[Bug 111682] use-after-free in amdgpu_vm_update_directories

[Bug 111682] use-after-free in amdgpu_vm_update_directories

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 1096 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=111682

            Bug ID: 111682
           Summary: use-after-free in amdgpu_vm_update_directories
           Product: DRI
           Version: XOrg git
          Hardware: Other
                OS: All
            Status: NEW
          Severity: not set
          Priority: not set
         Component: DRM/AMDgpu
          Assignee: dri-devel@lists.freedesktop.org
          Reporter: pierre-eric.pelloux-prayer@amd.com

Created attachment 145345
  --> https://bugs.freedesktop.org/attachment.cgi?id=145345&action=edit
dmesg output

When using amdgpu.vm_update_mode=3 the following error appears after some time
(ranging from a few minutes to a few hours):

BUG: KASAN: use-after-free in amdgpu_vm_update_directories

I attached the relevant dmesg part.

Notes:
- happens on Navi10 and gfx9 (probably also on other cards but I didn't try)
- reproduced on 865b4ca43816e113996c3be571d4998b6daf5f1 and
20d6b9c3b7f40ec427af912d140f2be0de098d2d

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 2506 bytes --]

[-- Attachment #2: Type: text/plain, Size: 159 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 111682] use-after-free in amdgpu_vm_update_directories

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 484 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=111682

--- Comment #1 from Andrey Grodzovsky <andrey.grodzovsky@amd.com> ---
Which kernel branch are you using ? I couldn't find 
amdgpu_vm_update_directories in latest code in amd-staging-drm-next and turns
out it was renamed to amdgpu_vm_update_pdes in
78b20c2ee6788ba0df8b36b1369bc7e264262d3b back in March so seems like this is
very outdated code.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 1272 bytes --]

[-- Attachment #2: Type: text/plain, Size: 159 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 111682] use-after-free in amdgpu_vm_update_directories

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 861 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=111682

--- Comment #2 from Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com> ---
(In reply to Andrey Grodzovsky from comment #1)
> Which kernel branch are you using ? I couldn't find 
> amdgpu_vm_update_directories in latest code in amd-staging-drm-next and
> turns out it was renamed to amdgpu_vm_update_pdes in
> 78b20c2ee6788ba0df8b36b1369bc7e264262d3b back in March so seems like this is
> very outdated code.

I'm using amd-staging-drm-next from a few days ago.

But 78b20c2ee6788ba0df8b36b1369bc7e264262d3b (drm/amdgpu: allow direct
submission of PDE updates v2) has been pushed in this branch recently and
indeed it renamed the function.

I'll rebuild a kernel and test if the issue is still there.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 1750 bytes --]

[-- Attachment #2: Type: text/plain, Size: 159 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 111682] use-after-free in amdgpu_vm_update_directories

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 561 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=111682

--- Comment #3 from Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com> ---
Created attachment 145387
  --> https://bugs.freedesktop.org/attachment.cgi?id=145387&action=edit
dmesg when using cfdabd064b2d(drm/amdgpu: remove the redundant null checks)

Using the latest commit from amd-staging-drm-next (= cfdabd064b2d58f
"drm/amdgpu: remove the redundant null checks"): the use-after-free bug is
still there.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 1619 bytes --]

[-- Attachment #2: Type: text/plain, Size: 159 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 111682] use-after-free in amdgpu_vm_update_pdes

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 534 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=111682

Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|use-after-free in           |use-after-free in
                   |amdgpu_vm_update_directorie |amdgpu_vm_update_pdes
                   |s                           |

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 1184 bytes --]

[-- Attachment #2: Type: text/plain, Size: 159 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

[Bug 111682] use-after-free in amdgpu_vm_update_pdes

[bugzilla-daemon]

[-- Attachment #1.1: Type: text/plain, Size: 805 bytes --]

https://bugs.freedesktop.org/show_bug.cgi?id=111682

Martin Peres <martin.peres@free.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |MOVED

--- Comment #4 from Martin Peres <martin.peres@free.fr> ---
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been
closed from further activity.

You can subscribe and participate further through the new bug through this link
to our GitLab instance: https://gitlab.freedesktop.org/drm/amd/issues/905.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[-- Attachment #1.2: Type: text/html, Size: 2341 bytes --]

[-- Attachment #2: Type: text/plain, Size: 159 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel