* [Intel-gfx] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure
@ 2019-08-26 15:20 Chris Wilson
2019-08-26 15:29 ` Chris Wilson
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: Chris Wilson @ 2019-08-26 15:20 UTC (permalink / raw)
To: intel-gfx; +Cc: igt-dev
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Abdiel Janulgue <abdiel.janulgue@linux.intel.com>
---
tests/i915/gem_mmap_gtt.c | 98 +++++++++++++++++++++++++++++++++++++++
1 file changed, 98 insertions(+)
diff --git a/tests/i915/gem_mmap_gtt.c b/tests/i915/gem_mmap_gtt.c
index 8eff91850..81068f7d1 100644
--- a/tests/i915/gem_mmap_gtt.c
+++ b/tests/i915/gem_mmap_gtt.c
@@ -26,6 +26,7 @@
*/
#include <unistd.h>
+#include <stdatomic.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
@@ -360,6 +361,99 @@ test_isolation(int i915)
igt_assert(ptr == MAP_FAILED);
}
+static void
+test_close_race(int i915)
+{
+ const int ncpus = sysconf(_SC_NPROCESSORS_ONLN);
+ uint32_t *handles;
+
+ handles = mmap64(0, 4096, PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0);
+ igt_assert(handles != MAP_FAILED);
+
+ igt_fork(child, ncpus) {
+ do {
+ struct drm_i915_gem_mmap_gtt mmap_arg = {};
+ int i = 1 + random() % ncpus;
+ uint32_t old;
+
+ mmap_arg.handle = gem_create(i915, 4096);
+ old = atomic_exchange(&handles[i], mmap_arg.handle);
+ ioctl(i915, DRM_IOCTL_GEM_CLOSE, &old);
+
+ if (ioctl(i915,
+ DRM_IOCTL_I915_GEM_MMAP_GTT,
+ &mmap_arg) != -1) {
+ void *ptr;
+
+ ptr = mmap64(0, 4096,
+ PROT_READ, MAP_SHARED, i915,
+ mmap_arg.offset);
+ if (ptr != MAP_FAILED)
+ munmap(ptr, 4096);
+ }
+ } while (!READ_ONCE(handles[0]));
+ }
+
+ sleep(20);
+ handles[0] = 1;
+ igt_waitchildren();
+
+ for (int i = 1; i <= ncpus; i++)
+ ioctl(i915, DRM_IOCTL_GEM_CLOSE, handles[i]);
+ munmap(handles, 4096);
+}
+
+static void
+test_flink_race(int i915)
+{
+ const int ncpus = sysconf(_SC_NPROCESSORS_ONLN);
+ uint32_t *handles;
+
+ handles = mmap64(0, 4096, PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0);
+ igt_assert(handles != MAP_FAILED);
+
+ igt_fork(child, ncpus) {
+ int fd = gem_reopen_driver(i915);
+
+ do {
+ struct drm_i915_gem_mmap_gtt mmap_arg = {};
+ uint32_t old;
+ int i = 1 + random() % ncpus;
+
+ old = atomic_exchange(&handles[i],
+ gem_create(i915, 4096));
+ if (!old)
+ continue;
+
+ mmap_arg.handle =
+ gem_open(fd, gem_flink(i915, old));
+ ioctl(i915, DRM_IOCTL_GEM_CLOSE, &old);
+
+ if (ioctl(fd,
+ DRM_IOCTL_I915_GEM_MMAP_GTT,
+ &mmap_arg) != -1) {
+ void *ptr;
+
+ ptr = mmap64(0, 4096,
+ PROT_READ, MAP_SHARED, fd,
+ mmap_arg.offset);
+ if (ptr != MAP_FAILED)
+ munmap(ptr, 4096);
+ }
+
+ ioctl(fd, DRM_IOCTL_GEM_CLOSE, &mmap_arg.handle);
+ } while (!READ_ONCE(handles[0]));
+ }
+
+ sleep(20);
+ handles[0] = 1;
+ igt_waitchildren();
+
+ for (int i = 1; i <= ncpus; i++)
+ ioctl(i915, DRM_IOCTL_GEM_CLOSE, handles[i]);
+ munmap(handles, 4096);
+}
+
static void
test_write_gtt(int fd)
{
@@ -985,6 +1079,10 @@ igt_main
test_wc(fd);
igt_subtest("isolation")
test_isolation(fd);
+ igt_subtest("close-race")
+ test_close_race(fd);
+ igt_subtest("flink-race")
+ test_flink_race(fd);
igt_subtest("pf-nonblock")
test_pf_nonblock(fd);
--
2.23.0
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [Intel-gfx] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure 2019-08-26 15:20 [Intel-gfx] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure Chris Wilson @ 2019-08-26 15:29 ` Chris Wilson 2019-08-26 16:21 ` [igt-dev] ✓ Fi.CI.BAT: success for " Patchwork ` (3 subsequent siblings) 4 siblings, 0 replies; 6+ messages in thread From: Chris Wilson @ 2019-08-26 15:29 UTC (permalink / raw) To: intel-gfx; +Cc: igt-dev Quoting Chris Wilson (2019-08-26 16:20:00) > Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> > Cc: Abdiel Janulgue <abdiel.janulgue@linux.intel.com> That honestly worked better than I was anticipating, [ 36.413656] [IGT] gem_mmap_gtt: executing [ 36.425906] [IGT] gem_mmap_gtt: starting subtest close-race [ 36.448179] ------------[ cut here ]------------ [ 36.448414] refcount_t: increment on 0; use-after-free. [ 36.448548] WARNING: CPU: 3 PID: 802 at lib/refcount.c:156 refcount_inc_checked+0x2b/0x30 [ 36.448667] Modules linked in: i915 intel_gtt iosf_mbi prime_numbers drm_kms_helper drm drm_panel_orientation_quirks [ 36.448820] CPU: 3 PID: 802 Comm: gem_mmap_gtt Not tainted 5.3.0-rc6+ #187 [ 36.448927] Hardware name: Intel Corporation 2012 Client Platform/Emerald Lake 2, BIOS ACRVMBY1.86C.0078.P00.1201161002 01/16/2012 [ 36.449076] RIP: 0010:refcount_inc_checked+0x2b/0x30 [ 36.449170] Code: 48 89 e5 e8 e7 fe ff ff 84 c0 74 02 5d c3 80 3d 93 de fc 00 00 75 f5 48 c7 c7 80 88 f2 81 c6 05 83 de fc 00 01 e8 b6 8e b4 ff <0f> 0b 5d c3 90 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41 57 49 [ 36.449373] RSP: 0018:ffff88820333fc00 EFLAGS: 00010282 [ 36.449467] RAX: 0000000000000000 RBX: ffff8882036169e8 RCX: 0000000000000000 [ 36.449531] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffed1040667f76 [ 36.449605] RBP: ffff88820333fc00 R08: 0000000000000001 R09: ffffed1042b5bec5 [ 36.449661] R10: ffffed1042b5bec4 R11: ffff888215adf627 R12: ffff8881ff8b32a8 [ 36.449713] R13: ffff888203616a38 R14: ffff888203616a30 R15: 0000000000000000 [ 36.449766] FS: 00007f5d234efd40(0000) GS:ffff888215ac0000(0000) knlGS:0000000000000000 [ 36.449827] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 36.449878] CR2: 00007f5d24366020 CR3: 00000001ff758001 CR4: 00000000001606e0 [ 36.449929] Call Trace: [ 36.450115] i915_gem_mmap+0x346/0x3a0 [i915] [ 36.450295] ? i915_gem_vm_close+0x90/0x90 [i915] [ 36.450350] ? memset+0x32/0x40 [ 36.450389] mmap_region+0x646/0xa20 [ 36.450430] ? __x64_sys_brk+0x390/0x390 [ 36.450474] ? arch_get_unmapped_area+0x370/0x370 [ 36.450518] do_mmap+0x3e4/0x6d0 [ 36.450556] vm_mmap_pgoff+0xf9/0x150 [ 36.450599] ? vma_is_stack_for_current+0x60/0x60 [ 36.450643] ksys_mmap_pgoff+0x94/0xc0 [ 36.450683] __x64_sys_mmap+0x88/0xa0 [ 36.450723] do_syscall_64+0x72/0xe0 [ 36.450765] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 36.450811] RIP: 0033:0x7f5d23c74133 [ 36.450854] Code: 54 41 89 d4 55 48 89 fd 53 4c 89 cb 48 85 ff 74 56 49 89 d9 45 89 f8 45 89 f2 44 89 e2 4c 89 ee 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7d 5b 5d 41 5c 41 5d 41 5e 41 5f c3 66 2e 0f [ 36.450952] RSP: 002b:00007fffb808da68 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 36.451011] RAX: ffffffffffffffda RBX: 0000000100006000 RCX: 00007f5d23c74133 [ 36.451069] RDX: 0000000000000001 RSI: 0000000000001000 RDI: 0000000000000000 [ 36.451121] RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000100006000 [ 36.451194] R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000001 [ 36.451304] R13: 0000000000001000 R14: 0000000000000001 R15: 0000000000000003 [ 36.451414] irq event stamp: 5158 [ 36.451493] hardirqs last enabled at (5157): [<ffffffff8112d575>] console_unlock+0x545/0x6f0 [ 36.451627] hardirqs last disabled at (5158): [<ffffffff810026ca>] trace_hardirqs_off_thunk+0x1a/0x20 [ 36.451756] softirqs last enabled at (4752): [<ffffffff81c00441>] __do_softirq+0x441/0x575 [ 36.451879] softirqs last disabled at (4747): [<ffffffff8109b80e>] irq_exit+0x14e/0x160 [ 36.452000] WARNING: CPU: 3 PID: 802 at lib/refcount.c:156 refcount_inc_checked+0x2b/0x30 [ 36.452125] ---[ end trace 1a7be3cf5c013580 ]--- [ 36.452340] ================================================================== [ 36.452849] BUG: KASAN: use-after-free in i915_gem_vm_close+0x35/0x90 [i915] [ 36.452960] Read of size 8 at addr ffff8881ff8b3390 by task gem_mmap_gtt/802 [ 36.453064] [ 36.453129] CPU: 3 PID: 802 Comm: gem_mmap_gtt Tainted: G W 5.3.0-rc6+ #187 [ 36.453248] Hardware name: Intel Corporation 2012 Client Platform/Emerald Lake 2, BIOS ACRVMBY1.86C.0078.P00.1201161002 01/16/2012 [ 36.453395] Call Trace: [ 36.453469] dump_stack+0x86/0xca [ 36.453552] print_address_description+0x6e/0x324 [ 36.453913] ? i915_gem_vm_close+0x35/0x90 [i915] [ 36.454006] __kasan_report.cold+0x1b/0x37 [ 36.454332] ? i915_gem_vm_close+0x35/0x90 [i915] [ 36.454423] kasan_report+0xc/0xe [ 36.454500] __asan_load8+0x54/0x90 [ 36.454821] i915_gem_vm_close+0x35/0x90 [i915] [ 36.454907] remove_vma+0x5e/0x90 [ 36.454983] __do_munmap+0x315/0x670 [ 36.455062] __vm_munmap+0xa9/0xf0 [ 36.455139] ? __do_munmap+0x670/0x670 [ 36.455218] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 36.455307] ? lockdep_hardirqs_on+0x185/0x260 [ 36.455393] __x64_sys_munmap+0x31/0x40 [ 36.455475] do_syscall_64+0x72/0xe0 [ 36.455554] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 36.455645] RIP: 0033:0x7f5d23c741d7 [ 36.455730] Code: 10 e9 67 ff ff ff 0f 1f 44 00 00 48 8b 15 b1 6c 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff e9 6b ff ff ff b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 89 6c 0c 00 f7 d8 64 89 01 48 [ 36.455965] RSP: 002b:00007fffb808da98 EFLAGS: 00000213 ORIG_RAX: 000000000000000b [ 36.456081] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5d23c741d7 [ 36.456188] RDX: 0000000000000001 RSI: 0000000000001000 RDI: 00007f5d24365000 [ 36.456298] RBP: 00007f5d24366000 R08: 0000000000000003 R09: 0000000100006000 [ 36.456407] R10: 0000000000000001 R11: 0000000000000213 R12: 0000000000000003 [ 36.456514] R13: 0000000000000002 R14: 0000000000000008 R15: 0000000000000000 [ 36.456623] [ 36.456682] Allocated by task 802: [ 36.456762] save_stack+0x23/0x90 [ 36.456838] __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 36.456926] kasan_kmalloc+0x9/0x10 [ 36.457004] kmem_cache_alloc_trace+0x11c/0x2f0 [ 36.457358] __assign_gem_object_mmap_data+0x103/0x250 [i915] [ 36.457717] i915_gem_mmap_gtt_ioctl+0x5c/0x100 [i915] [ 36.457864] drm_ioctl_kernel+0x126/0x170 [drm] [ 36.458013] drm_ioctl+0x331/0x550 [drm] [ 36.458098] do_vfs_ioctl+0x767/0xa30 [ 36.458176] ksys_ioctl+0x3c/0x80 [ 36.458252] __x64_sys_ioctl+0x3e/0x50 [ 36.458261] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 36.458304] do_syscall_64+0x72/0xe0 [ 36.458364] #PF: supervisor read access in kernel mode [ 36.458410] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 36.458458] #PF: error_code(0x0000) - not-present page [ 36.458508] [ 36.458567] PGD 0 P4D 0 [ 36.458618] Freed by task 803: [ 36.458667] Oops: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN [ 36.458716] save_stack+0x23/0x90 _______________________________________________ Intel-gfx mailing list Intel-gfx@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/intel-gfx ^ permalink raw reply [flat|nested] 6+ messages in thread
* [igt-dev] ✓ Fi.CI.BAT: success for i915/gem_mmap_gtt: Race mmap offset generation against closure 2019-08-26 15:20 [Intel-gfx] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure Chris Wilson 2019-08-26 15:29 ` Chris Wilson @ 2019-08-26 16:21 ` Patchwork 2019-08-26 20:09 ` [igt-dev] ✓ Fi.CI.IGT: " Patchwork ` (2 subsequent siblings) 4 siblings, 0 replies; 6+ messages in thread From: Patchwork @ 2019-08-26 16:21 UTC (permalink / raw) To: Chris Wilson; +Cc: igt-dev == Series Details == Series: i915/gem_mmap_gtt: Race mmap offset generation against closure URL : https://patchwork.freedesktop.org/series/65817/ State : success == Summary == CI Bug Log - changes from IGT_5150 -> IGTPW_3381 ==================================================== Summary ------- **SUCCESS** No regressions found. External URL: https://patchwork.freedesktop.org/api/1.0/series/65817/revisions/1/mbox/ Known issues ------------ Here are the changes found in IGTPW_3381 that come from known issues: ### IGT changes ### #### Issues hit #### * igt@gem_ctx_param@basic-default: - fi-icl-u3: [PASS][1] -> [DMESG-WARN][2] ([fdo#107724]) [1]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/fi-icl-u3/igt@gem_ctx_param@basic-default.html [2]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/fi-icl-u3/igt@gem_ctx_param@basic-default.html * igt@i915_selftest@live_hangcheck: - fi-cfl-8109u: [PASS][3] -> [INCOMPLETE][4] ([fdo#106070]) [3]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/fi-cfl-8109u/igt@i915_selftest@live_hangcheck.html [4]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/fi-cfl-8109u/igt@i915_selftest@live_hangcheck.html * igt@kms_chamelium@dp-edid-read: - fi-icl-u2: [PASS][5] -> [FAIL][6] ([fdo#109483] / [fdo#109635 ]) [5]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/fi-icl-u2/igt@kms_chamelium@dp-edid-read.html [6]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/fi-icl-u2/igt@kms_chamelium@dp-edid-read.html #### Possible fixes #### * igt@i915_module_load@reload-no-display: - {fi-icl-u4}: [DMESG-WARN][7] ([fdo#105602]) -> [PASS][8] [7]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/fi-icl-u4/igt@i915_module_load@reload-no-display.html [8]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/fi-icl-u4/igt@i915_module_load@reload-no-display.html * igt@kms_frontbuffer_tracking@basic: - fi-icl-u2: [FAIL][9] ([fdo#103167]) -> [PASS][10] [9]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/fi-icl-u2/igt@kms_frontbuffer_tracking@basic.html [10]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/fi-icl-u2/igt@kms_frontbuffer_tracking@basic.html {name}: This element is suppressed. This means it is ignored when computing the status of the difference (SUCCESS, WARNING, or FAILURE). [fdo#103167]: https://bugs.freedesktop.org/show_bug.cgi?id=103167 [fdo#105602]: https://bugs.freedesktop.org/show_bug.cgi?id=105602 [fdo#106070]: https://bugs.freedesktop.org/show_bug.cgi?id=106070 [fdo#107724]: https://bugs.freedesktop.org/show_bug.cgi?id=107724 [fdo#109483]: https://bugs.freedesktop.org/show_bug.cgi?id=109483 [fdo#109635 ]: https://bugs.freedesktop.org/show_bug.cgi?id=109635 Participating hosts (53 -> 45) ------------------------------ Missing (8): fi-kbl-soraka fi-ilk-m540 fi-hsw-4200u fi-byt-squawks fi-bsw-cyan fi-icl-y fi-byt-clapper fi-bdw-samus Build changes ------------- * CI: CI-20190529 -> None * IGT: IGT_5150 -> IGTPW_3381 CI-20190529: 20190529 CI_DRM_6785: f1f309b0b9d38667082d95904d7967f13fd2e274 @ git://anongit.freedesktop.org/gfx-ci/linux IGTPW_3381: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/ IGT_5150: a4e8217bcdfef9bb523f26a9084bbf615a6e8abb @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools == Testlist changes == +igt@gem_mmap_gtt@close-race +igt@gem_mmap_gtt@flink-race == Logs == For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/ _______________________________________________ igt-dev mailing list igt-dev@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/igt-dev ^ permalink raw reply [flat|nested] 6+ messages in thread
* [igt-dev] ✓ Fi.CI.IGT: success for i915/gem_mmap_gtt: Race mmap offset generation against closure 2019-08-26 15:20 [Intel-gfx] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure Chris Wilson 2019-08-26 15:29 ` Chris Wilson 2019-08-26 16:21 ` [igt-dev] ✓ Fi.CI.BAT: success for " Patchwork @ 2019-08-26 20:09 ` Patchwork 2019-08-27 8:41 ` [igt-dev] [PATCH i-g-t] " Arkadiusz Hiler 2019-08-29 7:36 ` Abdiel Janulgue 4 siblings, 0 replies; 6+ messages in thread From: Patchwork @ 2019-08-26 20:09 UTC (permalink / raw) To: Chris Wilson; +Cc: igt-dev == Series Details == Series: i915/gem_mmap_gtt: Race mmap offset generation against closure URL : https://patchwork.freedesktop.org/series/65817/ State : success == Summary == CI Bug Log - changes from IGT_5150_full -> IGTPW_3381_full ==================================================== Summary ------- **SUCCESS** No regressions found. External URL: https://patchwork.freedesktop.org/api/1.0/series/65817/revisions/1/mbox/ New tests --------- New tests have been introduced between IGT_5150_full and IGTPW_3381_full: ### New IGT tests (2) ### * igt@gem_mmap_gtt@close-race: - Statuses : 6 pass(s) - Exec time: [20.02, 20.05] s * igt@gem_mmap_gtt@flink-race: - Statuses : 4 pass(s) - Exec time: [20.02, 20.06] s Known issues ------------ Here are the changes found in IGTPW_3381_full that come from known issues: ### IGT changes ### #### Issues hit #### * igt@gem_ctx_isolation@rcs0-s3: - shard-apl: [PASS][1] -> [DMESG-WARN][2] ([fdo#108566]) +3 similar issues [1]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-apl6/igt@gem_ctx_isolation@rcs0-s3.html [2]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-apl4/igt@gem_ctx_isolation@rcs0-s3.html * igt@gem_ctx_shared@q-in-order-bsd2: - shard-iclb: [PASS][3] -> [SKIP][4] ([fdo#109276]) +12 similar issues [3]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb1/igt@gem_ctx_shared@q-in-order-bsd2.html [4]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb7/igt@gem_ctx_shared@q-in-order-bsd2.html * igt@gem_exec_schedule@preempt-queue-bsd: - shard-iclb: [PASS][5] -> [SKIP][6] ([fdo#111325]) [5]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb7/igt@gem_exec_schedule@preempt-queue-bsd.html [6]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb4/igt@gem_exec_schedule@preempt-queue-bsd.html * igt@gem_tiled_swapping@non-threaded: - shard-kbl: [PASS][7] -> [DMESG-WARN][8] ([fdo#108686]) [7]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-kbl1/igt@gem_tiled_swapping@non-threaded.html [8]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-kbl4/igt@gem_tiled_swapping@non-threaded.html * igt@kms_busy@extended-pageflip-hang-newfb-render-c: - shard-apl: [PASS][9] -> [INCOMPLETE][10] ([fdo#103927]) +1 similar issue [9]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-apl3/igt@kms_busy@extended-pageflip-hang-newfb-render-c.html [10]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-apl1/igt@kms_busy@extended-pageflip-hang-newfb-render-c.html * igt@kms_cursor_crc@pipe-a-cursor-suspend: - shard-kbl: [PASS][11] -> [INCOMPLETE][12] ([fdo#103665]) [11]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-kbl2/igt@kms_cursor_crc@pipe-a-cursor-suspend.html [12]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-kbl3/igt@kms_cursor_crc@pipe-a-cursor-suspend.html * igt@kms_frontbuffer_tracking@fbc-1p-primscrn-spr-indfb-draw-mmap-cpu: - shard-apl: [PASS][13] -> [FAIL][14] ([fdo#103167]) [13]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-apl2/igt@kms_frontbuffer_tracking@fbc-1p-primscrn-spr-indfb-draw-mmap-cpu.html [14]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-apl7/igt@kms_frontbuffer_tracking@fbc-1p-primscrn-spr-indfb-draw-mmap-cpu.html - shard-kbl: [PASS][15] -> [FAIL][16] ([fdo#103167]) [15]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-kbl6/igt@kms_frontbuffer_tracking@fbc-1p-primscrn-spr-indfb-draw-mmap-cpu.html [16]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-kbl7/igt@kms_frontbuffer_tracking@fbc-1p-primscrn-spr-indfb-draw-mmap-cpu.html * igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-pri-indfb-draw-pwrite: - shard-iclb: [PASS][17] -> [FAIL][18] ([fdo#103167]) +1 similar issue [17]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb3/igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-pri-indfb-draw-pwrite.html [18]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb4/igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-pri-indfb-draw-pwrite.html * igt@kms_psr@psr2_sprite_mmap_gtt: - shard-iclb: [PASS][19] -> [SKIP][20] ([fdo#109441]) +1 similar issue [19]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb2/igt@kms_psr@psr2_sprite_mmap_gtt.html [20]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb7/igt@kms_psr@psr2_sprite_mmap_gtt.html * igt@tools_test@tools_test: - shard-glk: [PASS][21] -> [SKIP][22] ([fdo#109271]) [21]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-glk9/igt@tools_test@tools_test.html [22]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-glk6/igt@tools_test@tools_test.html #### Possible fixes #### * igt@gem_bad_reloc@negative-reloc-bsd2: - shard-iclb: [SKIP][23] ([fdo#109276]) -> [PASS][24] +14 similar issues [23]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb7/igt@gem_bad_reloc@negative-reloc-bsd2.html [24]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb1/igt@gem_bad_reloc@negative-reloc-bsd2.html * igt@gem_ctx_shared@exec-single-timeline-bsd: - shard-iclb: [SKIP][25] ([fdo#110841]) -> [PASS][26] [25]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb2/igt@gem_ctx_shared@exec-single-timeline-bsd.html [26]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb5/igt@gem_ctx_shared@exec-single-timeline-bsd.html * igt@gem_eio@reset-stress: - shard-snb: [FAIL][27] ([fdo#109661]) -> [PASS][28] [27]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-snb1/igt@gem_eio@reset-stress.html [28]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-snb1/igt@gem_eio@reset-stress.html * igt@gem_exec_balancer@smoke: - shard-iclb: [SKIP][29] ([fdo#110854]) -> [PASS][30] [29]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb8/igt@gem_exec_balancer@smoke.html [30]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb4/igt@gem_exec_balancer@smoke.html * igt@gem_exec_schedule@deep-bsd: - shard-iclb: [SKIP][31] ([fdo#111325]) -> [PASS][32] +6 similar issues [31]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb1/igt@gem_exec_schedule@deep-bsd.html [32]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb7/igt@gem_exec_schedule@deep-bsd.html * igt@i915_selftest@mock_fence: - shard-iclb: [INCOMPLETE][33] ([fdo#107713]) -> [PASS][34] [33]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb7/igt@i915_selftest@mock_fence.html [34]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb4/igt@i915_selftest@mock_fence.html * igt@i915_suspend@sysfs-reader: - shard-apl: [DMESG-WARN][35] ([fdo#108566]) -> [PASS][36] +3 similar issues [35]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-apl8/igt@i915_suspend@sysfs-reader.html [36]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-apl4/igt@i915_suspend@sysfs-reader.html * igt@kms_busy@basic-flip-b: - shard-kbl: [DMESG-WARN][37] -> [PASS][38] [37]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-kbl2/igt@kms_busy@basic-flip-b.html [38]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-kbl1/igt@kms_busy@basic-flip-b.html * igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-pri-indfb-draw-blt: - shard-iclb: [FAIL][39] ([fdo#103167]) -> [PASS][40] +4 similar issues [39]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb2/igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-pri-indfb-draw-blt.html [40]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb3/igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-pri-indfb-draw-blt.html * igt@kms_psr@no_drrs: - shard-iclb: [FAIL][41] ([fdo#108341]) -> [PASS][42] [41]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb1/igt@kms_psr@no_drrs.html [42]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb7/igt@kms_psr@no_drrs.html * igt@kms_psr@psr2_cursor_blt: - shard-iclb: [SKIP][43] ([fdo#109441]) -> [PASS][44] +1 similar issue [43]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb8/igt@kms_psr@psr2_cursor_blt.html [44]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb2/igt@kms_psr@psr2_cursor_blt.html #### Warnings #### * igt@gem_mocs_settings@mocs-rc6-bsd2: - shard-iclb: [SKIP][45] ([fdo#109276]) -> [FAIL][46] ([fdo#111330]) [45]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb6/igt@gem_mocs_settings@mocs-rc6-bsd2.html [46]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb2/igt@gem_mocs_settings@mocs-rc6-bsd2.html * igt@gem_mocs_settings@mocs-reset-bsd2: - shard-iclb: [FAIL][47] ([fdo#111330]) -> [SKIP][48] ([fdo#109276]) [47]: https://intel-gfx-ci.01.org/tree/drm-tip/IGT_5150/shard-iclb4/igt@gem_mocs_settings@mocs-reset-bsd2.html [48]: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/shard-iclb7/igt@gem_mocs_settings@mocs-reset-bsd2.html [fdo#103167]: https://bugs.freedesktop.org/show_bug.cgi?id=103167 [fdo#103665]: https://bugs.freedesktop.org/show_bug.cgi?id=103665 [fdo#103927]: https://bugs.freedesktop.org/show_bug.cgi?id=103927 [fdo#107713]: https://bugs.freedesktop.org/show_bug.cgi?id=107713 [fdo#108341]: https://bugs.freedesktop.org/show_bug.cgi?id=108341 [fdo#108566]: https://bugs.freedesktop.org/show_bug.cgi?id=108566 [fdo#108686]: https://bugs.freedesktop.org/show_bug.cgi?id=108686 [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 [fdo#109276]: https://bugs.freedesktop.org/show_bug.cgi?id=109276 [fdo#109441]: https://bugs.freedesktop.org/show_bug.cgi?id=109441 [fdo#109661]: https://bugs.freedesktop.org/show_bug.cgi?id=109661 [fdo#110841]: https://bugs.freedesktop.org/show_bug.cgi?id=110841 [fdo#110854]: https://bugs.freedesktop.org/show_bug.cgi?id=110854 [fdo#111325]: https://bugs.freedesktop.org/show_bug.cgi?id=111325 [fdo#111330]: https://bugs.freedesktop.org/show_bug.cgi?id=111330 Participating hosts (7 -> 6) ------------------------------ Missing (1): shard-skl Build changes ------------- * CI: CI-20190529 -> None * IGT: IGT_5150 -> IGTPW_3381 CI-20190529: 20190529 CI_DRM_6785: f1f309b0b9d38667082d95904d7967f13fd2e274 @ git://anongit.freedesktop.org/gfx-ci/linux IGTPW_3381: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/ IGT_5150: a4e8217bcdfef9bb523f26a9084bbf615a6e8abb @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools == Logs == For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/IGTPW_3381/ _______________________________________________ igt-dev mailing list igt-dev@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/igt-dev ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [igt-dev] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure 2019-08-26 15:20 [Intel-gfx] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure Chris Wilson ` (2 preceding siblings ...) 2019-08-26 20:09 ` [igt-dev] ✓ Fi.CI.IGT: " Patchwork @ 2019-08-27 8:41 ` Arkadiusz Hiler 2019-08-29 7:36 ` Abdiel Janulgue 4 siblings, 0 replies; 6+ messages in thread From: Arkadiusz Hiler @ 2019-08-27 8:41 UTC (permalink / raw) To: Chris Wilson; +Cc: igt-dev, intel-gfx On Mon, Aug 26, 2019 at 04:20:00PM +0100, Chris Wilson wrote: > Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> > Cc: Abdiel Janulgue <abdiel.janulgue@linux.intel.com> > --- > tests/i915/gem_mmap_gtt.c | 98 +++++++++++++++++++++++++++++++++++++++ > 1 file changed, 98 insertions(+) > > diff --git a/tests/i915/gem_mmap_gtt.c b/tests/i915/gem_mmap_gtt.c > index 8eff91850..81068f7d1 100644 > --- a/tests/i915/gem_mmap_gtt.c > +++ b/tests/i915/gem_mmap_gtt.c > @@ -26,6 +26,7 @@ > */ > > #include <unistd.h> > +#include <stdatomic.h> > #include <stdlib.h> > #include <stdio.h> > #include <string.h> > @@ -360,6 +361,99 @@ test_isolation(int i915) > igt_assert(ptr == MAP_FAILED); > } > > +static void > +test_close_race(int i915) > +{ > + const int ncpus = sysconf(_SC_NPROCESSORS_ONLN); > + uint32_t *handles; > + > + handles = mmap64(0, 4096, PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0); > + igt_assert(handles != MAP_FAILED); > + > + igt_fork(child, ncpus) { > + do { > + struct drm_i915_gem_mmap_gtt mmap_arg = {}; > + int i = 1 + random() % ncpus; > + uint32_t old; > + > + mmap_arg.handle = gem_create(i915, 4096); > + old = atomic_exchange(&handles[i], mmap_arg.handle); ../tests/i915/gem_mmap_gtt.c:380:10: error: address argument to atomic operation must be a pointer to _Atomic type ('uint32_t *' (aka 'unsigned int *') invalid) old = atomic_exchange(&handles[i], mmap_arg.handle); ^ ~~~~~~~~~~~ /usr/lib64/clang/8.0.0/include/stdatomic.h:137:42: note: expanded from macro 'atomic_exchange' #define atomic_exchange(object, desired) __c11_atomic_exchange(object, desired, __ATOMIC_SEQ_CST) ^ ~~~~~~ ../tests/i915/gem_mmap_gtt.c:423:10: error: address argument to atomic operation must be a pointer to _Atomic type ('uint32_t *' (aka 'unsigned int *') invalid) old = atomic_exchange(&handles[i], ^ ~~~~~~~~~~~ /usr/lib64/clang/8.0.0/include/stdatomic.h:137:42: note: expanded from macro 'atomic_exchange' #define atomic_exchange(object, desired) __c11_atomic_exchange(object, desired, __ATOMIC_SEQ_CST) ^ ~~~~~~ 2 errors generated. https://gitlab.freedesktop.org/gfx-ci/igt-ci-tags/-/jobs/535592 _______________________________________________ igt-dev mailing list igt-dev@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/igt-dev ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [igt-dev] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure 2019-08-26 15:20 [Intel-gfx] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure Chris Wilson ` (3 preceding siblings ...) 2019-08-27 8:41 ` [igt-dev] [PATCH i-g-t] " Arkadiusz Hiler @ 2019-08-29 7:36 ` Abdiel Janulgue 4 siblings, 0 replies; 6+ messages in thread From: Abdiel Janulgue @ 2019-08-29 7:36 UTC (permalink / raw) To: Chris Wilson, intel-gfx; +Cc: igt-dev Yup, this is a valid issue. Reviewed-by: Abdiel Janulgue <abdiel.janulgue@linux.intel.com> On 26/08/2019 18.20, Chris Wilson wrote: > Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> > Cc: Abdiel Janulgue <abdiel.janulgue@linux.intel.com> > --- > tests/i915/gem_mmap_gtt.c | 98 +++++++++++++++++++++++++++++++++++++++ > 1 file changed, 98 insertions(+) > > diff --git a/tests/i915/gem_mmap_gtt.c b/tests/i915/gem_mmap_gtt.c > index 8eff91850..81068f7d1 100644 > --- a/tests/i915/gem_mmap_gtt.c > +++ b/tests/i915/gem_mmap_gtt.c > @@ -26,6 +26,7 @@ > */ > > #include <unistd.h> > +#include <stdatomic.h> > #include <stdlib.h> > #include <stdio.h> > #include <string.h> > @@ -360,6 +361,99 @@ test_isolation(int i915) > igt_assert(ptr == MAP_FAILED); > } > > +static void > +test_close_race(int i915) > +{ > + const int ncpus = sysconf(_SC_NPROCESSORS_ONLN); > + uint32_t *handles; > + > + handles = mmap64(0, 4096, PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0); > + igt_assert(handles != MAP_FAILED); > + > + igt_fork(child, ncpus) { > + do { > + struct drm_i915_gem_mmap_gtt mmap_arg = {}; > + int i = 1 + random() % ncpus; > + uint32_t old; > + > + mmap_arg.handle = gem_create(i915, 4096); > + old = atomic_exchange(&handles[i], mmap_arg.handle); > + ioctl(i915, DRM_IOCTL_GEM_CLOSE, &old); > + > + if (ioctl(i915, > + DRM_IOCTL_I915_GEM_MMAP_GTT, > + &mmap_arg) != -1) { > + void *ptr; > + > + ptr = mmap64(0, 4096, > + PROT_READ, MAP_SHARED, i915, > + mmap_arg.offset); > + if (ptr != MAP_FAILED) > + munmap(ptr, 4096); > + } > + } while (!READ_ONCE(handles[0])); > + } > + > + sleep(20); > + handles[0] = 1; > + igt_waitchildren(); > + > + for (int i = 1; i <= ncpus; i++) > + ioctl(i915, DRM_IOCTL_GEM_CLOSE, handles[i]); > + munmap(handles, 4096); > +} > + > +static void > +test_flink_race(int i915) > +{ > + const int ncpus = sysconf(_SC_NPROCESSORS_ONLN); > + uint32_t *handles; > + > + handles = mmap64(0, 4096, PROT_WRITE, MAP_SHARED | MAP_ANON, -1, 0); > + igt_assert(handles != MAP_FAILED); > + > + igt_fork(child, ncpus) { > + int fd = gem_reopen_driver(i915); > + > + do { > + struct drm_i915_gem_mmap_gtt mmap_arg = {}; > + uint32_t old; > + int i = 1 + random() % ncpus; > + > + old = atomic_exchange(&handles[i], > + gem_create(i915, 4096)); > + if (!old) > + continue; > + > + mmap_arg.handle = > + gem_open(fd, gem_flink(i915, old)); > + ioctl(i915, DRM_IOCTL_GEM_CLOSE, &old); > + > + if (ioctl(fd, > + DRM_IOCTL_I915_GEM_MMAP_GTT, > + &mmap_arg) != -1) { > + void *ptr; > + > + ptr = mmap64(0, 4096, > + PROT_READ, MAP_SHARED, fd, > + mmap_arg.offset); > + if (ptr != MAP_FAILED) > + munmap(ptr, 4096); > + } > + > + ioctl(fd, DRM_IOCTL_GEM_CLOSE, &mmap_arg.handle); > + } while (!READ_ONCE(handles[0])); > + } > + > + sleep(20); > + handles[0] = 1; > + igt_waitchildren(); > + > + for (int i = 1; i <= ncpus; i++) > + ioctl(i915, DRM_IOCTL_GEM_CLOSE, handles[i]); > + munmap(handles, 4096); > +} > + > static void > test_write_gtt(int fd) > { > @@ -985,6 +1079,10 @@ igt_main > test_wc(fd); > igt_subtest("isolation") > test_isolation(fd); > + igt_subtest("close-race") > + test_close_race(fd); > + igt_subtest("flink-race") > + test_flink_race(fd); > igt_subtest("pf-nonblock") > test_pf_nonblock(fd); > > _______________________________________________ igt-dev mailing list igt-dev@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/igt-dev ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-08-29 7:36 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2019-08-26 15:20 [Intel-gfx] [PATCH i-g-t] i915/gem_mmap_gtt: Race mmap offset generation against closure Chris Wilson 2019-08-26 15:29 ` Chris Wilson 2019-08-26 16:21 ` [igt-dev] ✓ Fi.CI.BAT: success for " Patchwork 2019-08-26 20:09 ` [igt-dev] ✓ Fi.CI.IGT: " Patchwork 2019-08-27 8:41 ` [igt-dev] [PATCH i-g-t] " Arkadiusz Hiler 2019-08-29 7:36 ` Abdiel Janulgue
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox