From: "Christian König" <christian.koenig@amd.com>
To: "Kazlauskas, Nicholas" <nicholas.kazlauskas@amd.com>,
Mazin Rezk <mnrzk@protonmail.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"amd-gfx@lists.freedesktop.org" <amd-gfx@lists.freedesktop.org>,
"dri-devel@lists.freedesktop.org"
<dri-devel@lists.freedesktop.org>
Cc: Paul Menzel <pmenzel@molgen.mpg.de>,
"anthony.ruhier@gmail.com" <anthony.ruhier@gmail.com>,
Duncan <1i5t5.duncan@cox.net>, Kees Cook <keescook@chromium.org>,
"sunpeng.li@amd.com" <sunpeng.li@amd.com>,
"regressions@leemhuis.info" <regressions@leemhuis.info>,
Alexander Deucher <Alexander.Deucher@amd.com>,
Andrew Morton <akpm@linux-foundation.org>,
"mphantomx@yahoo.com.br" <mphantomx@yahoo.com.br>
Subject: Re: [PATCH] drm/amd/display: Clear dm_state for fast updates
Date: Mon, 27 Jul 2020 21:28:15 +0200 [thread overview]
Message-ID: <3b7e3e50-2ff7-eff3-2ffc-abaa4b36ce7f@amd.com> (raw)
In-Reply-To: <e2f55480-c24f-6c85-08d3-21131a22d0bf@amd.com>
Am 27.07.20 um 16:05 schrieb Kazlauskas, Nicholas:
> On 2020-07-27 9:39 a.m., Christian König wrote:
>> Am 27.07.20 um 07:40 schrieb Mazin Rezk:
>>> This patch fixes a race condition that causes a use-after-free during
>>> amdgpu_dm_atomic_commit_tail. This can occur when 2 non-blocking
>>> commits
>>> are requested and the second one finishes before the first.
>>> Essentially,
>>> this bug occurs when the following sequence of events happens:
>>>
>>> 1. Non-blocking commit #1 is requested w/ a new dm_state #1 and is
>>> deferred to the workqueue.
>>>
>>> 2. Non-blocking commit #2 is requested w/ a new dm_state #2 and is
>>> deferred to the workqueue.
>>>
>>> 3. Commit #2 starts before commit #1, dm_state #1 is used in the
>>> commit_tail and commit #2 completes, freeing dm_state #1.
>>>
>>> 4. Commit #1 starts after commit #2 completes, uses the freed dm_state
>>> 1 and dereferences a freelist pointer while setting the context.
>>
>> Well I only have a one mile high view on this, but why don't you let
>> the work items execute in order?
>>
>> That would be better anyway cause this way we don't trigger a cache
>> line ping pong between CPUs.
>>
>> Christian.
>
> We use the DRM helpers for managing drm_atomic_commit_state and those
> helpers internally push non-blocking commit work into the system
> unbound work queue.
Mhm, well if you send those helper atomic commits in the order A,B and
they execute it in the order B,A I would call that a bug :)
> While we could duplicate a copy of that code with nothing but the
> workqueue changed that isn't something I'd really like to maintain
> going forward.
I'm not talking about duplicating the code, I'm talking about fixing the
helpers. I don't know that code well, but from the outside it sounds
like a bug there.
And executing work items in the order they are submitted is trivial.
Had anybody pinged Daniel or other people familiar with the helper code
about it?
Regards,
Christian.
>
> Regards,
> Nicholas Kazlauskas
>
>>
>>>
>>> Since this bug has only been spotted with fast commits, this patch
>>> fixes
>>> the bug by clearing the dm_state instead of using the old dc_state for
>>> fast updates. In addition, since dm_state is only used for its dc_state
>>> and amdgpu_dm_atomic_commit_tail will retain the dc_state if none is
>>> found,
>>> removing the dm_state should not have any consequences in fast updates.
>>>
>>> This use-after-free bug has existed for a while now, but only caused a
>>> noticeable issue starting from 5.7-rc1 due to 3202fa62f ("slub:
>>> relocate
>>> freelist pointer to middle of object") moving the freelist pointer from
>>> dm_state->base (which was unused) to dm_state->context (which is
>>> dereferenced).
>>>
>>> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=207383
>>> Fixes: bd200d190f45 ("drm/amd/display: Don't replace the dc_state
>>> for fast updates")
>>> Reported-by: Duncan <1i5t5.duncan@cox.net>
>>> Signed-off-by: Mazin Rezk <mnrzk@protonmail.com>
>>> ---
>>> .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 36
>>> ++++++++++++++-----
>>> 1 file changed, 27 insertions(+), 9 deletions(-)
>>>
>>> diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
>>> b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
>>> index 86ffa0c2880f..710edc70e37e 100644
>>> --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
>>> +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
>>> @@ -8717,20 +8717,38 @@ static int amdgpu_dm_atomic_check(struct
>>> drm_device *dev,
>>> * the same resource. If we have a new DC context as part of
>>> * the DM atomic state from validation we need to free it and
>>> * retain the existing one instead.
>>> + *
>>> + * Furthermore, since the DM atomic state only contains the DC
>>> + * context and can safely be annulled, we can free the state
>>> + * and clear the associated private object now to free
>>> + * some memory and avoid a possible use-after-free later.
>>> */
>>> - struct dm_atomic_state *new_dm_state, *old_dm_state;
>>>
>>> - new_dm_state = dm_atomic_get_new_state(state);
>>> - old_dm_state = dm_atomic_get_old_state(state);
>>> + for (i = 0; i < state->num_private_objs; i++) {
>>> + struct drm_private_obj *obj = state->private_objs[i].ptr;
>>>
>>> - if (new_dm_state && old_dm_state) {
>>> - if (new_dm_state->context)
>>> - dc_release_state(new_dm_state->context);
>>> + if (obj->funcs == adev->dm.atomic_obj.funcs) {
>>> + int j = state->num_private_objs-1;
>>>
>>> - new_dm_state->context = old_dm_state->context;
>>> + dm_atomic_destroy_state(obj,
>>> + state->private_objs[i].state);
>>> +
>>> + /* If i is not at the end of the array then the
>>> + * last element needs to be moved to where i was
>>> + * before the array can safely be truncated.
>>> + */
>>> + if (i != j)
>>> + state->private_objs[i] =
>>> + state->private_objs[j];
>>>
>>> - if (old_dm_state->context)
>>> - dc_retain_state(old_dm_state->context);
>>> + state->private_objs[j].ptr = NULL;
>>> + state->private_objs[j].state = NULL;
>>> + state->private_objs[j].old_state = NULL;
>>> + state->private_objs[j].new_state = NULL;
>>> +
>>> + state->num_private_objs = j;
>>> + break;
>>> + }
>>> }
>>> }
>>>
>>> --
>>> 2.27.0
>>>
>>
>
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply other threads:[~2020-07-27 19:28 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-27 5:40 [PATCH] drm/amd/display: Clear dm_state for fast updates Mazin Rezk
2020-07-27 5:53 ` Mazin Rezk
2020-07-27 13:26 ` Kazlauskas, Nicholas
2020-07-27 20:27 ` Mazin Rezk
2020-07-27 13:39 ` Christian König
2020-07-27 14:05 ` Kazlauskas, Nicholas
2020-07-27 15:37 ` Duncan
2020-07-27 19:28 ` Christian König [this message]
2020-07-27 20:29 ` Daniel Vetter
2020-07-27 21:09 ` Daniel Vetter
2020-07-27 21:11 ` Mazin Rezk
2020-07-27 21:32 ` Daniel Vetter
2020-07-27 23:42 ` Mazin Rezk
2020-07-28 4:42 ` Mazin Rezk
2020-07-28 2:49 ` Kazlauskas, Nicholas
2020-07-28 9:08 ` daniel
2020-07-29 16:49 ` Kazlauskas, Nicholas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3b7e3e50-2ff7-eff3-2ffc-abaa4b36ce7f@amd.com \
--to=christian.koenig@amd.com \
--cc=1i5t5.duncan@cox.net \
--cc=Alexander.Deucher@amd.com \
--cc=akpm@linux-foundation.org \
--cc=amd-gfx@lists.freedesktop.org \
--cc=anthony.ruhier@gmail.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mnrzk@protonmail.com \
--cc=mphantomx@yahoo.com.br \
--cc=nicholas.kazlauskas@amd.com \
--cc=pmenzel@molgen.mpg.de \
--cc=regressions@leemhuis.info \
--cc=sunpeng.li@amd.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).