From: bugzilla-daemon@bugzilla.kernel.org To: dri-devel@lists.freedesktop.org Subject: [Bug 207383] [Regression] 5.7 amdgpu/polaris11 gpf: amdgpu_atomic_commit_tail Date: Sun, 26 Jul 2020 18:40:55 +0000 Message-ID: <bug-207383-2300-zSXBhK7kGU@https.bugzilla.kernel.org/> (raw) In-Reply-To: <bug-207383-2300@https.bugzilla.kernel.org/> https://bugzilla.kernel.org/show_bug.cgi?id=207383 --- Comment #95 from Nicholas Kazlauskas (nicholas.kazlauskas@amd.com) --- Created attachment 290583 --> https://bugzilla.kernel.org/attachment.cgi?id=290583&action=edit 0001-drm-amd-display-Force-add-all-CRTCs-to-state-when-us.patch So the sequence looks like the following: 1. Non-blocking commit #1 requested, checked, swaps state and deferred to work queue. 2. Non-blocking commit #2 requested, checked, swaps state and deferred to work queue. Commits #1 and #2 don't touch any of the same core DRM objects (CRTCs, Planes, Connectors) so Commit #2 does not stall for Commit #1. DRM Private Objects have always been avoided in stall checks, so we have no safety from DRM core in this regard. 3. Due to system load commit #2 executes first and finishes its commit tail work. At the end of commit tail, as part of DRM core, it calls drm_atomic_state_put(). Since this was the pageflip IOCTL we likely already dropped the reference on the state held by the IOCTL itself. So it's going to actually free at this point. This eventually calls drm_atomic_state_clear() which does the following: obj->funcs->atomic_destroy_state(obj, state->private_objs[i].state); Note that it clears "state" here. Commit sets "state" to the following: state->private_objs[i].state = old_obj_state; obj->state = new_obj_state; Since Commit #1 swapped first this means Commit #2 actually does free Commit #1's private object. 4. Commit #1 then executes and we get a use after free. Same bug, it's just this was never corrupted before by the slab changes. It's been sitting dormant for 5.0~5.8. Attached is a patch that might help resolve this. -- You are receiving this mail because: You are watching the assignee of the bug. _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply index Thread overview: 121+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-04-21 9:51 [Bug 207383] New: [Regression] 5.7-rc: " bugzilla-daemon 2020-04-21 9:57 ` [Bug 207383] " bugzilla-daemon 2020-04-21 10:04 ` bugzilla-daemon 2020-04-23 4:59 ` bugzilla-daemon 2020-04-27 19:24 ` bugzilla-daemon 2020-04-27 19:42 ` bugzilla-daemon 2020-04-27 19:43 ` bugzilla-daemon 2020-05-01 8:20 ` bugzilla-daemon 2020-05-01 8:28 ` bugzilla-daemon 2020-05-02 16:03 ` bugzilla-daemon 2020-05-03 15:10 ` bugzilla-daemon 2020-05-05 4:23 ` bugzilla-daemon 2020-05-06 17:46 ` bugzilla-daemon 2020-05-06 22:06 ` bugzilla-daemon 2020-06-03 0:04 ` [Bug 207383] [Regression] 5.7 " bugzilla-daemon 2020-06-21 7:01 ` bugzilla-daemon 2020-06-22 15:20 ` bugzilla-daemon 2020-06-22 17:44 ` bugzilla-daemon 2020-06-22 17:57 ` bugzilla-daemon 2020-06-22 19:36 ` bugzilla-daemon 2020-06-22 20:00 ` bugzilla-daemon 2020-06-23 15:36 ` bugzilla-daemon 2020-06-23 23:41 ` bugzilla-daemon 2020-06-24 8:55 ` bugzilla-daemon 2020-06-27 4:37 ` bugzilla-daemon 2020-06-27 4:38 ` bugzilla-daemon 2020-06-27 5:16 ` bugzilla-daemon 2020-06-27 6:08 ` bugzilla-daemon 2020-06-27 7:07 ` bugzilla-daemon 2020-06-27 22:26 ` bugzilla-daemon 2020-06-28 1:12 ` bugzilla-daemon 2020-06-28 10:48 ` bugzilla-daemon 2020-06-28 15:30 ` bugzilla-daemon 2020-06-29 7:39 ` bugzilla-daemon 2020-06-29 22:09 ` bugzilla-daemon 2020-07-01 19:08 ` bugzilla-daemon 2020-07-04 19:57 ` bugzilla-daemon 2020-07-04 20:13 ` bugzilla-daemon 2020-07-05 16:58 ` bugzilla-daemon 2020-07-05 22:08 ` bugzilla-daemon 2020-07-06 16:24 ` bugzilla-daemon 2020-07-06 23:57 ` bugzilla-daemon 2020-07-07 0:37 ` bugzilla-daemon 2020-07-07 3:01 ` bugzilla-daemon 2020-07-07 11:01 ` bugzilla-daemon 2020-07-07 12:43 ` bugzilla-daemon 2020-07-07 15:27 ` bugzilla-daemon 2020-07-07 19:05 ` bugzilla-daemon 2020-07-08 0:25 ` bugzilla-daemon 2020-07-08 1:25 ` bugzilla-daemon 2020-07-08 20:16 ` bugzilla-daemon 2020-07-08 20:17 ` bugzilla-daemon 2020-07-09 7:45 ` bugzilla-daemon 2020-07-10 7:23 ` bugzilla-daemon 2020-07-10 7:36 ` bugzilla-daemon 2020-07-10 8:10 ` bugzilla-daemon 2020-07-10 10:55 ` bugzilla-daemon 2020-07-10 11:25 ` bugzilla-daemon 2020-07-10 14:31 ` bugzilla-daemon 2020-07-12 5:20 ` bugzilla-daemon 2020-07-12 5:47 ` bugzilla-daemon 2020-07-12 7:47 ` bugzilla-daemon 2020-07-14 23:36 ` bugzilla-daemon 2020-07-15 16:49 ` bugzilla-daemon 2020-07-15 17:12 ` bugzilla-daemon 2020-07-16 2:12 ` bugzilla-daemon 2020-07-16 6:37 ` bugzilla-daemon 2020-07-16 9:35 ` bugzilla-daemon 2020-07-16 10:24 ` bugzilla-daemon 2020-07-16 10:30 ` bugzilla-daemon 2020-07-16 10:32 ` bugzilla-daemon 2020-07-17 12:39 ` bugzilla-daemon 2020-07-20 2:20 ` bugzilla-daemon 2020-07-21 16:40 ` bugzilla-daemon 2020-07-21 16:57 ` bugzilla-daemon 2020-07-21 19:32 ` bugzilla-daemon 2020-07-21 20:33 ` bugzilla-daemon 2020-07-21 20:49 ` bugzilla-daemon 2020-07-21 20:56 ` bugzilla-daemon 2020-07-21 21:16 ` bugzilla-daemon 2020-07-22 2:03 ` bugzilla-daemon 2020-07-22 2:05 ` bugzilla-daemon 2020-07-22 3:37 ` bugzilla-daemon 2020-07-22 7:27 ` bugzilla-daemon 2020-07-22 13:04 ` bugzilla-daemon 2020-07-23 0:48 ` bugzilla-daemon 2020-07-23 5:46 ` bugzilla-daemon 2020-07-23 21:30 ` bugzilla-daemon 2020-07-23 21:34 ` bugzilla-daemon 2020-07-24 7:18 ` bugzilla-daemon 2020-07-24 7:24 ` bugzilla-daemon 2020-07-24 19:08 ` bugzilla-daemon 2020-07-24 21:00 ` bugzilla-daemon 2020-07-25 2:38 ` bugzilla-daemon 2020-07-26 6:47 ` bugzilla-daemon 2020-07-26 18:40 ` bugzilla-daemon [this message] 2020-07-26 19:55 ` bugzilla-daemon 2020-07-26 22:52 ` bugzilla-daemon 2020-07-26 23:30 ` bugzilla-daemon 2020-07-26 23:52 ` bugzilla-daemon 2020-07-27 6:11 ` bugzilla-daemon 2020-07-27 16:55 ` bugzilla-daemon 2020-07-28 2:29 ` bugzilla-daemon 2020-07-28 3:21 ` bugzilla-daemon 2020-07-28 3:39 ` bugzilla-daemon 2020-07-28 7:14 ` bugzilla-daemon 2020-07-29 2:33 ` bugzilla-daemon 2020-07-29 6:41 ` bugzilla-daemon 2020-07-29 16:02 ` bugzilla-daemon 2020-07-29 16:37 ` bugzilla-daemon 2020-07-29 16:45 ` bugzilla-daemon 2020-07-29 20:32 ` bugzilla-daemon 2020-07-31 16:38 ` bugzilla-daemon 2020-08-02 1:40 ` bugzilla-daemon 2020-08-02 13:06 ` bugzilla-daemon 2020-08-03 13:51 ` bugzilla-daemon 2020-08-05 16:10 ` bugzilla-daemon 2020-08-17 5:45 ` bugzilla-daemon 2021-01-06 6:36 ` bugzilla-daemon 2021-01-06 12:05 ` bugzilla-daemon 2021-01-06 18:59 ` bugzilla-daemon
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-207383-2300-zSXBhK7kGU@https.bugzilla.kernel.org/ \ --to=bugzilla-daemon@bugzilla.kernel.org \ --cc=dri-devel@lists.freedesktop.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
dri-devel Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/dri-devel/0 dri-devel/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 dri-devel dri-devel/ https://lore.kernel.org/dri-devel \ dri-devel@lists.freedesktop.org public-inbox-index dri-devel Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/org.freedesktop.lists.dri-devel AGPL code for this site: git clone https://public-inbox.org/public-inbox.git