt@runner@aborted.html
- fi-cml-s: NOTRUN -> [FAIL][82] ([i915#1814] / [i915#2082] / [i915#2426] / [i915#3363])
[82]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-cml-s/igt@runner@aborted.html
- fi-cfl-guc: NOTRUN -> [FAIL][83] ([i915#1814] / [i915#2426] / [i915#3363])
[83]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-cfl-guc/igt@runner@aborted.html
- fi-icl-y: NOTRUN -> [FAIL][84] ([i915#1814] / [i915#3690])
[84]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-icl-y/igt@runner@aborted.html
- fi-kbl-7567u: NOTRUN -> [FAIL][85] ([i915#1814] / [i915#2426] / [i915#3363])
[85]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-kbl-7567u/igt@runner@aborted.html
- fi-skl-6700k2: NOTRUN -> [FAIL][86] ([i915#1814] / [i915#2426] / [i915#3363])
[86]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-skl-6700k2/igt@runner@aborted.html
- fi-bsw-n3050: NOTRUN -> [FAIL][87] ([i915#1250] / [i915#3690])
[87]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-bsw-n3050/igt@runner@aborted.html
#### Warnings ####
* igt@debugfs_test@read_all_entries:
- fi-icl-u2: [{ABORT}][88] ([i915#1814]) -> [DMESG-WARN][89] ([i915#3660])
[88]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-icl-u2/igt@debugfs_test@read_all_entries.html
[89]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-icl-u2/igt@debugfs_test@read_all_entries.html
* igt@runner@aborted:
- fi-icl-u2: [FAIL][90] ([i915#1814] / [i915#3363]) -> [FAIL][91] ([i915#1814] / [i915#2426] / [i915#3363] / [i915#3690])
[90]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-icl-u2/igt@runner@aborted.html
[91]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-icl-u2/igt@runner@aborted.html
- fi-apl-guc: [FAIL][92] ([i915#2426] / [i915#3363]) -> [FAIL][93] ([i915#1814] / [i915#2426] / [i915#3363])
[92]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/fi-apl-guc/igt@runner@aborted.html
[93]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/fi-apl-guc/igt@runner@aborted.html
{name}: This element is suppressed. This means it is ignored when computing
the status of the difference (SUCCESS, WARNING, or FAILURE).
[i915#1250]: https://gitlab.freedesktop.org/drm/intel/issues/1250
[i915#1814]: https://gitlab.freedesktop.org/drm/intel/issues/1814
[i915#2082]: https://gitlab.freedesktop.org/drm/intel/issues/2082
[i915#2403]: https://gitlab.freedesktop.org/drm/intel/issues/2403
[i915#2426]: https://gitlab.freedesktop.org/drm/intel/issues/2426
[i915#2505]: https://gitlab.freedesktop.org/drm/intel/issues/2505
[i915#262]: https://gitlab.freedesktop.org/drm/intel/issues/262
[i915#2932]: https://gitlab.freedesktop.org/drm/intel/issues/2932
[i915#3363]: https://gitlab.freedesktop.org/drm/intel/issues/3363
[i915#3626]: https://gitlab.freedesktop.org/drm/intel/issues/3626
[i915#3660]: https://gitlab.freedesktop.org/drm/intel/issues/3660
[i915#3690]: https://gitlab.freedesktop.org/drm/intel/issues/3690
[k.org#202321]: https://bugzilla.kernel.org/show_bug.cgi?id=202321
Participating hosts (39 -> 36)
------------------------------
Missing (3): fi-ilk-m540 fi-bsw-cyan fi-bdw-samus
Build changes
-------------
* Linux: CI_DRM_10295 -> Patchwork_20495
CI-20190529: 20190529
CI_DRM_10295: 683b7f160eb6993ccfc19e67e3c7111f12946bea @ git://anongit.freedesktop.org/gfx-ci/linux
IGT_6124: 357d5477c93f2bdd3354afe91b89ccfd4ee4fd56 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git
Patchwork_20495: 057ea9e5fa3cacd2bff69bbf1c7b3b702aa9d293 @ git://anongit.freedesktop.org/gfx-ci/linux
== Linux commits ==
057ea9e5fa3c drm: protect drm_master pointers in drm_lease.c
21e2781892f6 drm: add a locked version of drm_is_current_master
dbd6d7ef5160 drm: avoid circular locks in __drm_mode_object_find
13940bd0a105 drm: avoid circular locks in drm_mode_getconnector
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/index.html
[-- Attachment #1.2: Type: text/html, Size: 25930 bytes --]
[-- Attachment #2: Type: text/plain, Size: 160 bytes --]
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 23+ messages in thread
* [Intel-gfx] ✗ Fi.CI.IGT: failure for drm: address potential UAF bugs with drm_master ptrs
2021-06-30 14:54 ` Desmond Cheong Zhi Xi
` (8 preceding siblings ...)
(?)
@ 2021-07-01 1:04 ` Patchwork
-1 siblings, 0 replies; 23+ messages in thread
From: Patchwork @ 2021-07-01 1:04 UTC (permalink / raw)
To: Desmond Cheong Zhi Xi; +Cc: intel-gfx
[-- Attachment #1.1: Type: text/plain, Size: 30275 bytes --]
== Series Details ==
Series: drm: address potential UAF bugs with drm_master ptrs
URL : https://patchwork.freedesktop.org/series/92076/
State : failure
== Summary ==
CI Bug Log - changes from CI_DRM_10295_full -> Patchwork_20495_full
====================================================
Summary
-------
**FAILURE**
Serious unknown changes coming with Patchwork_20495_full absolutely need to be
verified manually.
If you think the reported changes have nothing to do with the changes
introduced in Patchwork_20495_full, please notify your bug team to allow them
to document this new failure mode, which will reduce false positives in CI.
Possible new issues
-------------------
Here are the unknown changes that may have been introduced in Patchwork_20495_full:
### IGT changes ###
#### Possible regressions ####
* igt@gem_exec_reloc@basic-cpu-wc:
- shard-kbl: [PASS][1] -> [DMESG-WARN][2] +1 similar issue
[1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl3/igt@gem_exec_reloc@basic-cpu-wc.html
[2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl3/igt@gem_exec_reloc@basic-cpu-wc.html
* igt@gem_exec_reloc@basic-write-wc:
- shard-snb: [PASS][3] -> [DMESG-WARN][4] +7 similar issues
[3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-snb2/igt@gem_exec_reloc@basic-write-wc.html
[4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-snb7/igt@gem_exec_reloc@basic-write-wc.html
* igt@kms_frontbuffer_tracking@fbc-1p-primscrn-cur-indfb-draw-blt:
- shard-snb: NOTRUN -> [DMESG-WARN][5] +2 similar issues
[5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-snb2/igt@kms_frontbuffer_tracking@fbc-1p-primscrn-cur-indfb-draw-blt.html
* igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb:
- shard-iclb: [PASS][6] -> [DMESG-WARN][7] +12 similar issues
[6]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-iclb2/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
[7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb7/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
* igt@kms_vblank@pipe-a-wait-busy:
- shard-tglb: [PASS][8] -> [DMESG-WARN][9] +9 similar issues
[8]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-tglb5/igt@kms_vblank@pipe-a-wait-busy.html
[9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb6/igt@kms_vblank@pipe-a-wait-busy.html
#### Warnings ####
* igt@runner@aborted:
- shard-iclb: ([FAIL][10], [FAIL][11]) ([i915#3002]) -> ([FAIL][12], [FAIL][13], [FAIL][14], [FAIL][15], [FAIL][16], [FAIL][17], [FAIL][18], [FAIL][19], [FAIL][20], [FAIL][21], [FAIL][22], [FAIL][23], [FAIL][24], [FAIL][25], [FAIL][26], [FAIL][27], [FAIL][28], [FAIL][29], [FAIL][30], [FAIL][31], [FAIL][32], [FAIL][33], [FAIL][34], [FAIL][35], [FAIL][36]) ([i915#1814] / [i915#2426] / [i915#3690])
[10]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-iclb3/igt@runner@aborted.html
[11]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-iclb2/igt@runner@aborted.html
[12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb1/igt@runner@aborted.html
[13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb4/igt@runner@aborted.html
[14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb6/igt@runner@aborted.html
[15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb4/igt@runner@aborted.html
[16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb7/igt@runner@aborted.html
[17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb7/igt@runner@aborted.html
[18]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb3/igt@runner@aborted.html
[19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb8/igt@runner@aborted.html
[20]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb6/igt@runner@aborted.html
[21]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb4/igt@runner@aborted.html
[22]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb3/igt@runner@aborted.html
[23]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb7/igt@runner@aborted.html
[24]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb3/igt@runner@aborted.html
[25]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb1/igt@runner@aborted.html
[26]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb5/igt@runner@aborted.html
[27]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb3/igt@runner@aborted.html
[28]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb2/igt@runner@aborted.html
[29]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb6/igt@runner@aborted.html
[30]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb6/igt@runner@aborted.html
[31]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb1/igt@runner@aborted.html
[32]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb8/igt@runner@aborted.html
[33]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb2/igt@runner@aborted.html
[34]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb1/igt@runner@aborted.html
[35]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb5/igt@runner@aborted.html
[36]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb5/igt@runner@aborted.html
- shard-tglb: ([FAIL][37], [FAIL][38], [FAIL][39]) ([i915#1814] / [i915#2426] / [i915#3002] / [i915#3690]) -> ([FAIL][40], [FAIL][41], [FAIL][42], [FAIL][43], [FAIL][44], [FAIL][45], [FAIL][46], [FAIL][47], [FAIL][48], [FAIL][49], [FAIL][50], [FAIL][51], [FAIL][52], [FAIL][53], [FAIL][54], [FAIL][55], [FAIL][56], [FAIL][57], [FAIL][58], [FAIL][59], [FAIL][60], [FAIL][61], [FAIL][62], [FAIL][63], [FAIL][64]) ([i915#1436] / [i915#1602] / [i915#1814] / [i915#2426] / [i915#3690] / [i915#402] / [i915#456])
[37]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-tglb1/igt@runner@aborted.html
[38]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-tglb6/igt@runner@aborted.html
[39]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-tglb7/igt@runner@aborted.html
[40]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb3/igt@runner@aborted.html
[41]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb2/igt@runner@aborted.html
[42]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb2/igt@runner@aborted.html
[43]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb2/igt@runner@aborted.html
[44]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb3/igt@runner@aborted.html
[45]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb2/igt@runner@aborted.html
[46]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb2/igt@runner@aborted.html
[47]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb2/igt@runner@aborted.html
[48]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb1/igt@runner@aborted.html
[49]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb3/igt@runner@aborted.html
[50]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb1/igt@runner@aborted.html
[51]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb1/igt@runner@aborted.html
[52]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb1/igt@runner@aborted.html
[53]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb5/igt@runner@aborted.html
[54]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb1/igt@runner@aborted.html
[55]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb5/igt@runner@aborted.html
[56]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb5/igt@runner@aborted.html
[57]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb6/igt@runner@aborted.html
[58]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb6/igt@runner@aborted.html
[59]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb6/igt@runner@aborted.html
[60]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb6/igt@runner@aborted.html
[61]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb7/igt@runner@aborted.html
[62]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb7/igt@runner@aborted.html
[63]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb7/igt@runner@aborted.html
[64]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb7/igt@runner@aborted.html
#### Suppressed ####
The following results come from untrusted machines, tests, or statuses.
They do not affect the overall result.
* igt@gem_exec_reloc@basic-cpu-wc:
- {shard-rkl}: [PASS][65] -> [DMESG-WARN][66] +1 similar issue
[65]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-rkl-6/igt@gem_exec_reloc@basic-cpu-wc.html
[66]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@gem_exec_reloc@basic-cpu-wc.html
* igt@kms_addfb_basic@clobberred-modifier:
- {shard-rkl}: NOTRUN -> [DMESG-WARN][67]
[67]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-5/igt@kms_addfb_basic@clobberred-modifier.html
* igt@kms_ccs@pipe-c-crc-sprite-planes-basic-y_tiled_gen12_rc_ccs_cc:
- {shard-rkl}: [FAIL][68] -> [DMESG-WARN][69]
[68]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-rkl-2/igt@kms_ccs@pipe-c-crc-sprite-planes-basic-y_tiled_gen12_rc_ccs_cc.html
[69]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-6/igt@kms_ccs@pipe-c-crc-sprite-planes-basic-y_tiled_gen12_rc_ccs_cc.html
* igt@kms_cursor_crc@pipe-a-cursor-128x128-onscreen:
- {shard-rkl}: [SKIP][70] -> [DMESG-WARN][71]
[70]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-rkl-5/igt@kms_cursor_crc@pipe-a-cursor-128x128-onscreen.html
[71]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-6/igt@kms_cursor_crc@pipe-a-cursor-128x128-onscreen.html
* igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-cur-indfb-draw-mmap-wc:
- {shard-rkl}: [SKIP][72] ([i915#1849]) -> [SKIP][73]
[72]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-rkl-5/igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-cur-indfb-draw-mmap-wc.html
[73]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-cur-indfb-draw-mmap-wc.html
* igt@kms_frontbuffer_tracking@fbcpsr-2p-primscrn-spr-indfb-draw-mmap-cpu:
- {shard-rkl}: [SKIP][74] ([fdo#111825] / [i915#1825]) -> [SKIP][75]
[74]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-rkl-6/igt@kms_frontbuffer_tracking@fbcpsr-2p-primscrn-spr-indfb-draw-mmap-cpu.html
[75]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@kms_frontbuffer_tracking@fbcpsr-2p-primscrn-spr-indfb-draw-mmap-cpu.html
* igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb:
- {shard-rkl}: [PASS][76] -> [SKIP][77]
[76]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-rkl-6/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
[77]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
* igt@runner@aborted:
- {shard-rkl}: ([FAIL][78], [FAIL][79]) ([i915#3002]) -> ([FAIL][80], [FAIL][81], [FAIL][82], [FAIL][83], [FAIL][84], [FAIL][85], [FAIL][86], [FAIL][87], [FAIL][88], [FAIL][89], [FAIL][90], [FAIL][91], [FAIL][92], [FAIL][93], [FAIL][94], [FAIL][95], [FAIL][96], [FAIL][97], [FAIL][98], [FAIL][99], [FAIL][100], [FAIL][101], [FAIL][102], [FAIL][103], [FAIL][104]) ([i915#1602])
[78]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-rkl-5/igt@runner@aborted.html
[79]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-rkl-1/igt@runner@aborted.html
[80]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-6/igt@runner@aborted.html
[81]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-6/igt@runner@aborted.html
[82]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-6/igt@runner@aborted.html
[83]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-6/igt@runner@aborted.html
[84]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-6/igt@runner@aborted.html
[85]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-5/igt@runner@aborted.html
[86]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-5/igt@runner@aborted.html
[87]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-5/igt@runner@aborted.html
[88]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-5/igt@runner@aborted.html
[89]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-5/igt@runner@aborted.html
[90]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-5/igt@runner@aborted.html
[91]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-5/igt@runner@aborted.html
[92]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-2/igt@runner@aborted.html
[93]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-2/igt@runner@aborted.html
[94]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-2/igt@runner@aborted.html
[95]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-2/igt@runner@aborted.html
[96]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-2/igt@runner@aborted.html
[97]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-2/igt@runner@aborted.html
[98]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@runner@aborted.html
[99]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@runner@aborted.html
[100]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@runner@aborted.html
[101]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@runner@aborted.html
[102]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@runner@aborted.html
[103]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@runner@aborted.html
[104]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@runner@aborted.html
Known issues
------------
Here are the changes found in Patchwork_20495_full that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@gem_ctx_persistence@engines-queued:
- shard-snb: NOTRUN -> [SKIP][105] ([fdo#109271] / [i915#1099])
[105]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-snb7/igt@gem_ctx_persistence@engines-queued.html
* igt@gem_eio@in-flight-suspend:
- shard-skl: [PASS][106] -> [DMESG-WARN][107] ([i915#1610]) +7 similar issues
[106]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-skl7/igt@gem_eio@in-flight-suspend.html
[107]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-skl1/igt@gem_eio@in-flight-suspend.html
* igt@kms_addfb_basic@clobberred-modifier:
- shard-glk: NOTRUN -> [DMESG-WARN][108] ([i915#1610])
[108]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-glk2/igt@kms_addfb_basic@clobberred-modifier.html
* igt@kms_big_fb@yf-tiled-max-hw-stride-32bpp-rotate-0-async-flip:
- shard-apl: [PASS][109] -> [DMESG-WARN][110] ([i915#1610]) +5 similar issues
[109]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-apl1/igt@kms_big_fb@yf-tiled-max-hw-stride-32bpp-rotate-0-async-flip.html
[110]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl3/igt@kms_big_fb@yf-tiled-max-hw-stride-32bpp-rotate-0-async-flip.html
* igt@kms_color@pipe-b-gamma:
- shard-iclb: [PASS][111] -> [DMESG-WARN][112] ([i915#1149])
[111]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-iclb2/igt@kms_color@pipe-b-gamma.html
[112]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb6/igt@kms_color@pipe-b-gamma.html
- shard-apl: NOTRUN -> [DMESG-WARN][113] ([i915#1610]) +3 similar issues
[113]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl6/igt@kms_color@pipe-b-gamma.html
- shard-tglb: [PASS][114] -> [DMESG-WARN][115] ([i915#1149])
[114]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-tglb2/igt@kms_color@pipe-b-gamma.html
[115]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb1/igt@kms_color@pipe-b-gamma.html
* igt@kms_cursor_legacy@cursorb-vs-flipa-legacy:
- shard-apl: NOTRUN -> [SKIP][116] ([fdo#109271]) +2 similar issues
[116]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl7/igt@kms_cursor_legacy@cursorb-vs-flipa-legacy.html
* igt@kms_frontbuffer_tracking@fbcpsr-2p-primscrn-spr-indfb-draw-mmap-cpu:
- shard-snb: NOTRUN -> [SKIP][117] ([fdo#109271]) +4 similar issues
[117]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-snb7/igt@kms_frontbuffer_tracking@fbcpsr-2p-primscrn-spr-indfb-draw-mmap-cpu.html
* igt@kms_plane_cursor@pipe-a-primary-size-256:
- shard-kbl: [PASS][118] -> [DMESG-WARN][119] ([i915#1610]) +8 similar issues
[118]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl2/igt@kms_plane_cursor@pipe-a-primary-size-256.html
[119]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl7/igt@kms_plane_cursor@pipe-a-primary-size-256.html
- shard-skl: NOTRUN -> [DMESG-WARN][120] ([i915#1610])
[120]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-skl7/igt@kms_plane_cursor@pipe-a-primary-size-256.html
* igt@kms_plane_cursor@pipe-a-primary-size-64:
- shard-glk: [PASS][121] -> [DMESG-WARN][122] ([i915#1610]) +11 similar issues
[121]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-glk3/igt@kms_plane_cursor@pipe-a-primary-size-64.html
[122]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-glk9/igt@kms_plane_cursor@pipe-a-primary-size-64.html
* igt@kms_psr2_su@page_flip:
- shard-apl: NOTRUN -> [SKIP][123] ([fdo#109271] / [i915#658])
[123]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl3/igt@kms_psr2_su@page_flip.html
* igt@kms_vblank@pipe-a-ts-continuation-suspend:
- shard-kbl: [PASS][124] -> [DMESG-WARN][125] ([i915#1610] / [i915#295])
[124]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl1/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
[125]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl4/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
- shard-tglb: [PASS][126] -> [DMESG-WARN][127] ([i915#2411]) +1 similar issue
[126]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-tglb6/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
[127]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb7/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
- shard-glk: [PASS][128] -> [DMESG-WARN][129] ([i915#1610] / [i915#295])
[128]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-glk9/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
[129]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-glk7/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
- shard-skl: [PASS][130] -> [DMESG-WARN][131] ([i915#1610] / [i915#295])
[130]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-skl10/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
[131]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-skl1/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
#### Warnings ####
* igt@kms_big_fb@yf-tiled-max-hw-stride-32bpp-rotate-0-async-flip:
- shard-skl: [FAIL][132] -> [DMESG-FAIL][133] ([i915#1610])
[132]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-skl10/igt@kms_big_fb@yf-tiled-max-hw-stride-32bpp-rotate-0-async-flip.html
[133]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-skl1/igt@kms_big_fb@yf-tiled-max-hw-stride-32bpp-rotate-0-async-flip.html
* igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb:
- shard-skl: [FAIL][134] ([i915#265]) -> [DMESG-FAIL][135] ([i915#1610] / [i915#265])
[134]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-skl4/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
[135]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-skl6/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
- shard-apl: [FAIL][136] ([i915#265]) -> [DMESG-FAIL][137] ([i915#1610] / [i915#265])
[136]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-apl7/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
[137]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl6/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
- shard-glk: [FAIL][138] ([i915#265]) -> [DMESG-FAIL][139] ([i915#1610] / [i915#265])
[138]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-glk9/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
[139]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-glk1/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
- shard-kbl: [FAIL][140] ([i915#265]) -> [DMESG-FAIL][141] ([i915#1610] / [i915#265])
[140]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl1/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
[141]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl2/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
* igt@kms_vblank@pipe-a-ts-continuation-suspend:
- shard-apl: [DMESG-WARN][142] ([i915#180] / [i915#295]) -> [DMESG-WARN][143] ([i915#1610] / [i915#295])
[142]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-apl6/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
[143]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl3/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
* igt@runner@aborted:
- shard-kbl: ([FAIL][144], [FAIL][145], [FAIL][146], [FAIL][147], [FAIL][148], [FAIL][149], [FAIL][150], [FAIL][151], [FAIL][152], [FAIL][153], [FAIL][154], [FAIL][155], [FAIL][156]) ([i915#1436] / [i915#180] / [i915#1814] / [i915#3002] / [i915#3363] / [i915#602] / [i915#92]) -> ([FAIL][157], [FAIL][158], [FAIL][159], [FAIL][160], [FAIL][161], [FAIL][162], [FAIL][163], [FAIL][164], [FAIL][165], [FAIL][166], [FAIL][167], [FAIL][168], [FAIL][169], [FAIL][170], [FAIL][171], [FAIL][172], [FAIL][173], [FAIL][174], [FAIL][175], [FAIL][176], [FAIL][177], [FAIL][178], [FAIL][179], [FAIL][180], [FAIL][181]) ([fdo#109271] / [i915#1436] / [i915#1814] / [i915#2426] / [i915#2505] / [i915#3363] / [i915#602])
[144]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl2/igt@runner@aborted.html
[145]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl3/igt@runner@aborted.html
[146]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl2/igt@runner@aborted.html
[147]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl7/igt@runner@aborted.html
[148]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl7/igt@runner@aborted.html
[149]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl4/igt@runner@aborted.html
[150]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl7/igt@runner@aborted.html
[151]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl4/igt@runner@aborted.html
[152]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl2/igt@runner@aborted.html
[153]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl1/igt@runner@aborted.html
[154]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl3/igt@runner@aborted.html
[155]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl2/igt@runner@aborted.html
[156]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl7/igt@runner@aborted.html
[157]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl7/igt@runner@aborted.html
[158]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl7/igt@runner@aborted.html
[159]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl7/igt@runner@aborted.html
[160]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl7/igt@runner@aborted.html
[161]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl7/igt@runner@aborted.html
[162]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl6/igt@runner@aborted.html
[163]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl6/igt@runner@aborted.html
[164]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl6/igt@runner@aborted.html
[165]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl6/igt@runner@aborted.html
[166]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl4/igt@runner@aborted.html
[167]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl2/igt@runner@aborted.html
[168]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl4/igt@runner@aborted.html
[169]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl1/igt@runner@aborted.html
[170]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl2/igt@runner@aborted.html
[171]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl3/igt@runner@aborted.html
[172]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl4/igt@runner@aborted.html
[173]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl6/igt@runner@aborted.html
[174]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl3/igt@runner@aborted.html
[175]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl3/igt@runner@aborted.html
[176]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl1/igt@runner@aborted.html
[177]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl2/igt@runner@aborted.html
[178]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl3/igt@runner@aborted.html
[179]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl4/igt@runner@aborted.html
[180]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl4/igt@runner@aborted.html
[181]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl2/igt@runner@aborted.html
- shard-apl: ([FAIL][182], [FAIL][183], [FAIL][184], [FAIL][185]) ([fdo#109271] / [i915#180] / [i915#1814] / [i915#3363]) -> ([FAIL][186], [FAIL][187], [FAIL][188], [FAIL][189], [FAIL][190], [FAIL][191], [FAIL][192], [FAIL][193], [FAIL][194], [FAIL][195], [FAIL][196], [FAIL][197], [FAIL][198], [FAIL][199], [FAIL][200], [FAIL][201], [FAIL][202], [FAIL][203], [FAIL][204], [FAIL][205], [FAIL][206], [FAIL][207]) ([fdo#109271] / [i915#1610] / [i915#1814] / [i915#2426] / [i915#3363])
[182]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-apl6/igt@runner@aborted.html
[183]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-apl6/igt@runner@aborted.html
[184]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-apl8/igt@runner@aborted.html
[185]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-apl3/igt@runner@aborted.html
[186]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl1/igt@runner@aborted.html
[187]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl6/igt@runner@aborted.html
[188]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl3/igt@runner@aborted.html
[189]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl2/igt@runner@aborted.html
[190]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl6/igt@runner@aborted.html
[191]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl8/igt@runner@aborted.html
[192]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl8/igt@runner@aborted.html
[193]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl6/igt@runner@aborted.html
[194]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl7/igt@runner@aborted.html
[195]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl1/igt@runner@aborted.html
[196]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl3/igt@runner@aborted.html
[197]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl7/igt@runner@aborted.html
[198]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl1/igt@runner@aborted.html
[199]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl6/igt@runner@aborted.html
[200]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl8/igt@runner@aborted.html
[201]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl2/igt@runner@aborted.html
[202]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl1/igt@runner@aborted.html
[203]: h
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/index.html
[-- Attachment #1.2: Type: text/html, Size: 31835 bytes --]
[-- Attachment #2: Type: text/plain, Size: 160 bytes --]
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 23+ messages in thread