* [Intel-gfx] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure
@ 2019-08-26 15:20 Chris Wilson
2019-08-26 15:29 ` Chris Wilson
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: Chris Wilson @ 2019-08-26 15:20 UTC (permalink / raw)
To: intel-gfx; +Cc: igt-dev
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Abdiel Janulgue <abdiel.janulgue@linux.intel.com>
---
tests/i915/gem_mmap_gtt.c | 98 +++++++++++++++++++++++++++++++++++++++
1 file changed, 98 insertions(+)
diff --git a/tests/i915/gem_mmap_gtt.c b/tests/i915/gem_mmap_gtt.c
index 8eff91850..81068f7d1 100644
--- a/tests/i915/gem_mmap_gtt.c
+++ b/tests/i915/gem_mmap_gtt.c
@@ -26,6 +26,7 @@
*/
#include <unistd.h>
+#include <stdatomic.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
@@ -360,6 +361,99 @@ test_isolation(int i915)
igt_assert(ptr == MAP_FAILED);
}
+static void
+test_close_race(int i915)
+{
+ const int ncpus = sysconf(_SC_NPROCESSORS_ONLN);
+ uint32_t *handles;
+
+ handles = mmap64(0, 4096, PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0);
+ igt_assert(handles != MAP_FAILED);
+
+ igt_fork(child, ncpus) {
+ do {
+ struct drm_i915_gem_mmap_gtt mmap_arg = {};
+ int i = 1 + random() % ncpus;
+ uint32_t old;
+
+ mmap_arg.handle = gem_create(i915, 4096);
+ old = atomic_exchange(&handles[i], mmap_arg.handle);
+ ioctl(i915, DRM_IOCTL_GEM_CLOSE, &old);
+
+ if (ioctl(i915,
+ DRM_IOCTL_I915_GEM_MMAP_GTT,
+ &mmap_arg) != -1) {
+ void *ptr;
+
+ ptr = mmap64(0, 4096,
+ PROT_READ, MAP_SHARED, i915,
+ mmap_arg.offset);
+ if (ptr != MAP_FAILED)
+ munmap(ptr, 4096);
+ }
+ } while (!READ_ONCE(handles[0]));
+ }
+
+ sleep(20);
+ handles[0] = 1;
+ igt_waitchildren();
+
+ for (int i = 1; i <= ncpus; i++)
+ ioctl(i915, DRM_IOCTL_GEM_CLOSE, handles[i]);
+ munmap(handles, 4096);
+}
+
+static void
+test_flink_race(int i915)
+{
+ const int ncpus = sysconf(_SC_NPROCESSORS_ONLN);
+ uint32_t *handles;
+
+ handles = mmap64(0, 4096, PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0);
+ igt_assert(handles != MAP_FAILED);
+
+ igt_fork(child, ncpus) {
+ int fd = gem_reopen_driver(i915);
+
+ do {
+ struct drm_i915_gem_mmap_gtt mmap_arg = {};
+ uint32_t old;
+ int i = 1 + random() % ncpus;
+
+ old = atomic_exchange(&handles[i],
+ gem_create(i915, 4096));
+ if (!old)
+ continue;
+
+ mmap_arg.handle =
+ gem_open(fd, gem_flink(i915, old));
+ ioctl(i915, DRM_IOCTL_GEM_CLOSE, &old);
+
+ if (ioctl(fd,
+ DRM_IOCTL_I915_GEM_MMAP_GTT,
+ &mmap_arg) != -1) {
+ void *ptr;
+
+ ptr = mmap64(0, 4096,
+ PROT_READ, MAP_SHARED, fd,
+ mmap_arg.offset);
+ if (ptr != MAP_FAILED)
+ munmap(ptr, 4096);
+ }
+
+ ioctl(fd, DRM_IOCTL_GEM_CLOSE, &mmap_arg.handle);
+ } while (!READ_ONCE(handles[0]));
+ }
+
+ sleep(20);
+ handles[0] = 1;
+ igt_waitchildren();
+
+ for (int i = 1; i <= ncpus; i++)
+ ioctl(i915, DRM_IOCTL_GEM_CLOSE, handles[i]);
+ munmap(handles, 4096);
+}
+
static void
test_write_gtt(int fd)
{
@@ -985,6 +1079,10 @@ igt_main
test_wc(fd);
igt_subtest("isolation")
test_isolation(fd);
+ igt_subtest("close-race")
+ test_close_race(fd);
+ igt_subtest("flink-race")
+ test_flink_race(fd);
igt_subtest("pf-nonblock")
test_pf_nonblock(fd);
--
2.23.0
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [Intel-gfx] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure
2019-08-26 15:20 [Intel-gfx] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure Chris Wilson
@ 2019-08-26 15:29 ` Chris Wilson
2019-08-26 16:21 ` [igt-dev] ✓ Fi.CI.BAT: success for " Patchwork
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Chris Wilson @ 2019-08-26 15:29 UTC (permalink / raw)
To: intel-gfx; +Cc: igt-dev
Quoting Chris Wilson (2019-08-26 16:20:00)
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Abdiel Janulgue <abdiel.janulgue@linux.intel.com>
That honestly worked better than I was anticipating,
[ 36.413656] [IGT] gem_mmap_gtt: executing
[ 36.425906] [IGT] gem_mmap_gtt: starting subtest close-race
[ 36.448179] ------------[ cut here ]------------
[ 36.448414] refcount_t: increment on 0; use-after-free.
[ 36.448548] WARNING: CPU: 3 PID: 802 at lib/refcount.c:156 refcount_inc_checked+0x2b/0x30
[ 36.448667] Modules linked in: i915 intel_gtt iosf_mbi prime_numbers drm_kms_helper drm drm_panel_orientation_quirks
[ 36.448820] CPU: 3 PID: 802 Comm: gem_mmap_gtt Not tainted 5.3.0-rc6+ #187
[ 36.448927] Hardware name: Intel Corporation 2012 Client Platform/Emerald Lake 2, BIOS ACRVMBY1.86C.0078.P00.1201161002 01/16/2012
[ 36.449076] RIP: 0010:refcount_inc_checked+0x2b/0x30
[ 36.449170] Code: 48 89 e5 e8 e7 fe ff ff 84 c0 74 02 5d c3 80 3d 93 de fc 00 00 75 f5 48 c7 c7 80 88 f2 81 c6 05 83 de fc 00 01 e8 b6 8e b4 ff <0f> 0b 5d c3 90 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41 57 49
[ 36.449373] RSP: 0018:ffff88820333fc00 EFLAGS: 00010282
[ 36.449467] RAX: 0000000000000000 RBX: ffff8882036169e8 RCX: 0000000000000000
[ 36.449531] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffed1040667f76
[ 36.449605] RBP: ffff88820333fc00 R08: 0000000000000001 R09: ffffed1042b5bec5
[ 36.449661] R10: ffffed1042b5bec4 R11: ffff888215adf627 R12: ffff8881ff8b32a8
[ 36.449713] R13: ffff888203616a38 R14: ffff888203616a30 R15: 0000000000000000
[ 36.449766] FS: 00007f5d234efd40(0000) GS:ffff888215ac0000(0000) knlGS:0000000000000000
[ 36.449827] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 36.449878] CR2: 00007f5d24366020 CR3: 00000001ff758001 CR4: 00000000001606e0
[ 36.449929] Call Trace:
[ 36.450115] i915_gem_mmap+0x346/0x3a0 [i915]
[ 36.450295] ? i915_gem_vm_close+0x90/0x90 [i915]
[ 36.450350] ? memset+0x32/0x40
[ 36.450389] mmap_region+0x646/0xa20
[ 36.450430] ? __x64_sys_brk+0x390/0x390
[ 36.450474] ? arch_get_unmapped_area+0x370/0x370
[ 36.450518] do_mmap+0x3e4/0x6d0
[ 36.450556] vm_mmap_pgoff+0xf9/0x150
[ 36.450599] ? vma_is_stack_for_current+0x60/0x60
[ 36.450643] ksys_mmap_pgoff+0x94/0xc0
[ 36.450683] __x64_sys_mmap+0x88/0xa0
[ 36.450723] do_syscall_64+0x72/0xe0
[ 36.450765] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 36.450811] RIP: 0033:0x7f5d23c74133
[ 36.450854] Code: 54 41 89 d4 55 48 89 fd 53 4c 89 cb 48 85 ff 74 56 49 89 d9 45 89 f8 45 89 f2 44 89 e2 4c 89 ee 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7d 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f
[ 36.450952] RSP: 002b:00007fffb808da68 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
[ 36.451011] RAX: ffffffffffffffda RBX: 0000000100006000 RCX: 00007f5d23c74133
[ 36.451069] RDX: 0000000000000001 RSI: 0000000000001000 RDI: 0000000000000000
[ 36.451121] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000100006000
[ 36.451194] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001
[ 36.451304] R13: 0000000000001000 R14: 0000000000000001 R15: 0000000000000003
[ 36.451414] irq event stamp: 5158
[ 36.451493] hardirqs last enabled at (5157): [<ffffffff8112d575>] console_unlock+0x545/0x6f0
[ 36.451627] hardirqs last disabled at (5158): [<ffffffff810026ca>] trace_hardirqs_off_thunk+0x1a/0x20
[ 36.451756] softirqs last enabled at (4752): [<ffffffff81c00441>] __do_softirq+0x441/0x575
[ 36.451879] softirqs last disabled at (4747): [<ffffffff8109b80e>] irq_exit+0x14e/0x160
[ 36.452000] WARNING: CPU: 3 PID: 802 at lib/refcount.c:156 refcount_inc_checked+0x2b/0x30
[ 36.452125] ---[ end trace 1a7be3cf5c013580 ]---
[ 36.452340] ==================================================================
[ 36.452849] BUG: KASAN: use-after-free in i915_gem_vm_close+0x35/0x90 [i915]
[ 36.452960] Read of size 8 at addr ffff8881ff8b3390 by task gem_mmap_gtt/802
[ 36.453064]
[ 36.453129] CPU: 3 PID: 802 Comm: gem_mmap_gtt Tainted: G W 5.3.0-rc6+ #187
[ 36.453248] Hardware name: Intel Corporation 2012 Client Platform/Emerald Lake 2, BIOS ACRVMBY1.86C.0078.P00.1201161002 01/16/2012
[ 36.453395] Call Trace:
[ 36.453469] dump_stack+0x86/0xca
[ 36.453552] print_address_description+0x6e/0x324
[ 36.453913] ? i915_gem_vm_close+0x35/0x90 [i915]
[ 36.454006] __kasan_report.cold+0x1b/0x37
[ 36.454332] ? i915_gem_vm_close+0x35/0x90 [i915]
[ 36.454423] kasan_report+0xc/0xe
[ 36.454500] __asan_load8+0x54/0x90
[ 36.454821] i915_gem_vm_close+0x35/0x90 [i915]
[ 36.454907] remove_vma+0x5e/0x90
[ 36.454983] __do_munmap+0x315/0x670
[ 36.455062] __vm_munmap+0xa9/0xf0
[ 36.455139] ? __do_munmap+0x670/0x670
[ 36.455218] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 36.455307] ? lockdep_hardirqs_on+0x185/0x260
[ 36.455393] __x64_sys_munmap+0x31/0x40
[ 36.455475] do_syscall_64+0x72/0xe0
[ 36.455554] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 36.455645] RIP: 0033:0x7f5d23c741d7
[ 36.455730] Code: 10 e9 67 ff ff ff 0f 1f 44 00 00 48 8b 15 b1 6c 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff e9 6b ff ff ff b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 89 6c 0c 00 f7 d8 64 89 01 48
[ 36.455965] RSP: 002b:00007fffb808da98 EFLAGS: 00000213 ORIG_RAX: 000000000000000b
[ 36.456081] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5d23c741d7
[ 36.456188] RDX: 0000000000000001 RSI: 0000000000001000 RDI: 00007f5d24365000
[ 36.456298] RBP: 00007f5d24366000 R08: 0000000000000003 R09: 0000000100006000
[ 36.456407] R10: 0000000000000001 R11: 0000000000000213 R12: 0000000000000003
[ 36.456514] R13: 0000000000000002 R14: 0000000000000008 R15: 0000000000000000
[ 36.456623]
[ 36.456682] Allocated by task 802:
[ 36.456762] save_stack+0x23/0x90
[ 36.456838] __kasan_kmalloc.constprop.0+0xcf/0xe0
[ 36.456926] kasan_kmalloc+0x9/0x10
[ 36.457004] kmem_cache_alloc_trace+0x11c/0x2f0
[ 36.457358] __assign_gem_object_mmap_data+0x103/0x250 [i915]
[ 36.457717] i915_gem_mmap_gtt_ioctl+0x5c/0x100 [i915]
[ 36.457864] drm_ioctl_kernel+0x126/0x170 [drm]
[ 36.458013] drm_ioctl+0x331/0x550 [drm]
[ 36.458098] do_vfs_ioctl+0x767/0xa30
[ 36.458176] ksys_ioctl+0x3c/0x80
[ 36.458252] __x64_sys_ioctl+0x3e/0x50
[ 36.458261] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 36.458304] do_syscall_64+0x72/0xe0
[ 36.458364] #PF: supervisor read access in kernel mode
[ 36.458410] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 36.458458] #PF: error_code(0x0000) - not-present page
[ 36.458508]
[ 36.458567] PGD 0 P4D 0
[ 36.458618] Freed by task 803:
[ 36.458667] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN
[ 36.458716] save_stack+0x23/0x90
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 6+ messages in thread
* [igt-dev] ✓ Fi.CI.BAT: success for i915/gem_mmap_gtt: Race mmap offset generation against closure
2019-08-26 15:20 [Intel-gfx] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure Chris Wilson
2019-08-26 15:29 ` Chris Wilson
@ 2019-08-26 16:21 ` Patchwork
2019-08-26 20:09 ` [igt-dev] ✓ Fi.CI.IGT: " Patchwork
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Patchwork @ 2019-08-26 16:21 UTC (permalink / raw)
To: Chris Wilson; +Cc: igt-dev
== Series Details ==
Series: i915/gem_mmap_gtt: Race mmap offset generation against closure
URL : https://patchwork.freedesktop.org/series/65817/
State : success
== Summary ==
CI Bug Log - changes from IGT_5150 -> IGTPW_3381
====================================================
Summary
-------
**SUCCESS**
No regressions found.
External URL: https://patchwork.freedesktop.org/api/1.0/series/65817/revisions/1/mbox/
Known issues
------------
Here are the changes found in IGTPW_3381 that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@gem_ctx_param@basic-default:
- fi-icl-u3: [PASS][1] -> [DMESG-WARN][2] ([fdo#107724])
[1]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/fi-icl-u3/igt@gem_ctx_param@basic-default.html
[2]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/fi-icl-u3/igt@gem_ctx_param@basic-default.html
* igt@i915_selftest@live_hangcheck:
- fi-cfl-8109u: [PASS][3] -> [INCOMPLETE][4] ([fdo#106070])
[3]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/fi-cfl-8109u/igt@i915_selftest@live_hangcheck.html
[4]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/fi-cfl-8109u/igt@i915_selftest@live_hangcheck.html
* igt@kms_chamelium@dp-edid-read:
- fi-icl-u2: [PASS][5] -> [FAIL][6] ([fdo#109483] / [fdo#109635 ])
[5]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/fi-icl-u2/igt@kms_chamelium@dp-edid-read.html
[6]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/fi-icl-u2/igt@kms_chamelium@dp-edid-read.html
#### Possible fixes ####
* igt@i915_module_load@reload-no-display:
- {fi-icl-u4}: [DMESG-WARN][7] ([fdo#105602]) -> [PASS][8]
[7]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/fi-icl-u4/igt@i915_module_load@reload-no-display.html
[8]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/fi-icl-u4/igt@i915_module_load@reload-no-display.html
* igt@kms_frontbuffer_tracking@basic:
- fi-icl-u2: [FAIL][9] ([fdo#103167]) -> [PASS][10]
[9]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/fi-icl-u2/igt@kms_frontbuffer_tracking@basic.html
[10]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/fi-icl-u2/igt@kms_frontbuffer_tracking@basic.html
{name}: This element is suppressed. This means it is ignored when computing
the status of the difference (SUCCESS, WARNING, or FAILURE).
[fdo#103167]: https://bugs.freedesktop.org/show_bug.cgi?id=103167
[fdo#105602]: https://bugs.freedesktop.org/show_bug.cgi?id=105602
[fdo#106070]: https://bugs.freedesktop.org/show_bug.cgi?id=106070
[fdo#107724]: https://bugs.freedesktop.org/show_bug.cgi?id=107724
[fdo#109483]: https://bugs.freedesktop.org/show_bug.cgi?id=109483
[fdo#109635 ]: https://bugs.freedesktop.org/show_bug.cgi?id=109635
Participating hosts (53 -> 45)
------------------------------
Missing (8): fi-kbl-soraka fi-ilk-m540 fi-hsw-4200u fi-byt-squawks fi-bsw-cyan fi-icl-y fi-byt-clapper fi-bdw-samus
Build changes
-------------
* CI: CI-20190529 -> None
* IGT: IGT_5150 -> IGTPW_3381
CI-20190529: 20190529
CI_DRM_6785: f1f309b0b9d38667082d95904d7967f13fd2e274 @ git://anongit.freedesktop.org/gfx-ci/linux
IGTPW_3381: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/
IGT_5150: a4e8217bcdfef9bb523f26a9084bbf615a6e8abb @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools
== Testlist changes ==
+igt@gem_mmap_gtt@close-race
+igt@gem_mmap_gtt@flink-race
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/
_______________________________________________
igt-dev mailing list
igt-dev@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/igt-dev
^ permalink raw reply [flat|nested] 6+ messages in thread
* [igt-dev] ✓ Fi.CI.IGT: success for i915/gem_mmap_gtt: Race mmap offset generation against closure
2019-08-26 15:20 [Intel-gfx] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure Chris Wilson
2019-08-26 15:29 ` Chris Wilson
2019-08-26 16:21 ` [igt-dev] ✓ Fi.CI.BAT: success for " Patchwork
@ 2019-08-26 20:09 ` Patchwork
2019-08-27 8:41 ` [igt-dev] [PATCH i-g-t] " Arkadiusz Hiler
2019-08-29 7:36 ` Abdiel Janulgue
4 siblings, 0 replies; 6+ messages in thread
From: Patchwork @ 2019-08-26 20:09 UTC (permalink / raw)
To: Chris Wilson; +Cc: igt-dev
== Series Details ==
Series: i915/gem_mmap_gtt: Race mmap offset generation against closure
URL : https://patchwork.freedesktop.org/series/65817/
State : success
== Summary ==
CI Bug Log - changes from IGT_5150_full -> IGTPW_3381_full
====================================================
Summary
-------
**SUCCESS**
No regressions found.
External URL: https://patchwork.freedesktop.org/api/1.0/series/65817/revisions/1/mbox/
New tests
---------
New tests have been introduced between IGT_5150_full and IGTPW_3381_full:
### New IGT tests (2) ###
* igt@gem_mmap_gtt@close-race:
- Statuses : 6 pass(s)
- Exec time: [20.02, 20.05] s
* igt@gem_mmap_gtt@flink-race:
- Statuses : 4 pass(s)
- Exec time: [20.02, 20.06] s
Known issues
------------
Here are the changes found in IGTPW_3381_full that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@gem_ctx_isolation@rcs0-s3:
- shard-apl: [PASS][1] -> [DMESG-WARN][2] ([fdo#108566]) +3 similar issues
[1]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-apl6/igt@gem_ctx_isolation@rcs0-s3.html
[2]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-apl4/igt@gem_ctx_isolation@rcs0-s3.html
* igt@gem_ctx_shared@q-in-order-bsd2:
- shard-iclb: [PASS][3] -> [SKIP][4] ([fdo#109276]) +12 similar issues
[3]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb1/igt@gem_ctx_shared@q-in-order-bsd2.html
[4]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb7/igt@gem_ctx_shared@q-in-order-bsd2.html
* igt@gem_exec_schedule@preempt-queue-bsd:
- shard-iclb: [PASS][5] -> [SKIP][6] ([fdo#111325])
[5]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb7/igt@gem_exec_schedule@preempt-queue-bsd.html
[6]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb4/igt@gem_exec_schedule@preempt-queue-bsd.html
* igt@gem_tiled_swapping@non-threaded:
- shard-kbl: [PASS][7] -> [DMESG-WARN][8] ([fdo#108686])
[7]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-kbl1/igt@gem_tiled_swapping@non-threaded.html
[8]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-kbl4/igt@gem_tiled_swapping@non-threaded.html
* igt@kms_busy@extended-pageflip-hang-newfb-render-c:
- shard-apl: [PASS][9] -> [INCOMPLETE][10] ([fdo#103927]) +1 similar issue
[9]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-apl3/igt@kms_busy@extended-pageflip-hang-newfb-render-c.html
[10]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-apl1/igt@kms_busy@extended-pageflip-hang-newfb-render-c.html
* igt@kms_cursor_crc@pipe-a-cursor-suspend:
- shard-kbl: [PASS][11] -> [INCOMPLETE][12] ([fdo#103665])
[11]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-kbl2/igt@kms_cursor_crc@pipe-a-cursor-suspend.html
[12]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-kbl3/igt@kms_cursor_crc@pipe-a-cursor-suspend.html
* igt@kms_frontbuffer_tracking@fbc-1p-primscrn-spr-indfb-draw-mmap-cpu:
- shard-apl: [PASS][13] -> [FAIL][14] ([fdo#103167])
[13]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-apl2/igt@kms_frontbuffer_tracking@fbc-1p-primscrn-spr-indfb-draw-mmap-cpu.html
[14]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-apl7/igt@kms_frontbuffer_tracking@fbc-1p-primscrn-spr-indfb-draw-mmap-cpu.html
- shard-kbl: [PASS][15] -> [FAIL][16] ([fdo#103167])
[15]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-kbl6/igt@kms_frontbuffer_tracking@fbc-1p-primscrn-spr-indfb-draw-mmap-cpu.html
[16]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-kbl7/igt@kms_frontbuffer_tracking@fbc-1p-primscrn-spr-indfb-draw-mmap-cpu.html
* igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-pri-indfb-draw-pwrite:
- shard-iclb: [PASS][17] -> [FAIL][18] ([fdo#103167]) +1 similar issue
[17]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb3/igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-pri-indfb-draw-pwrite.html
[18]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb4/igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-pri-indfb-draw-pwrite.html
* igt@kms_psr@psr2_sprite_mmap_gtt:
- shard-iclb: [PASS][19] -> [SKIP][20] ([fdo#109441]) +1 similar issue
[19]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb2/igt@kms_psr@psr2_sprite_mmap_gtt.html
[20]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb7/igt@kms_psr@psr2_sprite_mmap_gtt.html
* igt@tools_test@tools_test:
- shard-glk: [PASS][21] -> [SKIP][22] ([fdo#109271])
[21]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-glk9/igt@tools_test@tools_test.html
[22]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-glk6/igt@tools_test@tools_test.html
#### Possible fixes ####
* igt@gem_bad_reloc@negative-reloc-bsd2:
- shard-iclb: [SKIP][23] ([fdo#109276]) -> [PASS][24] +14 similar issues
[23]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb7/igt@gem_bad_reloc@negative-reloc-bsd2.html
[24]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb1/igt@gem_bad_reloc@negative-reloc-bsd2.html
* igt@gem_ctx_shared@exec-single-timeline-bsd:
- shard-iclb: [SKIP][25] ([fdo#110841]) -> [PASS][26]
[25]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb2/igt@gem_ctx_shared@exec-single-timeline-bsd.html
[26]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb5/igt@gem_ctx_shared@exec-single-timeline-bsd.html
* igt@gem_eio@reset-stress:
- shard-snb: [FAIL][27] ([fdo#109661]) -> [PASS][28]
[27]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-snb1/igt@gem_eio@reset-stress.html
[28]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-snb1/igt@gem_eio@reset-stress.html
* igt@gem_exec_balancer@smoke:
- shard-iclb: [SKIP][29] ([fdo#110854]) -> [PASS][30]
[29]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb8/igt@gem_exec_balancer@smoke.html
[30]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb4/igt@gem_exec_balancer@smoke.html
* igt@gem_exec_schedule@deep-bsd:
- shard-iclb: [SKIP][31] ([fdo#111325]) -> [PASS][32] +6 similar issues
[31]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb1/igt@gem_exec_schedule@deep-bsd.html
[32]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb7/igt@gem_exec_schedule@deep-bsd.html
* igt@i915_selftest@mock_fence:
- shard-iclb: [INCOMPLETE][33] ([fdo#107713]) -> [PASS][34]
[33]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb7/igt@i915_selftest@mock_fence.html
[34]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb4/igt@i915_selftest@mock_fence.html
* igt@i915_suspend@sysfs-reader:
- shard-apl: [DMESG-WARN][35] ([fdo#108566]) -> [PASS][36] +3 similar issues
[35]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-apl8/igt@i915_suspend@sysfs-reader.html
[36]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-apl4/igt@i915_suspend@sysfs-reader.html
* igt@kms_busy@basic-flip-b:
- shard-kbl: [DMESG-WARN][37] -> [PASS][38]
[37]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-kbl2/igt@kms_busy@basic-flip-b.html
[38]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-kbl1/igt@kms_busy@basic-flip-b.html
* igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-pri-indfb-draw-blt:
- shard-iclb: [FAIL][39] ([fdo#103167]) -> [PASS][40] +4 similar issues
[39]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb2/igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-pri-indfb-draw-blt.html
[40]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb3/igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-pri-indfb-draw-blt.html
* igt@kms_psr@no_drrs:
- shard-iclb: [FAIL][41] ([fdo#108341]) -> [PASS][42]
[41]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb1/igt@kms_psr@no_drrs.html
[42]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb7/igt@kms_psr@no_drrs.html
* igt@kms_psr@psr2_cursor_blt:
- shard-iclb: [SKIP][43] ([fdo#109441]) -> [PASS][44] +1 similar issue
[43]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb8/igt@kms_psr@psr2_cursor_blt.html
[44]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb2/igt@kms_psr@psr2_cursor_blt.html
#### Warnings ####
* igt@gem_mocs_settings@mocs-rc6-bsd2:
- shard-iclb: [SKIP][45] ([fdo#109276]) -> [FAIL][46] ([fdo#111330])
[45]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb6/igt@gem_mocs_settings@mocs-rc6-bsd2.html
[46]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb2/igt@gem_mocs_settings@mocs-rc6-bsd2.html
* igt@gem_mocs_settings@mocs-reset-bsd2:
- shard-iclb: [FAIL][47] ([fdo#111330]) -> [SKIP][48] ([fdo#109276])
[47]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb4/igt@gem_mocs_settings@mocs-reset-bsd2.html
[48]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb7/igt@gem_mocs_settings@mocs-reset-bsd2.html
[fdo#103167]: https://bugs.freedesktop.org/show_bug.cgi?id=103167
[fdo#103665]: https://bugs.freedesktop.org/show_bug.cgi?id=103665
[fdo#103927]: https://bugs.freedesktop.org/show_bug.cgi?id=103927
[fdo#107713]: https://bugs.freedesktop.org/show_bug.cgi?id=107713
[fdo#108341]: https://bugs.freedesktop.org/show_bug.cgi?id=108341
[fdo#108566]: https://bugs.freedesktop.org/show_bug.cgi?id=108566
[fdo#108686]: https://bugs.freedesktop.org/show_bug.cgi?id=108686
[fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271
[fdo#109276]: https://bugs.freedesktop.org/show_bug.cgi?id=109276
[fdo#109441]: https://bugs.freedesktop.org/show_bug.cgi?id=109441
[fdo#109661]: https://bugs.freedesktop.org/show_bug.cgi?id=109661
[fdo#110841]: https://bugs.freedesktop.org/show_bug.cgi?id=110841
[fdo#110854]: https://bugs.freedesktop.org/show_bug.cgi?id=110854
[fdo#111325]: https://bugs.freedesktop.org/show_bug.cgi?id=111325
[fdo#111330]: https://bugs.freedesktop.org/show_bug.cgi?id=111330
Participating hosts (7 -> 6)
------------------------------
Missing (1): shard-skl
Build changes
-------------
* CI: CI-20190529 -> None
* IGT: IGT_5150 -> IGTPW_3381
CI-20190529: 20190529
CI_DRM_6785: f1f309b0b9d38667082d95904d7967f13fd2e274 @ git://anongit.freedesktop.org/gfx-ci/linux
IGTPW_3381: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/
IGT_5150: a4e8217bcdfef9bb523f26a9084bbf615a6e8abb @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/
_______________________________________________
igt-dev mailing list
igt-dev@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/igt-dev
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [igt-dev] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure
2019-08-26 15:20 [Intel-gfx] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure Chris Wilson
` (2 preceding siblings ...)
2019-08-26 20:09 ` [igt-dev] ✓ Fi.CI.IGT: " Patchwork
@ 2019-08-27 8:41 ` Arkadiusz Hiler
2019-08-29 7:36 ` Abdiel Janulgue
4 siblings, 0 replies; 6+ messages in thread
From: Arkadiusz Hiler @ 2019-08-27 8:41 UTC (permalink / raw)
To: Chris Wilson; +Cc: igt-dev, intel-gfx
On Mon, Aug 26, 2019 at 04:20:00PM +0100, Chris Wilson wrote:
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Abdiel Janulgue <abdiel.janulgue@linux.intel.com>
> ---
> tests/i915/gem_mmap_gtt.c | 98 +++++++++++++++++++++++++++++++++++++++
> 1 file changed, 98 insertions(+)
>
> diff --git a/tests/i915/gem_mmap_gtt.c b/tests/i915/gem_mmap_gtt.c
> index 8eff91850..81068f7d1 100644
> --- a/tests/i915/gem_mmap_gtt.c
> +++ b/tests/i915/gem_mmap_gtt.c
> @@ -26,6 +26,7 @@
> */
>
> #include <unistd.h>
> +#include <stdatomic.h>
> #include <stdlib.h>
> #include <stdio.h>
> #include <string.h>
> @@ -360,6 +361,99 @@ test_isolation(int i915)
> igt_assert(ptr == MAP_FAILED);
> }
>
> +static void
> +test_close_race(int i915)
> +{
> + const int ncpus = sysconf(_SC_NPROCESSORS_ONLN);
> + uint32_t *handles;
> +
> + handles = mmap64(0, 4096, PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0);
> + igt_assert(handles != MAP_FAILED);
> +
> + igt_fork(child, ncpus) {
> + do {
> + struct drm_i915_gem_mmap_gtt mmap_arg = {};
> + int i = 1 + random() % ncpus;
> + uint32_t old;
> +
> + mmap_arg.handle = gem_create(i915, 4096);
> + old = atomic_exchange(&handles[i], mmap_arg.handle);
../tests/i915/gem_mmap_gtt.c:380:10: error: address argument to atomic operation must be a pointer to _Atomic type ('uint32_t *' (aka 'unsigned int *') invalid)
old = atomic_exchange(&handles[i], mmap_arg.handle);
^ ~~~~~~~~~~~
/usr/lib64/clang/8.0.0/include/stdatomic.h:137:42: note: expanded from macro 'atomic_exchange'
#define atomic_exchange(object, desired) __c11_atomic_exchange(object, desired, __ATOMIC_SEQ_CST)
^ ~~~~~~
../tests/i915/gem_mmap_gtt.c:423:10: error: address argument to atomic operation must be a pointer to _Atomic type ('uint32_t *' (aka 'unsigned int *') invalid)
old = atomic_exchange(&handles[i],
^ ~~~~~~~~~~~
/usr/lib64/clang/8.0.0/include/stdatomic.h:137:42: note: expanded from macro 'atomic_exchange'
#define atomic_exchange(object, desired) __c11_atomic_exchange(object, desired, __ATOMIC_SEQ_CST)
^ ~~~~~~
2 errors generated.
https://gitlab.freedesktop.org/gfx-ci/igt-ci-tags/-/jobs/535592
_______________________________________________
igt-dev mailing list
igt-dev@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/igt-dev
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [igt-dev] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure
2019-08-26 15:20 [Intel-gfx] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure Chris Wilson
` (3 preceding siblings ...)
2019-08-27 8:41 ` [igt-dev] [PATCH i-g-t] " Arkadiusz Hiler
@ 2019-08-29 7:36 ` Abdiel Janulgue
4 siblings, 0 replies; 6+ messages in thread
From: Abdiel Janulgue @ 2019-08-29 7:36 UTC (permalink / raw)
To: Chris Wilson, intel-gfx; +Cc: igt-dev
Yup, this is a valid issue.
Reviewed-by: Abdiel Janulgue <abdiel.janulgue@linux.intel.com>
On 26/08/2019 18.20, Chris Wilson wrote:
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Abdiel Janulgue <abdiel.janulgue@linux.intel.com>
> ---
> tests/i915/gem_mmap_gtt.c | 98 +++++++++++++++++++++++++++++++++++++++
> 1 file changed, 98 insertions(+)
>
> diff --git a/tests/i915/gem_mmap_gtt.c b/tests/i915/gem_mmap_gtt.c
> index 8eff91850..81068f7d1 100644
> --- a/tests/i915/gem_mmap_gtt.c
> +++ b/tests/i915/gem_mmap_gtt.c
> @@ -26,6 +26,7 @@
> */
>
> #include <unistd.h>
> +#include <stdatomic.h>
> #include <stdlib.h>
> #include <stdio.h>
> #include <string.h>
> @@ -360,6 +361,99 @@ test_isolation(int i915)
> igt_assert(ptr == MAP_FAILED);
> }
>
> +static void
> +test_close_race(int i915)
> +{
> + const int ncpus = sysconf(_SC_NPROCESSORS_ONLN);
> + uint32_t *handles;
> +
> + handles = mmap64(0, 4096, PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0);
> + igt_assert(handles != MAP_FAILED);
> +
> + igt_fork(child, ncpus) {
> + do {
> + struct drm_i915_gem_mmap_gtt mmap_arg = {};
> + int i = 1 + random() % ncpus;
> + uint32_t old;
> +
> + mmap_arg.handle = gem_create(i915, 4096);
> + old = atomic_exchange(&handles[i], mmap_arg.handle);
> + ioctl(i915, DRM_IOCTL_GEM_CLOSE, &old);
> +
> + if (ioctl(i915,
> + DRM_IOCTL_I915_GEM_MMAP_GTT,
> + &mmap_arg) != -1) {
> + void *ptr;
> +
> + ptr = mmap64(0, 4096,
> + PROT_READ, MAP_SHARED, i915,
> + mmap_arg.offset);
> + if (ptr != MAP_FAILED)
> + munmap(ptr, 4096);
> + }
> + } while (!READ_ONCE(handles[0]));
> + }
> +
> + sleep(20);
> + handles[0] = 1;
> + igt_waitchildren();
> +
> + for (int i = 1; i <= ncpus; i++)
> + ioctl(i915, DRM_IOCTL_GEM_CLOSE, handles[i]);
> + munmap(handles, 4096);
> +}
> +
> +static void
> +test_flink_race(int i915)
> +{
> + const int ncpus = sysconf(_SC_NPROCESSORS_ONLN);
> + uint32_t *handles;
> +
> + handles = mmap64(0, 4096, PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0);
> + igt_assert(handles != MAP_FAILED);
> +
> + igt_fork(child, ncpus) {
> + int fd = gem_reopen_driver(i915);
> +
> + do {
> + struct drm_i915_gem_mmap_gtt mmap_arg = {};
> + uint32_t old;
> + int i = 1 + random() % ncpus;
> +
> + old = atomic_exchange(&handles[i],
> + gem_create(i915, 4096));
> + if (!old)
> + continue;
> +
> + mmap_arg.handle =
> + gem_open(fd, gem_flink(i915, old));
> + ioctl(i915, DRM_IOCTL_GEM_CLOSE, &old);
> +
> + if (ioctl(fd,
> + DRM_IOCTL_I915_GEM_MMAP_GTT,
> + &mmap_arg) != -1) {
> + void *ptr;
> +
> + ptr = mmap64(0, 4096,
> + PROT_READ, MAP_SHARED, fd,
> + mmap_arg.offset);
> + if (ptr != MAP_FAILED)
> + munmap(ptr, 4096);
> + }
> +
> + ioctl(fd, DRM_IOCTL_GEM_CLOSE, &mmap_arg.handle);
> + } while (!READ_ONCE(handles[0]));
> + }
> +
> + sleep(20);
> + handles[0] = 1;
> + igt_waitchildren();
> +
> + for (int i = 1; i <= ncpus; i++)
> + ioctl(i915, DRM_IOCTL_GEM_CLOSE, handles[i]);
> + munmap(handles, 4096);
> +}
> +
> static void
> test_write_gtt(int fd)
> {
> @@ -985,6 +1079,10 @@ igt_main
> test_wc(fd);
> igt_subtest("isolation")
> test_isolation(fd);
> + igt_subtest("close-race")
> + test_close_race(fd);
> + igt_subtest("flink-race")
> + test_flink_race(fd);
> igt_subtest("pf-nonblock")
> test_pf_nonblock(fd);
>
>
_______________________________________________
igt-dev mailing list
igt-dev@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/igt-dev
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-08-29 7:36 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-08-26 15:20 [Intel-gfx] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure Chris Wilson
2019-08-26 15:29 ` Chris Wilson
2019-08-26 16:21 ` [igt-dev] ✓ Fi.CI.BAT: success for " Patchwork
2019-08-26 20:09 ` [igt-dev] ✓ Fi.CI.IGT: " Patchwork
2019-08-27 8:41 ` [igt-dev] [PATCH i-g-t] " Arkadiusz Hiler
2019-08-29 7:36 ` Abdiel Janulgue
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox