From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Chris Wilson <chris@chris-wilson.co.uk>,
Joonas Lahtinen <joonas.lahtinen@linux.intel.com>,
Daniel Vetter <daniel.vetter@ffwll.ch>
Subject: [PATCH 4.15 55/64] drm: Handle unexpected holes in color-eviction
Date: Mon, 26 Feb 2018 21:22:32 +0100 [thread overview]
Message-ID: <20180226202155.787556654@linuxfoundation.org> (raw)
In-Reply-To: <20180226202153.453363333@linuxfoundation.org>
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Wilson <chris@chris-wilson.co.uk>
commit b8ff1802815913aad52695898cccbc9f77b7e726 upstream.
During eviction, the driver may free more than one hole in the drm_mm
due to the side-effects in evicting the scanned nodes. However,
drm_mm_scan_color_evict() expects that the scan result is the first
available hole (in the mru freed hole_stack list):
kernel BUG at drivers/gpu/drm/drm_mm.c:844!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in: i915 snd_hda_codec_analog snd_hda_codec_generic coretemp snd_hda_intel snd_hda_codec snd_hwdep snd_hda_core lpc_ich snd_pcm e1000e mei_me prime_numbers mei
CPU: 1 PID: 1490 Comm: gem_userptr_bli Tainted: G U 4.16.0-rc1-g740f57c54ecf-kasan_6+ #1
Hardware name: Dell Inc. OptiPlex 755 /0PU052, BIOS A08 02/19/2008
RIP: 0010:drm_mm_scan_color_evict+0x2b8/0x3d0
RSP: 0018:ffff880057a573f8 EFLAGS: 00010287
RAX: ffff8800611f5980 RBX: ffff880057a575d0 RCX: dffffc0000000000
RDX: 00000000029d5000 RSI: 1ffff1000af4aec1 RDI: ffff8800611f5a10
RBP: ffff88005ab884d0 R08: ffff880057a57600 R09: 000000000afff000
R10: 1ffff1000b5710b5 R11: 0000000000001000 R12: 1ffff1000af4ae82
R13: ffff8800611f59b0 R14: ffff8800611f5980 R15: ffff880057a57608
FS: 00007f2de0c2e8c0(0000) GS:ffff88006ac40000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2ddde1e000 CR3: 00000000609b2000 CR4: 00000000000006e0
Call Trace:
? drm_mm_scan_remove_block+0x330/0x330
? drm_mm_scan_remove_block+0x151/0x330
i915_gem_evict_something+0x711/0xbd0 [i915]
? igt_evict_contexts+0x50/0x50 [i915]
? nop_clear_range+0x10/0x10 [i915]
? igt_evict_something+0x90/0x90 [i915]
? i915_gem_gtt_reserve+0x1a1/0x320 [i915]
i915_gem_gtt_insert+0x237/0x400 [i915]
__i915_vma_do_pin+0xc25/0x1a20 [i915]
eb_lookup_vmas+0x1c63/0x3790 [i915]
? i915_gem_check_execbuffer+0x250/0x250 [i915]
? trace_hardirqs_on_caller+0x33f/0x590
? _raw_spin_unlock_irqrestore+0x39/0x60
? __pm_runtime_resume+0x7d/0xf0
i915_gem_do_execbuffer+0x86a/0x2ff0 [i915]
? __kmalloc+0x132/0x340
? i915_gem_execbuffer2_ioctl+0x10f/0x760 [i915]
? drm_ioctl_kernel+0x12e/0x1c0
? drm_ioctl+0x662/0x980
? eb_relocate_slow+0xa90/0xa90 [i915]
? i915_gem_execbuffer2_ioctl+0x10f/0x760 [i915]
? __might_fault+0xea/0x1a0
i915_gem_execbuffer2_ioctl+0x3cc/0x760 [i915]
? i915_gem_execbuffer_ioctl+0xba0/0xba0 [i915]
? lock_acquire+0x3c0/0x3c0
? i915_gem_execbuffer_ioctl+0xba0/0xba0 [i915]
drm_ioctl_kernel+0x12e/0x1c0
drm_ioctl+0x662/0x980
? i915_gem_execbuffer_ioctl+0xba0/0xba0 [i915]
? drm_getstats+0x20/0x20
? debug_check_no_obj_freed+0x2a6/0x8c0
do_vfs_ioctl+0x170/0xe70
? ioctl_preallocate+0x170/0x170
? task_work_run+0xbe/0x160
? lock_acquire+0x3c0/0x3c0
? trace_hardirqs_on_caller+0x33f/0x590
? _raw_spin_unlock_irq+0x2f/0x50
SyS_ioctl+0x36/0x70
? do_vfs_ioctl+0xe70/0xe70
do_syscall_64+0x18c/0x5d0
entry_SYSCALL_64_after_hwframe+0x26/0x9b
RIP: 0033:0x7f2ddf13b587
RSP: 002b:00007fff15c4f9d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f2ddf13b587
RDX: 00007fff15c4fa20 RSI: 0000000040406469 RDI: 0000000000000003
RBP: 00007fff15c4fa20 R08: 0000000000000000 R09: 00007f2ddf3fe120
R10: 0000000000000073 R11: 0000000000000246 R12: 0000000040406469
R13: 0000000000000003 R14: 00007fff15c4fa20 R15: 00000000000000c7
Code: 00 00 00 4a c7 44 22 08 00 00 00 00 42 c7 44 22 10 00 00 00 00 48 81 c4 b8 00 00 00 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 0b 0f 0b <0f> 0b 31 c0 eb c0 4c 89 ef e8 9a 09 41 ff e9 1e fe ff ff 4c 89
RIP: drm_mm_scan_color_evict+0x2b8/0x3d0 RSP: ffff880057a573f8
We can trivially relax this assumption by searching the hole_stack for
the scan result and warn instead if the driver called us without any
result.
Fixes: 3fa489dabea9 ("drm: Apply tight eviction scanning to color_adjust")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: <stable@vger.kernel.org> # v4.11+
Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20180219113543.8010-1-chris@chris-wilson.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_mm.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -836,9 +836,24 @@ struct drm_mm_node *drm_mm_scan_color_ev
if (!mm->color_adjust)
return NULL;
- hole = list_first_entry(&mm->hole_stack, typeof(*hole), hole_stack);
- hole_start = __drm_mm_hole_node_start(hole);
- hole_end = hole_start + hole->hole_size;
+ /*
+ * The hole found during scanning should ideally be the first element
+ * in the hole_stack list, but due to side-effects in the driver it
+ * may not be.
+ */
+ list_for_each_entry(hole, &mm->hole_stack, hole_stack) {
+ hole_start = __drm_mm_hole_node_start(hole);
+ hole_end = hole_start + hole->hole_size;
+
+ if (hole_start <= scan->hit_start &&
+ hole_end >= scan->hit_end)
+ break;
+ }
+
+ /* We should only be called after we found the hole previously */
+ DRM_MM_BUG_ON(&hole->hole_stack == &mm->hole_stack);
+ if (unlikely(&hole->hole_stack == &mm->hole_stack))
+ return NULL;
DRM_MM_BUG_ON(hole_start > scan->hit_start);
DRM_MM_BUG_ON(hole_end < scan->hit_end);
next prev parent reply other threads:[~2018-02-26 20:22 UTC|newest]
Thread overview: 74+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-26 20:21 [PATCH 4.15 00/64] 4.15.7-stable review Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 01/64] netfilter: drop outermost socket lock in getsockopt() Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 02/64] arm64: mm: dont write garbage into TTBR1_EL1 register Greg Kroah-Hartman
2018-02-26 20:21 ` Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 03/64] kconfig.h: Include compiler types to avoid missed struct attributes Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 04/64] MIPS: boot: Define __ASSEMBLY__ for its.S build Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 05/64] xtensa: fix high memory/reserved memory collision Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 06/64] scsi: ibmvfc: fix misdefined reserved field in ibmvfc_fcp_rsp_info Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 07/64] MIPS: Drop spurious __unused in struct compat_flock Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 08/64] cfg80211: fix cfg80211_beacon_dup Greg Kroah-Hartman
2018-02-26 20:21 ` Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 09/64] i2c: designware: must wait for enable Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 10/64] i2c: bcm2835: Set up the rising/falling edge delays Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 11/64] X.509: fix BUG_ON() when hash algorithm is unsupported Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 12/64] X.509: fix NULL dereference when restricting key with unsupported_sig Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 13/64] PKCS#7: fix certificate chain verification Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 14/64] PKCS#7: fix certificate blacklisting Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 15/64] extcon: int3496: process id-pin first so that we start with the right status Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 16/64] genirq/matrix: Handle CPU offlining proper Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 17/64] RDMA/uverbs: Protect from races between lookup and destroy of uobjects Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 18/64] RDMA/uverbs: Protect from command mask overflow Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 19/64] RDMA/uverbs: Fix bad unlock balance in ib_uverbs_close_xrcd Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 20/64] RDMA/uverbs: Fix circular locking dependency Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 21/64] RDMA/uverbs: Sanitize user entered port numbers prior to access it Greg Kroah-Hartman
2018-02-26 20:21 ` [PATCH 4.15 22/64] iio: adc: stm32: fix stm32h7_adc_enable error handling Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 23/64] iio: srf08: fix link error "devm_iio_triggered_buffer_setup" undefined Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 24/64] iio: buffer: check if a buffer has been set up when poll is called Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 25/64] iio: adis_lib: Initialize trigger before requesting interrupt Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 26/64] Kbuild: always define endianess in kconfig.h Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 27/64] x86/apic/vector: Handle vector release on CPU unplug correctly Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 28/64] x86/oprofile: Fix bogus GCC-8 warning in nmi_setup() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 29/64] mm, swap, frontswap: fix THP swap if frontswap enabled Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 30/64] mm: dont defer struct page initialization for Xen pv guests Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 31/64] uapi/if_ether.h: move __UAPI_DEF_ETHHDR libc define Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 32/64] irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 33/64] irqchip/mips-gic: Avoid spuriously handling masked interrupts Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 34/64] PCI/cxgb4: Extend T3 PCI quirk to T4+ devices Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 35/64] net: thunderbolt: Tear down connection properly on suspend Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 36/64] net: thunderbolt: Run disconnect flow asynchronously when logout is received Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 37/64] ohci-hcd: Fix race condition caused by ohci_urb_enqueue() and io_watchdog_func() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 38/64] usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 39/64] arm64: Remove unimplemented syscall log message Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 40/64] arm64: Disable unhandled signal log messages by default Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 41/64] arm64: cpufeature: Fix CTR_EL0 field definitions Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 42/64] Add delay-init quirk for Corsair K70 RGB keyboards Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 43/64] drm/edid: Add 6 bpc quirk for CPT panel in Asus UX303LA Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 44/64] usb: host: ehci: use correct device pointer for dma ops Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 45/64] usb: dwc3: gadget: Set maxpacket size for ep0 IN Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 46/64] usb: dwc3: ep0: Reset TRB counter " Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 47/64] usb: phy: mxs: Fix NULL pointer dereference on i.MX23/28 Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 48/64] usb: ldusb: add PIDs for new CASSY devices supported by this driver Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 49/64] Revert "usb: musb: host: dont start next rx urb if current one failed" Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 50/64] usb: gadget: f_fs: Process all descriptors during bind Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 51/64] usb: gadget: f_fs: Use config_ep_by_speed() Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 52/64] usb: renesas_usbhs: missed the "running" flag in usb_dmac with rx path Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 53/64] drm/cirrus: Load lut in crtc_commit Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 54/64] drm/atomic: Fix memleak on ERESTARTSYS during non-blocking commits Greg Kroah-Hartman
2018-02-26 20:22 ` Greg Kroah-Hartman [this message]
2018-02-26 20:22 ` [PATCH 4.15 56/64] drm/amdgpu: disable MMHUB power gating on raven Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 57/64] drm/amdgpu: fix VA hole handling on Vega10 v3 Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 58/64] drm/amdgpu: Add dpm quirk for Jet PRO (v2) Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 59/64] drm/amdgpu: only check mmBIF_IOV_FUNC_IDENTIFIER on tonga/fiji Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 60/64] drm/amdgpu: add atpx quirk handling (v2) Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 61/64] drm/amdgpu: Avoid leaking PM domain on driver unbind (v2) Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 62/64] drm/amdgpu: add new device to use atpx quirk Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 63/64] arm64: __show_regs: Only resolve kernel symbols when running at EL1 Greg Kroah-Hartman
2018-02-26 20:22 ` [PATCH 4.15 64/64] drm/i915/breadcrumbs: Ignore unsubmitted signalers Greg Kroah-Hartman
2018-02-27 0:58 ` [PATCH 4.15 00/64] 4.15.7-stable review Shuah Khan
2018-02-27 13:09 ` Greg Kroah-Hartman
2018-02-27 7:07 ` Naresh Kamboju
2018-02-27 13:09 ` Greg Kroah-Hartman
2018-02-27 7:18 ` kernelci.org bot
2018-02-27 14:58 ` Guenter Roeck
2018-02-27 18:37 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180226202155.787556654@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=chris@chris-wilson.co.uk \
--cc=daniel.vetter@ffwll.ch \
--cc=joonas.lahtinen@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.