All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm/i915: Don't adjust priority on an already signaled fence
@ 2018-01-06 10:56 Chris Wilson
  2018-01-06 11:20 ` ✓ Fi.CI.BAT: success for " Patchwork
                   ` (4 more replies)
  0 siblings, 5 replies; 7+ messages in thread
From: Chris Wilson @ 2018-01-06 10:56 UTC (permalink / raw)
  To: intel-gfx; +Cc: Alexandru Chirvasitu

When we retire a signaled fence, we free the dependency tree. However,
we skip clearing the list so that if we then try to adjust the priority
of the signaled fence, we may walk the list of freed dependencies.

[ 3083.156757] ==================================================================
[ 3083.156806] BUG: KASAN: use-after-free in execlists_schedule+0x199/0x660 [i915]
[ 3083.156810] Read of size 8 at addr ffff8806bf20f400 by task Xorg/831

[ 3083.156815] CPU: 0 PID: 831 Comm: Xorg Not tainted 4.15.0-rc6-no-psn+ #1
[ 3083.156817] Hardware name: Notebook                         N24_25BU/N24_25BU, BIOS 5.12 02/17/2017
[ 3083.156818] Call Trace:
[ 3083.156823]  dump_stack+0x5c/0x7a
[ 3083.156827]  print_address_description+0x6b/0x290
[ 3083.156830]  kasan_report+0x28f/0x380
[ 3083.156872]  ? execlists_schedule+0x199/0x660 [i915]
[ 3083.156914]  execlists_schedule+0x199/0x660 [i915]
[ 3083.156956]  ? intel_crtc_atomic_check+0x146/0x4e0 [i915]
[ 3083.156997]  ? execlists_submit_request+0xe0/0xe0 [i915]
[ 3083.157038]  ? i915_vma_misplaced.part.4+0x25/0xb0 [i915]
[ 3083.157079]  ? __i915_vma_do_pin+0x7c8/0xc80 [i915]
[ 3083.157121]  ? intel_atomic_state_alloc+0x44/0x60 [i915]
[ 3083.157130]  ? drm_atomic_helper_page_flip+0x3e/0xb0 [drm_kms_helper]
[ 3083.157145]  ? drm_mode_page_flip_ioctl+0x7d2/0x850 [drm]
[ 3083.157159]  ? drm_ioctl_kernel+0xa7/0xf0 [drm]
[ 3083.157172]  ? drm_ioctl+0x45b/0x560 [drm]
[ 3083.157211]  i915_gem_object_wait_priority+0x14c/0x2c0 [i915]
[ 3083.157251]  ? i915_gem_get_aperture_ioctl+0x150/0x150 [i915]
[ 3083.157290]  ? i915_vma_pin_fence+0x1d8/0x320 [i915]
[ 3083.157331]  ? intel_pin_and_fence_fb_obj+0x175/0x250 [i915]
[ 3083.157372]  ? intel_rotation_info_size+0x60/0x60 [i915]
[ 3083.157413]  ? intel_link_compute_m_n+0x80/0x80 [i915]
[ 3083.157428]  ? drm_dev_printk+0x1b0/0x1b0 [drm]
[ 3083.157443]  ? drm_dev_printk+0x1b0/0x1b0 [drm]
[ 3083.157485]  intel_prepare_plane_fb+0x2f8/0x5a0 [i915]
[ 3083.157527]  ? intel_crtc_get_vblank_counter+0x80/0x80 [i915]
[ 3083.157536]  drm_atomic_helper_prepare_planes+0xa0/0x1c0 [drm_kms_helper]
[ 3083.157587]  intel_atomic_commit+0x12e/0x4e0 [i915]
[ 3083.157605]  drm_atomic_helper_page_flip+0xa2/0xb0 [drm_kms_helper]
[ 3083.157621]  drm_mode_page_flip_ioctl+0x7d2/0x850 [drm]
[ 3083.157638]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
[ 3083.157652]  ? drm_lease_owner+0x1a/0x30 [drm]
[ 3083.157668]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
[ 3083.157681]  drm_ioctl_kernel+0xa7/0xf0 [drm]
[ 3083.157696]  drm_ioctl+0x45b/0x560 [drm]
[ 3083.157711]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
[ 3083.157725]  ? drm_getstats+0x20/0x20 [drm]
[ 3083.157729]  ? timerqueue_del+0x49/0x80
[ 3083.157732]  ? __remove_hrtimer+0x62/0xb0
[ 3083.157735]  ? hrtimer_try_to_cancel+0x173/0x210
[ 3083.157738]  do_vfs_ioctl+0x13b/0x880
[ 3083.157741]  ? ioctl_preallocate+0x140/0x140
[ 3083.157744]  ? _raw_spin_unlock_irq+0xe/0x30
[ 3083.157746]  ? do_setitimer+0x234/0x370
[ 3083.157750]  ? SyS_setitimer+0x19e/0x1b0
[ 3083.157752]  ? SyS_alarm+0x140/0x140
[ 3083.157755]  ? __rcu_read_unlock+0x66/0x80
[ 3083.157757]  ? __fget+0xc4/0x100
[ 3083.157760]  SyS_ioctl+0x74/0x80
[ 3083.157763]  entry_SYSCALL_64_fastpath+0x1a/0x7d
[ 3083.157765] RIP: 0033:0x7f6135d0c6a7
[ 3083.157767] RSP: 002b:00007fff01451888 EFLAGS: 00003246 ORIG_RAX: 0000000000000010
[ 3083.157769] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f6135d0c6a7
[ 3083.157771] RDX: 00007fff01451950 RSI: 00000000c01864b0 RDI: 000000000000000c
[ 3083.157772] RBP: 00007f613076f600 R08: 0000000000000001 R09: 0000000000000000
[ 3083.157773] R10: 0000000000000060 R11: 0000000000003246 R12: 0000000000000000
[ 3083.157774] R13: 0000000000000060 R14: 000000000000001b R15: 0000000000000060

[ 3083.157779] Allocated by task 831:
[ 3083.157783]  kmem_cache_alloc+0xc0/0x200
[ 3083.157822]  i915_gem_request_await_dma_fence+0x2c4/0x5d0 [i915]
[ 3083.157861]  i915_gem_request_await_object+0x321/0x370 [i915]
[ 3083.157900]  i915_gem_do_execbuffer+0x1165/0x19c0 [i915]
[ 3083.157937]  i915_gem_execbuffer2+0x1ad/0x550 [i915]
[ 3083.157950]  drm_ioctl_kernel+0xa7/0xf0 [drm]
[ 3083.157962]  drm_ioctl+0x45b/0x560 [drm]
[ 3083.157964]  do_vfs_ioctl+0x13b/0x880
[ 3083.157966]  SyS_ioctl+0x74/0x80
[ 3083.157968]  entry_SYSCALL_64_fastpath+0x1a/0x7d

[ 3083.157971] Freed by task 831:
[ 3083.157973]  kmem_cache_free+0x77/0x220
[ 3083.158012]  i915_gem_request_retire+0x72c/0xa70 [i915]
[ 3083.158051]  i915_gem_request_alloc+0x1e9/0x8b0 [i915]
[ 3083.158089]  i915_gem_do_execbuffer+0xa96/0x19c0 [i915]
[ 3083.158127]  i915_gem_execbuffer2+0x1ad/0x550 [i915]
[ 3083.158140]  drm_ioctl_kernel+0xa7/0xf0 [drm]
[ 3083.158153]  drm_ioctl+0x45b/0x560 [drm]
[ 3083.158155]  do_vfs_ioctl+0x13b/0x880
[ 3083.158156]  SyS_ioctl+0x74/0x80
[ 3083.158158]  entry_SYSCALL_64_fastpath+0x1a/0x7d

[ 3083.158162] The buggy address belongs to the object at ffff8806bf20f400
                which belongs to the cache i915_dependency of size 64
[ 3083.158166] The buggy address is located 0 bytes inside of
                64-byte region [ffff8806bf20f400, ffff8806bf20f440)
[ 3083.158168] The buggy address belongs to the page:
[ 3083.158171] page:00000000d43decc4 count:1 mapcount:0 mapping:          (null) index:0x0
[ 3083.158174] flags: 0x17ffe0000000100(slab)
[ 3083.158179] raw: 017ffe0000000100 0000000000000000 0000000000000000 0000000180200020
[ 3083.158182] raw: ffffea001afc16c0 0000000500000005 ffff880731b881c0 0000000000000000
[ 3083.158184] page dumped because: kasan: bad access detected

[ 3083.158187] Memory state around the buggy address:
[ 3083.158190]  ffff8806bf20f300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 3083.158192]  ffff8806bf20f380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 3083.158195] >ffff8806bf20f400: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 3083.158196]                    ^
[ 3083.158199]  ffff8806bf20f480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 3083.158201]  ffff8806bf20f500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 3083.158203] ==================================================================

Reported-by: Alexandru Chirvasitu <achirvasub@gmail.com>
Reported-by: Mike Keehan <mike@keehan.net>
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=104436
Fixes: 1f181225f8ec ("drm/i915/execlists: Keep request->priority for its lifetime")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Alexandru Chirvasitu <achirvasub@gmail.com>
Cc: Michał Winiarski <michal.winiarski@intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
---
 drivers/gpu/drm/i915/i915_gem.c  | 2 +-
 drivers/gpu/drm/i915/intel_lrc.c | 3 +++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index ba9f67c256f4..8bc3283484be 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -467,7 +467,7 @@ static void __fence_set_priority(struct dma_fence *fence, int prio)
 	struct drm_i915_gem_request *rq;
 	struct intel_engine_cs *engine;
 
-	if (!dma_fence_is_i915(fence))
+	if (dma_fence_is_signaled(fence) || !dma_fence_is_i915(fence))
 		return;
 
 	rq = to_request(fence);
diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 4e150b095a11..ff25f209d0a5 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -1002,6 +1002,9 @@ static void execlists_schedule(struct drm_i915_gem_request *request, int prio)
 
 	GEM_BUG_ON(prio == I915_PRIORITY_INVALID);
 
+	if (i915_gem_request_completed(request))
+		return;
+
 	if (prio <= READ_ONCE(request->priotree.priority))
 		return;
 
-- 
2.15.1

_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

^ permalink raw reply related	[flat|nested] 7+ messages in thread
* ✓ Fi.CI.BAT: success for drm/i915: Don't adjust priority on an already signaled fence
  2018-01-06 10:56 [PATCH] drm/i915: Don't adjust priority on an already signaled fence Chris Wilson
@ 2018-01-06 11:20 ` Patchwork
  2018-01-06 17:35 ` [PATCH] " Chris Wilson
                   ` (3 subsequent siblings)
  4 siblings, 0 replies; 7+ messages in thread
From: Patchwork @ 2018-01-06 11:20 UTC (permalink / raw)
  To: Chris Wilson; +Cc: intel-gfx

== Series Details ==

Series: drm/i915: Don't adjust priority on an already signaled fence
URL   : https://patchwork.freedesktop.org/series/36108/
State : success

== Summary ==

Series 36108v1 drm/i915: Don't adjust priority on an already signaled fence
https://patchwork.freedesktop.org/api/1.0/series/36108/revisions/1/mbox/

Test kms_pipe_crc_basic:
        Subgroup suspend-read-crc-pipe-b:
                pass       -> INCOMPLETE (fi-snb-2520m) fdo#103713
                incomplete -> PASS       (fi-bdw-5557u) fdo#104162
Test kms_psr_sink_crc:
        Subgroup psr_basic:
                pass       -> DMESG-WARN (fi-skl-6700hq) fdo#104260

fdo#103713 https://bugs.freedesktop.org/show_bug.cgi?id=103713
fdo#104162 https://bugs.freedesktop.org/show_bug.cgi?id=104162
fdo#104260 https://bugs.freedesktop.org/show_bug.cgi?id=104260

fi-bdw-5557u     total:288  pass:267  dwarn:0   dfail:0   fail:0   skip:21  time:419s
fi-bdw-gvtdvm    total:288  pass:264  dwarn:0   dfail:0   fail:0   skip:24  time:425s
fi-blb-e6850     total:288  pass:223  dwarn:1   dfail:0   fail:0   skip:64  time:367s
fi-bsw-n3050     total:288  pass:242  dwarn:0   dfail:0   fail:0   skip:46  time:485s
fi-bwr-2160      total:288  pass:183  dwarn:0   dfail:0   fail:0   skip:105 time:277s
fi-bxt-dsi       total:288  pass:258  dwarn:0   dfail:0   fail:0   skip:30  time:477s
fi-bxt-j4205     total:288  pass:259  dwarn:0   dfail:0   fail:0   skip:29  time:480s
fi-byt-j1900     total:288  pass:253  dwarn:0   dfail:0   fail:0   skip:35  time:472s
fi-byt-n2820     total:288  pass:249  dwarn:0   dfail:0   fail:0   skip:39  time:453s
fi-elk-e7500     total:224  pass:168  dwarn:10  dfail:0   fail:0   skip:45 
fi-gdg-551       total:288  pass:179  dwarn:0   dfail:0   fail:1   skip:108 time:261s
fi-glk-1         total:288  pass:260  dwarn:0   dfail:0   fail:0   skip:28  time:515s
fi-hsw-4770      total:288  pass:261  dwarn:0   dfail:0   fail:0   skip:27  time:397s
fi-hsw-4770r     total:288  pass:261  dwarn:0   dfail:0   fail:0   skip:27  time:400s
fi-ilk-650       total:288  pass:228  dwarn:0   dfail:0   fail:0   skip:60  time:413s
fi-ivb-3520m     total:288  pass:259  dwarn:0   dfail:0   fail:0   skip:29  time:459s
fi-ivb-3770      total:288  pass:255  dwarn:0   dfail:0   fail:0   skip:33  time:420s
fi-kbl-7500u     total:288  pass:263  dwarn:1   dfail:0   fail:0   skip:24  time:467s
fi-kbl-7560u     total:288  pass:268  dwarn:1   dfail:0   fail:0   skip:19  time:500s
fi-kbl-7567u     total:288  pass:268  dwarn:0   dfail:0   fail:0   skip:20  time:455s
fi-kbl-r         total:288  pass:260  dwarn:1   dfail:0   fail:0   skip:27  time:498s
fi-pnv-d510      total:288  pass:222  dwarn:1   dfail:0   fail:0   skip:65  time:572s
fi-skl-6260u     total:288  pass:268  dwarn:0   dfail:0   fail:0   skip:20  time:433s
fi-skl-6600u     total:288  pass:260  dwarn:1   dfail:0   fail:0   skip:27  time:504s
fi-skl-6700hq    total:288  pass:261  dwarn:1   dfail:0   fail:0   skip:26  time:525s
fi-skl-6700k2    total:288  pass:264  dwarn:0   dfail:0   fail:0   skip:24  time:497s
fi-skl-6770hq    total:288  pass:268  dwarn:0   dfail:0   fail:0   skip:20  time:488s
fi-skl-gvtdvm    total:288  pass:265  dwarn:0   dfail:0   fail:0   skip:23  time:428s
fi-snb-2520m     total:245  pass:211  dwarn:0   dfail:0   fail:0   skip:33 
fi-snb-2600      total:288  pass:248  dwarn:0   dfail:0   fail:0   skip:40  time:403s
Blacklisted hosts:
fi-cfl-s2        total:288  pass:262  dwarn:0   dfail:0   fail:0   skip:26  time:574s
fi-cnl-y         total:288  pass:262  dwarn:0   dfail:0   fail:0   skip:26  time:597s
fi-glk-dsi       total:288  pass:258  dwarn:0   dfail:0   fail:0   skip:30  time:463s

0cb68b015fa3b8a40c65109737aed36d1985796b drm-tip: 2018y-01m-05d-17h-47m-51s UTC integration manifest
bfff2193808f drm/i915: Don't adjust priority on an already signaled fence

== Logs ==

For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_7621/issues.html
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

^ permalink raw reply	[flat|nested] 7+ messages in thread
* Re: [PATCH] drm/i915: Don't adjust priority on an already signaled fence
  2018-01-06 10:56 [PATCH] drm/i915: Don't adjust priority on an already signaled fence Chris Wilson
  2018-01-06 11:20 ` ✓ Fi.CI.BAT: success for " Patchwork
@ 2018-01-06 17:35 ` Chris Wilson
  2018-01-08  8:53 ` Michał Winiarski
                   ` (2 subsequent siblings)
  4 siblings, 0 replies; 7+ messages in thread
From: Chris Wilson @ 2018-01-06 17:35 UTC (permalink / raw)
  To: intel-gfx; +Cc: Alexandru

Quoting Chris Wilson (2018-01-06 10:56:18)
> When we retire a signaled fence, we free the dependency tree. However,
> we skip clearing the list so that if we then try to adjust the priority
> of the signaled fence, we may walk the list of freed dependencies.
> 
> [ 3083.156757] ==================================================================
> [ 3083.156806] BUG: KASAN: use-after-free in execlists_schedule+0x199/0x660 [i915]
> [ 3083.156810] Read of size 8 at addr ffff8806bf20f400 by task Xorg/831
> 
> [ 3083.156815] CPU: 0 PID: 831 Comm: Xorg Not tainted 4.15.0-rc6-no-psn+ #1
> [ 3083.156817] Hardware name: Notebook                         N24_25BU/N24_25BU, BIOS 5.12 02/17/2017
> [ 3083.156818] Call Trace:
> [ 3083.156823]  dump_stack+0x5c/0x7a
> [ 3083.156827]  print_address_description+0x6b/0x290
> [ 3083.156830]  kasan_report+0x28f/0x380
> [ 3083.156872]  ? execlists_schedule+0x199/0x660 [i915]
> [ 3083.156914]  execlists_schedule+0x199/0x660 [i915]
> [ 3083.156956]  ? intel_crtc_atomic_check+0x146/0x4e0 [i915]
> [ 3083.156997]  ? execlists_submit_request+0xe0/0xe0 [i915]
> [ 3083.157038]  ? i915_vma_misplaced.part.4+0x25/0xb0 [i915]
> [ 3083.157079]  ? __i915_vma_do_pin+0x7c8/0xc80 [i915]
> [ 3083.157121]  ? intel_atomic_state_alloc+0x44/0x60 [i915]
> [ 3083.157130]  ? drm_atomic_helper_page_flip+0x3e/0xb0 [drm_kms_helper]
> [ 3083.157145]  ? drm_mode_page_flip_ioctl+0x7d2/0x850 [drm]
> [ 3083.157159]  ? drm_ioctl_kernel+0xa7/0xf0 [drm]
> [ 3083.157172]  ? drm_ioctl+0x45b/0x560 [drm]
> [ 3083.157211]  i915_gem_object_wait_priority+0x14c/0x2c0 [i915]
> [ 3083.157251]  ? i915_gem_get_aperture_ioctl+0x150/0x150 [i915]
> [ 3083.157290]  ? i915_vma_pin_fence+0x1d8/0x320 [i915]
> [ 3083.157331]  ? intel_pin_and_fence_fb_obj+0x175/0x250 [i915]
> [ 3083.157372]  ? intel_rotation_info_size+0x60/0x60 [i915]
> [ 3083.157413]  ? intel_link_compute_m_n+0x80/0x80 [i915]
> [ 3083.157428]  ? drm_dev_printk+0x1b0/0x1b0 [drm]
> [ 3083.157443]  ? drm_dev_printk+0x1b0/0x1b0 [drm]
> [ 3083.157485]  intel_prepare_plane_fb+0x2f8/0x5a0 [i915]
> [ 3083.157527]  ? intel_crtc_get_vblank_counter+0x80/0x80 [i915]
> [ 3083.157536]  drm_atomic_helper_prepare_planes+0xa0/0x1c0 [drm_kms_helper]
> [ 3083.157587]  intel_atomic_commit+0x12e/0x4e0 [i915]
> [ 3083.157605]  drm_atomic_helper_page_flip+0xa2/0xb0 [drm_kms_helper]
> [ 3083.157621]  drm_mode_page_flip_ioctl+0x7d2/0x850 [drm]
> [ 3083.157638]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
> [ 3083.157652]  ? drm_lease_owner+0x1a/0x30 [drm]
> [ 3083.157668]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
> [ 3083.157681]  drm_ioctl_kernel+0xa7/0xf0 [drm]
> [ 3083.157696]  drm_ioctl+0x45b/0x560 [drm]
> [ 3083.157711]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
> [ 3083.157725]  ? drm_getstats+0x20/0x20 [drm]
> [ 3083.157729]  ? timerqueue_del+0x49/0x80
> [ 3083.157732]  ? __remove_hrtimer+0x62/0xb0
> [ 3083.157735]  ? hrtimer_try_to_cancel+0x173/0x210
> [ 3083.157738]  do_vfs_ioctl+0x13b/0x880
> [ 3083.157741]  ? ioctl_preallocate+0x140/0x140
> [ 3083.157744]  ? _raw_spin_unlock_irq+0xe/0x30
> [ 3083.157746]  ? do_setitimer+0x234/0x370
> [ 3083.157750]  ? SyS_setitimer+0x19e/0x1b0
> [ 3083.157752]  ? SyS_alarm+0x140/0x140
> [ 3083.157755]  ? __rcu_read_unlock+0x66/0x80
> [ 3083.157757]  ? __fget+0xc4/0x100
> [ 3083.157760]  SyS_ioctl+0x74/0x80
> [ 3083.157763]  entry_SYSCALL_64_fastpath+0x1a/0x7d
> [ 3083.157765] RIP: 0033:0x7f6135d0c6a7
> [ 3083.157767] RSP: 002b:00007fff01451888 EFLAGS: 00003246 ORIG_RAX: 0000000000000010
> [ 3083.157769] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f6135d0c6a7
> [ 3083.157771] RDX: 00007fff01451950 RSI: 00000000c01864b0 RDI: 000000000000000c
> [ 3083.157772] RBP: 00007f613076f600 R08: 0000000000000001 R09: 0000000000000000
> [ 3083.157773] R10: 0000000000000060 R11: 0000000000003246 R12: 0000000000000000
> [ 3083.157774] R13: 0000000000000060 R14: 000000000000001b R15: 0000000000000060
> 
> [ 3083.157779] Allocated by task 831:
> [ 3083.157783]  kmem_cache_alloc+0xc0/0x200
> [ 3083.157822]  i915_gem_request_await_dma_fence+0x2c4/0x5d0 [i915]
> [ 3083.157861]  i915_gem_request_await_object+0x321/0x370 [i915]
> [ 3083.157900]  i915_gem_do_execbuffer+0x1165/0x19c0 [i915]
> [ 3083.157937]  i915_gem_execbuffer2+0x1ad/0x550 [i915]
> [ 3083.157950]  drm_ioctl_kernel+0xa7/0xf0 [drm]
> [ 3083.157962]  drm_ioctl+0x45b/0x560 [drm]
> [ 3083.157964]  do_vfs_ioctl+0x13b/0x880
> [ 3083.157966]  SyS_ioctl+0x74/0x80
> [ 3083.157968]  entry_SYSCALL_64_fastpath+0x1a/0x7d
> 
> [ 3083.157971] Freed by task 831:
> [ 3083.157973]  kmem_cache_free+0x77/0x220
> [ 3083.158012]  i915_gem_request_retire+0x72c/0xa70 [i915]
> [ 3083.158051]  i915_gem_request_alloc+0x1e9/0x8b0 [i915]
> [ 3083.158089]  i915_gem_do_execbuffer+0xa96/0x19c0 [i915]
> [ 3083.158127]  i915_gem_execbuffer2+0x1ad/0x550 [i915]
> [ 3083.158140]  drm_ioctl_kernel+0xa7/0xf0 [drm]
> [ 3083.158153]  drm_ioctl+0x45b/0x560 [drm]
> [ 3083.158155]  do_vfs_ioctl+0x13b/0x880
> [ 3083.158156]  SyS_ioctl+0x74/0x80
> [ 3083.158158]  entry_SYSCALL_64_fastpath+0x1a/0x7d
> 
> [ 3083.158162] The buggy address belongs to the object at ffff8806bf20f400
>                 which belongs to the cache i915_dependency of size 64
> [ 3083.158166] The buggy address is located 0 bytes inside of
>                 64-byte region [ffff8806bf20f400, ffff8806bf20f440)
> [ 3083.158168] The buggy address belongs to the page:
> [ 3083.158171] page:00000000d43decc4 count:1 mapcount:0 mapping:          (null) index:0x0
> [ 3083.158174] flags: 0x17ffe0000000100(slab)
> [ 3083.158179] raw: 017ffe0000000100 0000000000000000 0000000000000000 0000000180200020
> [ 3083.158182] raw: ffffea001afc16c0 0000000500000005 ffff880731b881c0 0000000000000000
> [ 3083.158184] page dumped because: kasan: bad access detected
> 
> [ 3083.158187] Memory state around the buggy address:
> [ 3083.158190]  ffff8806bf20f300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 3083.158192]  ffff8806bf20f380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 3083.158195] >ffff8806bf20f400: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 3083.158196]                    ^
> [ 3083.158199]  ffff8806bf20f480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 3083.158201]  ffff8806bf20f500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 3083.158203] ==================================================================
> 
> Reported-by: Alexandru Chirvasitu <achirvasub@gmail.com>
> Reported-by: Mike Keehan <mike@keehan.net>
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=104436
> Fixes: 1f181225f8ec ("drm/i915/execlists: Keep request->priority for its lifetime")
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Alexandru Chirvasitu <achirvasub@gmail.com>
> Cc: Michał Winiarski <michal.winiarski@intel.com>
> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>

Preemptive,
Tested-by: Alexandru Chirvasitu <achirvasub@gmail.com>
-Chris
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

^ permalink raw reply	[flat|nested] 7+ messages in thread
* Re: [PATCH] drm/i915: Don't adjust priority on an already signaled fence
  2018-01-06 10:56 [PATCH] drm/i915: Don't adjust priority on an already signaled fence Chris Wilson
  2018-01-06 11:20 ` ✓ Fi.CI.BAT: success for " Patchwork
  2018-01-06 17:35 ` [PATCH] " Chris Wilson
@ 2018-01-08  8:53 ` Michał Winiarski
  2018-01-08  9:27 ` Mika Kuoppala
  2018-01-08 15:29 ` ✓ Fi.CI.IGT: success for " Patchwork
  4 siblings, 0 replies; 7+ messages in thread
From: Michał Winiarski @ 2018-01-08  8:53 UTC (permalink / raw)
  To: Chris Wilson; +Cc: intel-gfx, Alexandru Chirvasitu

On Sat, Jan 06, 2018 at 10:56:18AM +0000, Chris Wilson wrote:
> When we retire a signaled fence, we free the dependency tree. However,
> we skip clearing the list so that if we then try to adjust the priority
> of the signaled fence, we may walk the list of freed dependencies.
> 
> [ 3083.156757] ==================================================================
> [ 3083.156806] BUG: KASAN: use-after-free in execlists_schedule+0x199/0x660 [i915]
> [ 3083.156810] Read of size 8 at addr ffff8806bf20f400 by task Xorg/831
> 
> [ 3083.156815] CPU: 0 PID: 831 Comm: Xorg Not tainted 4.15.0-rc6-no-psn+ #1
> [ 3083.156817] Hardware name: Notebook                         N24_25BU/N24_25BU, BIOS 5.12 02/17/2017
> [ 3083.156818] Call Trace:
> [ 3083.156823]  dump_stack+0x5c/0x7a
> [ 3083.156827]  print_address_description+0x6b/0x290
> [ 3083.156830]  kasan_report+0x28f/0x380
> [ 3083.156872]  ? execlists_schedule+0x199/0x660 [i915]
> [ 3083.156914]  execlists_schedule+0x199/0x660 [i915]
> [ 3083.156956]  ? intel_crtc_atomic_check+0x146/0x4e0 [i915]
> [ 3083.156997]  ? execlists_submit_request+0xe0/0xe0 [i915]
> [ 3083.157038]  ? i915_vma_misplaced.part.4+0x25/0xb0 [i915]
> [ 3083.157079]  ? __i915_vma_do_pin+0x7c8/0xc80 [i915]
> [ 3083.157121]  ? intel_atomic_state_alloc+0x44/0x60 [i915]
> [ 3083.157130]  ? drm_atomic_helper_page_flip+0x3e/0xb0 [drm_kms_helper]
> [ 3083.157145]  ? drm_mode_page_flip_ioctl+0x7d2/0x850 [drm]
> [ 3083.157159]  ? drm_ioctl_kernel+0xa7/0xf0 [drm]
> [ 3083.157172]  ? drm_ioctl+0x45b/0x560 [drm]
> [ 3083.157211]  i915_gem_object_wait_priority+0x14c/0x2c0 [i915]
> [ 3083.157251]  ? i915_gem_get_aperture_ioctl+0x150/0x150 [i915]
> [ 3083.157290]  ? i915_vma_pin_fence+0x1d8/0x320 [i915]
> [ 3083.157331]  ? intel_pin_and_fence_fb_obj+0x175/0x250 [i915]
> [ 3083.157372]  ? intel_rotation_info_size+0x60/0x60 [i915]
> [ 3083.157413]  ? intel_link_compute_m_n+0x80/0x80 [i915]
> [ 3083.157428]  ? drm_dev_printk+0x1b0/0x1b0 [drm]
> [ 3083.157443]  ? drm_dev_printk+0x1b0/0x1b0 [drm]
> [ 3083.157485]  intel_prepare_plane_fb+0x2f8/0x5a0 [i915]
> [ 3083.157527]  ? intel_crtc_get_vblank_counter+0x80/0x80 [i915]
> [ 3083.157536]  drm_atomic_helper_prepare_planes+0xa0/0x1c0 [drm_kms_helper]
> [ 3083.157587]  intel_atomic_commit+0x12e/0x4e0 [i915]
> [ 3083.157605]  drm_atomic_helper_page_flip+0xa2/0xb0 [drm_kms_helper]
> [ 3083.157621]  drm_mode_page_flip_ioctl+0x7d2/0x850 [drm]
> [ 3083.157638]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
> [ 3083.157652]  ? drm_lease_owner+0x1a/0x30 [drm]
> [ 3083.157668]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
> [ 3083.157681]  drm_ioctl_kernel+0xa7/0xf0 [drm]
> [ 3083.157696]  drm_ioctl+0x45b/0x560 [drm]
> [ 3083.157711]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
> [ 3083.157725]  ? drm_getstats+0x20/0x20 [drm]
> [ 3083.157729]  ? timerqueue_del+0x49/0x80
> [ 3083.157732]  ? __remove_hrtimer+0x62/0xb0
> [ 3083.157735]  ? hrtimer_try_to_cancel+0x173/0x210
> [ 3083.157738]  do_vfs_ioctl+0x13b/0x880
> [ 3083.157741]  ? ioctl_preallocate+0x140/0x140
> [ 3083.157744]  ? _raw_spin_unlock_irq+0xe/0x30
> [ 3083.157746]  ? do_setitimer+0x234/0x370
> [ 3083.157750]  ? SyS_setitimer+0x19e/0x1b0
> [ 3083.157752]  ? SyS_alarm+0x140/0x140
> [ 3083.157755]  ? __rcu_read_unlock+0x66/0x80
> [ 3083.157757]  ? __fget+0xc4/0x100
> [ 3083.157760]  SyS_ioctl+0x74/0x80
> [ 3083.157763]  entry_SYSCALL_64_fastpath+0x1a/0x7d
> [ 3083.157765] RIP: 0033:0x7f6135d0c6a7
> [ 3083.157767] RSP: 002b:00007fff01451888 EFLAGS: 00003246 ORIG_RAX: 0000000000000010
> [ 3083.157769] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f6135d0c6a7
> [ 3083.157771] RDX: 00007fff01451950 RSI: 00000000c01864b0 RDI: 000000000000000c
> [ 3083.157772] RBP: 00007f613076f600 R08: 0000000000000001 R09: 0000000000000000
> [ 3083.157773] R10: 0000000000000060 R11: 0000000000003246 R12: 0000000000000000
> [ 3083.157774] R13: 0000000000000060 R14: 000000000000001b R15: 0000000000000060
> 
> [ 3083.157779] Allocated by task 831:
> [ 3083.157783]  kmem_cache_alloc+0xc0/0x200
> [ 3083.157822]  i915_gem_request_await_dma_fence+0x2c4/0x5d0 [i915]
> [ 3083.157861]  i915_gem_request_await_object+0x321/0x370 [i915]
> [ 3083.157900]  i915_gem_do_execbuffer+0x1165/0x19c0 [i915]
> [ 3083.157937]  i915_gem_execbuffer2+0x1ad/0x550 [i915]
> [ 3083.157950]  drm_ioctl_kernel+0xa7/0xf0 [drm]
> [ 3083.157962]  drm_ioctl+0x45b/0x560 [drm]
> [ 3083.157964]  do_vfs_ioctl+0x13b/0x880
> [ 3083.157966]  SyS_ioctl+0x74/0x80
> [ 3083.157968]  entry_SYSCALL_64_fastpath+0x1a/0x7d
> 
> [ 3083.157971] Freed by task 831:
> [ 3083.157973]  kmem_cache_free+0x77/0x220
> [ 3083.158012]  i915_gem_request_retire+0x72c/0xa70 [i915]
> [ 3083.158051]  i915_gem_request_alloc+0x1e9/0x8b0 [i915]
> [ 3083.158089]  i915_gem_do_execbuffer+0xa96/0x19c0 [i915]
> [ 3083.158127]  i915_gem_execbuffer2+0x1ad/0x550 [i915]
> [ 3083.158140]  drm_ioctl_kernel+0xa7/0xf0 [drm]
> [ 3083.158153]  drm_ioctl+0x45b/0x560 [drm]
> [ 3083.158155]  do_vfs_ioctl+0x13b/0x880
> [ 3083.158156]  SyS_ioctl+0x74/0x80
> [ 3083.158158]  entry_SYSCALL_64_fastpath+0x1a/0x7d
> 
> [ 3083.158162] The buggy address belongs to the object at ffff8806bf20f400
>                 which belongs to the cache i915_dependency of size 64
> [ 3083.158166] The buggy address is located 0 bytes inside of
>                 64-byte region [ffff8806bf20f400, ffff8806bf20f440)
> [ 3083.158168] The buggy address belongs to the page:
> [ 3083.158171] page:00000000d43decc4 count:1 mapcount:0 mapping:          (null) index:0x0
> [ 3083.158174] flags: 0x17ffe0000000100(slab)
> [ 3083.158179] raw: 017ffe0000000100 0000000000000000 0000000000000000 0000000180200020
> [ 3083.158182] raw: ffffea001afc16c0 0000000500000005 ffff880731b881c0 0000000000000000
> [ 3083.158184] page dumped because: kasan: bad access detected
> 
> [ 3083.158187] Memory state around the buggy address:
> [ 3083.158190]  ffff8806bf20f300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 3083.158192]  ffff8806bf20f380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 3083.158195] >ffff8806bf20f400: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 3083.158196]                    ^
> [ 3083.158199]  ffff8806bf20f480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 3083.158201]  ffff8806bf20f500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 3083.158203] ==================================================================
> 
> Reported-by: Alexandru Chirvasitu <achirvasub@gmail.com>
> Reported-by: Mike Keehan <mike@keehan.net>
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=104436
> Fixes: 1f181225f8ec ("drm/i915/execlists: Keep request->priority for its lifetime")
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Alexandru Chirvasitu <achirvasub@gmail.com>
> Cc: Michał Winiarski <michal.winiarski@intel.com>
> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>

Reviewed-by: Michał Winiarski <michal.winiarski@intel.com>

-Michał

> ---
>  drivers/gpu/drm/i915/i915_gem.c  | 2 +-
>  drivers/gpu/drm/i915/intel_lrc.c | 3 +++
>  2 files changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
> index ba9f67c256f4..8bc3283484be 100644
> --- a/drivers/gpu/drm/i915/i915_gem.c
> +++ b/drivers/gpu/drm/i915/i915_gem.c
> @@ -467,7 +467,7 @@ static void __fence_set_priority(struct dma_fence *fence, int prio)
>  	struct drm_i915_gem_request *rq;
>  	struct intel_engine_cs *engine;
>  
> -	if (!dma_fence_is_i915(fence))
> +	if (dma_fence_is_signaled(fence) || !dma_fence_is_i915(fence))
>  		return;
>  
>  	rq = to_request(fence);
> diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
> index 4e150b095a11..ff25f209d0a5 100644
> --- a/drivers/gpu/drm/i915/intel_lrc.c
> +++ b/drivers/gpu/drm/i915/intel_lrc.c
> @@ -1002,6 +1002,9 @@ static void execlists_schedule(struct drm_i915_gem_request *request, int prio)
>  
>  	GEM_BUG_ON(prio == I915_PRIORITY_INVALID);
>  
> +	if (i915_gem_request_completed(request))
> +		return;
> +
>  	if (prio <= READ_ONCE(request->priotree.priority))
>  		return;
>  
> -- 
> 2.15.1
> 
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

^ permalink raw reply	[flat|nested] 7+ messages in thread
* Re: [PATCH] drm/i915: Don't adjust priority on an already signaled fence
  2018-01-06 10:56 [PATCH] drm/i915: Don't adjust priority on an already signaled fence Chris Wilson
                   ` (2 preceding siblings ...)
  2018-01-08  8:53 ` Michał Winiarski
@ 2018-01-08  9:27 ` Mika Kuoppala
  2018-01-08  9:44   ` Chris Wilson
  2018-01-08 15:29 ` ✓ Fi.CI.IGT: success for " Patchwork
  4 siblings, 1 reply; 7+ messages in thread
From: Mika Kuoppala @ 2018-01-08  9:27 UTC (permalink / raw)
  To: Chris Wilson, intel-gfx; +Cc: Alexandru Chirvasitu

Chris Wilson <chris@chris-wilson.co.uk> writes:

> When we retire a signaled fence, we free the dependency tree. However,
> we skip clearing the list so that if we then try to adjust the priority
> of the signaled fence, we may walk the list of freed dependencies.
>
> [ 3083.156757] ==================================================================
> [ 3083.156806] BUG: KASAN: use-after-free in execlists_schedule+0x199/0x660 [i915]
> [ 3083.156810] Read of size 8 at addr ffff8806bf20f400 by task Xorg/831
>
> [ 3083.156815] CPU: 0 PID: 831 Comm: Xorg Not tainted 4.15.0-rc6-no-psn+ #1
> [ 3083.156817] Hardware name: Notebook                         N24_25BU/N24_25BU, BIOS 5.12 02/17/2017
> [ 3083.156818] Call Trace:
> [ 3083.156823]  dump_stack+0x5c/0x7a
> [ 3083.156827]  print_address_description+0x6b/0x290
> [ 3083.156830]  kasan_report+0x28f/0x380
> [ 3083.156872]  ? execlists_schedule+0x199/0x660 [i915]
> [ 3083.156914]  execlists_schedule+0x199/0x660 [i915]
> [ 3083.156956]  ? intel_crtc_atomic_check+0x146/0x4e0 [i915]
> [ 3083.156997]  ? execlists_submit_request+0xe0/0xe0 [i915]
> [ 3083.157038]  ? i915_vma_misplaced.part.4+0x25/0xb0 [i915]
> [ 3083.157079]  ? __i915_vma_do_pin+0x7c8/0xc80 [i915]
> [ 3083.157121]  ? intel_atomic_state_alloc+0x44/0x60 [i915]
> [ 3083.157130]  ? drm_atomic_helper_page_flip+0x3e/0xb0 [drm_kms_helper]
> [ 3083.157145]  ? drm_mode_page_flip_ioctl+0x7d2/0x850 [drm]
> [ 3083.157159]  ? drm_ioctl_kernel+0xa7/0xf0 [drm]
> [ 3083.157172]  ? drm_ioctl+0x45b/0x560 [drm]
> [ 3083.157211]  i915_gem_object_wait_priority+0x14c/0x2c0 [i915]
> [ 3083.157251]  ? i915_gem_get_aperture_ioctl+0x150/0x150 [i915]
> [ 3083.157290]  ? i915_vma_pin_fence+0x1d8/0x320 [i915]
> [ 3083.157331]  ? intel_pin_and_fence_fb_obj+0x175/0x250 [i915]
> [ 3083.157372]  ? intel_rotation_info_size+0x60/0x60 [i915]
> [ 3083.157413]  ? intel_link_compute_m_n+0x80/0x80 [i915]
> [ 3083.157428]  ? drm_dev_printk+0x1b0/0x1b0 [drm]
> [ 3083.157443]  ? drm_dev_printk+0x1b0/0x1b0 [drm]
> [ 3083.157485]  intel_prepare_plane_fb+0x2f8/0x5a0 [i915]
> [ 3083.157527]  ? intel_crtc_get_vblank_counter+0x80/0x80 [i915]
> [ 3083.157536]  drm_atomic_helper_prepare_planes+0xa0/0x1c0 [drm_kms_helper]
> [ 3083.157587]  intel_atomic_commit+0x12e/0x4e0 [i915]
> [ 3083.157605]  drm_atomic_helper_page_flip+0xa2/0xb0 [drm_kms_helper]
> [ 3083.157621]  drm_mode_page_flip_ioctl+0x7d2/0x850 [drm]
> [ 3083.157638]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
> [ 3083.157652]  ? drm_lease_owner+0x1a/0x30 [drm]
> [ 3083.157668]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
> [ 3083.157681]  drm_ioctl_kernel+0xa7/0xf0 [drm]
> [ 3083.157696]  drm_ioctl+0x45b/0x560 [drm]
> [ 3083.157711]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
> [ 3083.157725]  ? drm_getstats+0x20/0x20 [drm]
> [ 3083.157729]  ? timerqueue_del+0x49/0x80
> [ 3083.157732]  ? __remove_hrtimer+0x62/0xb0
> [ 3083.157735]  ? hrtimer_try_to_cancel+0x173/0x210
> [ 3083.157738]  do_vfs_ioctl+0x13b/0x880
> [ 3083.157741]  ? ioctl_preallocate+0x140/0x140
> [ 3083.157744]  ? _raw_spin_unlock_irq+0xe/0x30
> [ 3083.157746]  ? do_setitimer+0x234/0x370
> [ 3083.157750]  ? SyS_setitimer+0x19e/0x1b0
> [ 3083.157752]  ? SyS_alarm+0x140/0x140
> [ 3083.157755]  ? __rcu_read_unlock+0x66/0x80
> [ 3083.157757]  ? __fget+0xc4/0x100
> [ 3083.157760]  SyS_ioctl+0x74/0x80
> [ 3083.157763]  entry_SYSCALL_64_fastpath+0x1a/0x7d
> [ 3083.157765] RIP: 0033:0x7f6135d0c6a7
> [ 3083.157767] RSP: 002b:00007fff01451888 EFLAGS: 00003246 ORIG_RAX: 0000000000000010
> [ 3083.157769] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f6135d0c6a7
> [ 3083.157771] RDX: 00007fff01451950 RSI: 00000000c01864b0 RDI: 000000000000000c
> [ 3083.157772] RBP: 00007f613076f600 R08: 0000000000000001 R09: 0000000000000000
> [ 3083.157773] R10: 0000000000000060 R11: 0000000000003246 R12: 0000000000000000
> [ 3083.157774] R13: 0000000000000060 R14: 000000000000001b R15: 0000000000000060
>
> [ 3083.157779] Allocated by task 831:
> [ 3083.157783]  kmem_cache_alloc+0xc0/0x200
> [ 3083.157822]  i915_gem_request_await_dma_fence+0x2c4/0x5d0 [i915]
> [ 3083.157861]  i915_gem_request_await_object+0x321/0x370 [i915]
> [ 3083.157900]  i915_gem_do_execbuffer+0x1165/0x19c0 [i915]
> [ 3083.157937]  i915_gem_execbuffer2+0x1ad/0x550 [i915]
> [ 3083.157950]  drm_ioctl_kernel+0xa7/0xf0 [drm]
> [ 3083.157962]  drm_ioctl+0x45b/0x560 [drm]
> [ 3083.157964]  do_vfs_ioctl+0x13b/0x880
> [ 3083.157966]  SyS_ioctl+0x74/0x80
> [ 3083.157968]  entry_SYSCALL_64_fastpath+0x1a/0x7d
>
> [ 3083.157971] Freed by task 831:
> [ 3083.157973]  kmem_cache_free+0x77/0x220
> [ 3083.158012]  i915_gem_request_retire+0x72c/0xa70 [i915]
> [ 3083.158051]  i915_gem_request_alloc+0x1e9/0x8b0 [i915]
> [ 3083.158089]  i915_gem_do_execbuffer+0xa96/0x19c0 [i915]
> [ 3083.158127]  i915_gem_execbuffer2+0x1ad/0x550 [i915]
> [ 3083.158140]  drm_ioctl_kernel+0xa7/0xf0 [drm]
> [ 3083.158153]  drm_ioctl+0x45b/0x560 [drm]
> [ 3083.158155]  do_vfs_ioctl+0x13b/0x880
> [ 3083.158156]  SyS_ioctl+0x74/0x80
> [ 3083.158158]  entry_SYSCALL_64_fastpath+0x1a/0x7d
>
> [ 3083.158162] The buggy address belongs to the object at ffff8806bf20f400
>                 which belongs to the cache i915_dependency of size 64
> [ 3083.158166] The buggy address is located 0 bytes inside of
>                 64-byte region [ffff8806bf20f400, ffff8806bf20f440)
> [ 3083.158168] The buggy address belongs to the page:
> [ 3083.158171] page:00000000d43decc4 count:1 mapcount:0 mapping:          (null) index:0x0
> [ 3083.158174] flags: 0x17ffe0000000100(slab)
> [ 3083.158179] raw: 017ffe0000000100 0000000000000000 0000000000000000 0000000180200020
> [ 3083.158182] raw: ffffea001afc16c0 0000000500000005 ffff880731b881c0 0000000000000000
> [ 3083.158184] page dumped because: kasan: bad access detected
>
> [ 3083.158187] Memory state around the buggy address:
> [ 3083.158190]  ffff8806bf20f300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 3083.158192]  ffff8806bf20f380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 3083.158195] >ffff8806bf20f400: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 3083.158196]                    ^
> [ 3083.158199]  ffff8806bf20f480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 3083.158201]  ffff8806bf20f500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> [ 3083.158203] ==================================================================
>
> Reported-by: Alexandru Chirvasitu <achirvasub@gmail.com>
> Reported-by: Mike Keehan <mike@keehan.net>
> Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=104436
> Fixes: 1f181225f8ec ("drm/i915/execlists: Keep request->priority for its lifetime")
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Alexandru Chirvasitu <achirvasub@gmail.com>
> Cc: Michał Winiarski <michal.winiarski@intel.com>
> Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
> ---
>  drivers/gpu/drm/i915/i915_gem.c  | 2 +-
>  drivers/gpu/drm/i915/intel_lrc.c | 3 +++
>  2 files changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
> index ba9f67c256f4..8bc3283484be 100644
> --- a/drivers/gpu/drm/i915/i915_gem.c
> +++ b/drivers/gpu/drm/i915/i915_gem.c
> @@ -467,7 +467,7 @@ static void __fence_set_priority(struct dma_fence *fence, int prio)
>  	struct drm_i915_gem_request *rq;
>  	struct intel_engine_cs *engine;
>  
> -	if (!dma_fence_is_i915(fence))
> +	if (dma_fence_is_signaled(fence) || !dma_fence_is_i915(fence))

Generic status first and then if it is ours. Should be ok.

>  		return;
>  
>  	rq = to_request(fence);
> diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
> index 4e150b095a11..ff25f209d0a5 100644
> --- a/drivers/gpu/drm/i915/intel_lrc.c
> +++ b/drivers/gpu/drm/i915/intel_lrc.c
> @@ -1002,6 +1002,9 @@ static void execlists_schedule(struct drm_i915_gem_request *request, int prio)
>  
>  	GEM_BUG_ON(prio == I915_PRIORITY_INVALID);
>  
> +	if (i915_gem_request_completed(request))
> +		return;
> +

Not that I would mind but I don't see the connection to
the above. Is there one?

-Mika


>  	if (prio <= READ_ONCE(request->priotree.priority))
>  		return;
>  
> -- 
> 2.15.1
>
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/intel-gfx
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

^ permalink raw reply	[flat|nested] 7+ messages in thread
* Re: [PATCH] drm/i915: Don't adjust priority on an already signaled fence
  2018-01-08  9:27 ` Mika Kuoppala
@ 2018-01-08  9:44   ` Chris Wilson
  0 siblings, 0 replies; 7+ messages in thread
From: Chris Wilson @ 2018-01-08  9:44 UTC (permalink / raw)
  To: Mika Kuoppala, intel-gfx; +Cc: Alexandru Chirvasitu

Quoting Mika Kuoppala (2018-01-08 09:27:38)
> Chris Wilson <chris@chris-wilson.co.uk> writes:
> 
> > When we retire a signaled fence, we free the dependency tree. However,
> > we skip clearing the list so that if we then try to adjust the priority
> > of the signaled fence, we may walk the list of freed dependencies.
> >
> > [ 3083.156757] ==================================================================
> > [ 3083.156806] BUG: KASAN: use-after-free in execlists_schedule+0x199/0x660 [i915]
> > [ 3083.156810] Read of size 8 at addr ffff8806bf20f400 by task Xorg/831
> >
> > [ 3083.156815] CPU: 0 PID: 831 Comm: Xorg Not tainted 4.15.0-rc6-no-psn+ #1
> > [ 3083.156817] Hardware name: Notebook                         N24_25BU/N24_25BU, BIOS 5.12 02/17/2017
> > [ 3083.156818] Call Trace:
> > [ 3083.156823]  dump_stack+0x5c/0x7a
> > [ 3083.156827]  print_address_description+0x6b/0x290
> > [ 3083.156830]  kasan_report+0x28f/0x380
> > [ 3083.156872]  ? execlists_schedule+0x199/0x660 [i915]
> > [ 3083.156914]  execlists_schedule+0x199/0x660 [i915]
> > [ 3083.156956]  ? intel_crtc_atomic_check+0x146/0x4e0 [i915]
> > [ 3083.156997]  ? execlists_submit_request+0xe0/0xe0 [i915]
> > [ 3083.157038]  ? i915_vma_misplaced.part.4+0x25/0xb0 [i915]
> > [ 3083.157079]  ? __i915_vma_do_pin+0x7c8/0xc80 [i915]
> > [ 3083.157121]  ? intel_atomic_state_alloc+0x44/0x60 [i915]
> > [ 3083.157130]  ? drm_atomic_helper_page_flip+0x3e/0xb0 [drm_kms_helper]
> > [ 3083.157145]  ? drm_mode_page_flip_ioctl+0x7d2/0x850 [drm]
> > [ 3083.157159]  ? drm_ioctl_kernel+0xa7/0xf0 [drm]
> > [ 3083.157172]  ? drm_ioctl+0x45b/0x560 [drm]
> > [ 3083.157211]  i915_gem_object_wait_priority+0x14c/0x2c0 [i915]
> > [ 3083.157251]  ? i915_gem_get_aperture_ioctl+0x150/0x150 [i915]
> > [ 3083.157290]  ? i915_vma_pin_fence+0x1d8/0x320 [i915]
> > [ 3083.157331]  ? intel_pin_and_fence_fb_obj+0x175/0x250 [i915]
> > [ 3083.157372]  ? intel_rotation_info_size+0x60/0x60 [i915]
> > [ 3083.157413]  ? intel_link_compute_m_n+0x80/0x80 [i915]
> > [ 3083.157428]  ? drm_dev_printk+0x1b0/0x1b0 [drm]
> > [ 3083.157443]  ? drm_dev_printk+0x1b0/0x1b0 [drm]
> > [ 3083.157485]  intel_prepare_plane_fb+0x2f8/0x5a0 [i915]
> > [ 3083.157527]  ? intel_crtc_get_vblank_counter+0x80/0x80 [i915]
> > [ 3083.157536]  drm_atomic_helper_prepare_planes+0xa0/0x1c0 [drm_kms_helper]
> > [ 3083.157587]  intel_atomic_commit+0x12e/0x4e0 [i915]
> > [ 3083.157605]  drm_atomic_helper_page_flip+0xa2/0xb0 [drm_kms_helper]
> > [ 3083.157621]  drm_mode_page_flip_ioctl+0x7d2/0x850 [drm]
> > [ 3083.157638]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
> > [ 3083.157652]  ? drm_lease_owner+0x1a/0x30 [drm]
> > [ 3083.157668]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
> > [ 3083.157681]  drm_ioctl_kernel+0xa7/0xf0 [drm]
> > [ 3083.157696]  drm_ioctl+0x45b/0x560 [drm]
> > [ 3083.157711]  ? drm_mode_cursor2_ioctl+0x10/0x10 [drm]
> > [ 3083.157725]  ? drm_getstats+0x20/0x20 [drm]
> > [ 3083.157729]  ? timerqueue_del+0x49/0x80
> > [ 3083.157732]  ? __remove_hrtimer+0x62/0xb0
> > [ 3083.157735]  ? hrtimer_try_to_cancel+0x173/0x210
> > [ 3083.157738]  do_vfs_ioctl+0x13b/0x880
> > [ 3083.157741]  ? ioctl_preallocate+0x140/0x140
> > [ 3083.157744]  ? _raw_spin_unlock_irq+0xe/0x30
> > [ 3083.157746]  ? do_setitimer+0x234/0x370
> > [ 3083.157750]  ? SyS_setitimer+0x19e/0x1b0
> > [ 3083.157752]  ? SyS_alarm+0x140/0x140
> > [ 3083.157755]  ? __rcu_read_unlock+0x66/0x80
> > [ 3083.157757]  ? __fget+0xc4/0x100
> > [ 3083.157760]  SyS_ioctl+0x74/0x80
> > [ 3083.157763]  entry_SYSCALL_64_fastpath+0x1a/0x7d
> > [ 3083.157765] RIP: 0033:0x7f6135d0c6a7
> > [ 3083.157767] RSP: 002b:00007fff01451888 EFLAGS: 00003246 ORIG_RAX: 0000000000000010
> > [ 3083.157769] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f6135d0c6a7
> > [ 3083.157771] RDX: 00007fff01451950 RSI: 00000000c01864b0 RDI: 000000000000000c
> > [ 3083.157772] RBP: 00007f613076f600 R08: 0000000000000001 R09: 0000000000000000
> > [ 3083.157773] R10: 0000000000000060 R11: 0000000000003246 R12: 0000000000000000
> > [ 3083.157774] R13: 0000000000000060 R14: 000000000000001b R15: 0000000000000060
> >
> > [ 3083.157779] Allocated by task 831:
> > [ 3083.157783]  kmem_cache_alloc+0xc0/0x200
> > [ 3083.157822]  i915_gem_request_await_dma_fence+0x2c4/0x5d0 [i915]
> > [ 3083.157861]  i915_gem_request_await_object+0x321/0x370 [i915]
> > [ 3083.157900]  i915_gem_do_execbuffer+0x1165/0x19c0 [i915]
> > [ 3083.157937]  i915_gem_execbuffer2+0x1ad/0x550 [i915]
> > [ 3083.157950]  drm_ioctl_kernel+0xa7/0xf0 [drm]
> > [ 3083.157962]  drm_ioctl+0x45b/0x560 [drm]
> > [ 3083.157964]  do_vfs_ioctl+0x13b/0x880
> > [ 3083.157966]  SyS_ioctl+0x74/0x80
> > [ 3083.157968]  entry_SYSCALL_64_fastpath+0x1a/0x7d
> >
> > [ 3083.157971] Freed by task 831:
> > [ 3083.157973]  kmem_cache_free+0x77/0x220
> > [ 3083.158012]  i915_gem_request_retire+0x72c/0xa70 [i915]
> > [ 3083.158051]  i915_gem_request_alloc+0x1e9/0x8b0 [i915]
> > [ 3083.158089]  i915_gem_do_execbuffer+0xa96/0x19c0 [i915]
> > [ 3083.158127]  i915_gem_execbuffer2+0x1ad/0x550 [i915]
> > [ 3083.158140]  drm_ioctl_kernel+0xa7/0xf0 [drm]
> > [ 3083.158153]  drm_ioctl+0x45b/0x560 [drm]
> > [ 3083.158155]  do_vfs_ioctl+0x13b/0x880
> > [ 3083.158156]  SyS_ioctl+0x74/0x80
> > [ 3083.158158]  entry_SYSCALL_64_fastpath+0x1a/0x7d
> >
> > [ 3083.158162] The buggy address belongs to the object at ffff8806bf20f400
> >                 which belongs to the cache i915_dependency of size 64
> > [ 3083.158166] The buggy address is located 0 bytes inside of
> >                 64-byte region [ffff8806bf20f400, ffff8806bf20f440)
> > [ 3083.158168] The buggy address belongs to the page:
> > [ 3083.158171] page:00000000d43decc4 count:1 mapcount:0 mapping:          (null) index:0x0
> > [ 3083.158174] flags: 0x17ffe0000000100(slab)
> > [ 3083.158179] raw: 017ffe0000000100 0000000000000000 0000000000000000 0000000180200020
> > [ 3083.158182] raw: ffffea001afc16c0 0000000500000005 ffff880731b881c0 0000000000000000
> > [ 3083.158184] page dumped because: kasan: bad access detected
> >
> > [ 3083.158187] Memory state around the buggy address:
> > [ 3083.158190]  ffff8806bf20f300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> > [ 3083.158192]  ffff8806bf20f380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> > [ 3083.158195] >ffff8806bf20f400: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> > [ 3083.158196]                    ^
> > [ 3083.158199]  ffff8806bf20f480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> > [ 3083.158201]  ffff8806bf20f500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> > [ 3083.158203] ==================================================================
> >
> > Reported-by: Alexandru Chirvasitu <achirvasub@gmail.com>
> > Reported-by: Mike Keehan <mike@keehan.net>
> > Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=104436
> > Fixes: 1f181225f8ec ("drm/i915/execlists: Keep request->priority for its lifetime")
> > Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> > Cc: Alexandru Chirvasitu <achirvasub@gmail.com>
> > Cc: Michał Winiarski <michal.winiarski@intel.com>
> > Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
> > Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
> > ---
> >  drivers/gpu/drm/i915/i915_gem.c  | 2 +-
> >  drivers/gpu/drm/i915/intel_lrc.c | 3 +++
> >  2 files changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
> > index ba9f67c256f4..8bc3283484be 100644
> > --- a/drivers/gpu/drm/i915/i915_gem.c
> > +++ b/drivers/gpu/drm/i915/i915_gem.c
> > @@ -467,7 +467,7 @@ static void __fence_set_priority(struct dma_fence *fence, int prio)
> >       struct drm_i915_gem_request *rq;
> >       struct intel_engine_cs *engine;
> >  
> > -     if (!dma_fence_is_i915(fence))
> > +     if (dma_fence_is_signaled(fence) || !dma_fence_is_i915(fence))
> 
> Generic status first and then if it is ours. Should be ok.
> 
> >               return;
> >  
> >       rq = to_request(fence);
> > diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
> > index 4e150b095a11..ff25f209d0a5 100644
> > --- a/drivers/gpu/drm/i915/intel_lrc.c
> > +++ b/drivers/gpu/drm/i915/intel_lrc.c
> > @@ -1002,6 +1002,9 @@ static void execlists_schedule(struct drm_i915_gem_request *request, int prio)
> >  
> >       GEM_BUG_ON(prio == I915_PRIORITY_INVALID);
> >  
> > +     if (i915_gem_request_completed(request))
> > +             return;
> > +
> 
> Not that I would mind but I don't see the connection to
> the above. Is there one?

i915_gem_request_completed() is rejecting all signaled fences, it's the
function that dma_fence_is_signaled() calls for i915 requests.

Adding dma_fence_is_signaled() I consider to be a micro-optimisation,
the true safe guard here is checking in execlists_schedule() where the
rules on when the priotree can be accessed are kept.

Thanks for the review, pushed the urgent bug fix. If this is the only
fallout from enabling preemption, we are doing well!
-Chris
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

^ permalink raw reply	[flat|nested] 7+ messages in thread
* ✓ Fi.CI.IGT: success for drm/i915: Don't adjust priority on an already signaled fence
  2018-01-06 10:56 [PATCH] drm/i915: Don't adjust priority on an already signaled fence Chris Wilson
                   ` (3 preceding siblings ...)
  2018-01-08  9:27 ` Mika Kuoppala
@ 2018-01-08 15:29 ` Patchwork
  4 siblings, 0 replies; 7+ messages in thread
From: Patchwork @ 2018-01-08 15:29 UTC (permalink / raw)
  To: Chris Wilson; +Cc: intel-gfx

== Series Details ==

Series: drm/i915: Don't adjust priority on an already signaled fence
URL   : https://patchwork.freedesktop.org/series/36108/
State : success

== Summary ==

Test gem_tiled_swapping:
        Subgroup non-threaded:
                pass       -> INCOMPLETE (shard-hsw) fdo#104218
Test kms_flip:
        Subgroup vblank-vs-suspend:
                pass       -> DMESG-WARN (shard-snb) fdo#103375 +1
Test kms_frontbuffer_tracking:
        Subgroup fbc-1p-offscren-pri-shrfb-draw-blt:
                pass       -> FAIL       (shard-snb) fdo#101623

fdo#104218 https://bugs.freedesktop.org/show_bug.cgi?id=104218
fdo#103375 https://bugs.freedesktop.org/show_bug.cgi?id=103375
fdo#101623 https://bugs.freedesktop.org/show_bug.cgi?id=101623

shard-hsw        total:2679 pass:1513 dwarn:1   dfail:0   fail:10  skip:1154 time:8746s
shard-snb        total:2713 pass:1308 dwarn:2   dfail:0   fail:12  skip:1391 time:7876s
Blacklisted hosts:
shard-apl        total:2713 pass:1685 dwarn:1   dfail:1   fail:24  skip:1001 time:13416s
shard-kbl        total:2713 pass:1805 dwarn:1   dfail:0   fail:29  skip:878 time:10558s

== Logs ==

For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_7621/shards.html
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

^ permalink raw reply	[flat|nested] 7+ messages in thread
end of thread, other threads:[~2018-01-08 15:29 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-01-06 10:56 [PATCH] drm/i915: Don't adjust priority on an already signaled fence Chris Wilson
2018-01-06 11:20 ` ✓ Fi.CI.BAT: success for " Patchwork
2018-01-06 17:35 ` [PATCH] " Chris Wilson
2018-01-08  8:53 ` Michał Winiarski
2018-01-08  9:27 ` Mika Kuoppala
2018-01-08  9:44   ` Chris Wilson
2018-01-08 15:29 ` ✓ Fi.CI.IGT: success for " Patchwork

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.