From mboxrd@z Thu Jan 1 00:00:00 1970 From: Daniel Vetter Subject: Re: [PATCH] drm/i915: Fix erroneous dereference of batch_obj inside reset_status Date: Thu, 12 Dec 2013 10:54:20 +0100 Message-ID: <20131212095420.GG9804@phenom.ffwll.local> References: <1386157029-5954-1-git-send-email-chris@chris-wilson.co.uk> <87haan9t8g.fsf@gaia.fi.intel.com> <20131205162201.GI3197@nuc-i3427.alporthouse.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail-ee0-f49.google.com (mail-ee0-f49.google.com [74.125.83.49]) by gabe.freedesktop.org (Postfix) with ESMTP id A8E66FB2EE for ; Thu, 12 Dec 2013 01:53:30 -0800 (PST) Received: by mail-ee0-f49.google.com with SMTP id c41so92234eek.36 for ; Thu, 12 Dec 2013 01:53:29 -0800 (PST) Content-Disposition: inline In-Reply-To: <20131205162201.GI3197@nuc-i3427.alporthouse.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: intel-gfx-bounces@lists.freedesktop.org Errors-To: intel-gfx-bounces@lists.freedesktop.org To: Chris Wilson , Mika Kuoppala , intel-gfx@lists.freedesktop.org, stable@vger.kernel.org List-Id: intel-gfx@lists.freedesktop.org On Thu, Dec 05, 2013 at 04:22:02PM +0000, Chris Wilson wrote: > On Thu, Dec 05, 2013 at 06:07:27PM +0200, Mika Kuoppala wrote: > > Chris Wilson writes: > > > > > As the rings may be processed and their requests deallocated in a > > > different order to the natural retirement during a reset, > > > > > > /* Whilst this request exists, batch_obj will be on the > > > * active_list, and so will hold the active reference. Only when this > > > * request is retired will the the batch_obj be moved onto the > > > * inactive_list and lose its active reference. Hence we do not need > > > * to explicitly hold another reference here. > > > */ > > > > > > is violated, and the batch_obj may be dereferenced after it had been > > > freed on another ring. This can be simply avoided by processing the > > > status update prior to deallocating any requests. > > > > > > Fixes regression (a possible OOPS following a GPU hang) from > > > commit aa60c664e6df502578454621c3a9b1f087ff8d25 > > > Author: Mika Kuoppala > > > Date: Wed Jun 12 15:13:20 2013 +0300 > > > > > > drm/i915: find guilty batch buffer on ring resets > > > > > > Signed-off-by: Chris Wilson > > > Cc: Mika Kuoppala > > > Cc: stable@vger.kernel.org > > > > Passes the igt/gem_reset_stats/close-pending-fork and > > doesn't affect the fast path. > > > > Reviewed-by: Mika Kuoppala > > For reference, this is the comment I added upon request: > > @@ -2502,8 +2508,15 @@ void i915_gem_reset(struct drm_device *dev) > struct intel_ring_buffer *ring; > int i; > > + /* Before we free the objects from the requests, we need to inspect > + * them for finding the guilty party. As the requests only borrow > + * their reference to the objects, the inspection must be done first. > + */ > + for_each_ring(ring, dev_priv, i) > + i915_gem_reset_ring_status(dev_priv, ring); > + > for_each_ring(ring, dev_priv, i) > - i915_gem_reset_ring_lists(dev_priv, ring); > + i915_gem_reset_ring_cleanup(dev_priv, ring); > > i915_gem_cleanup_ringbuffer(dev); QA didn't hit this bug since the test wasn't added to the right make target. With that sorted I've now merged this patch (including comment) to -fixes. Thanks, Daniel -- Daniel Vetter Software Engineer, Intel Corporation +41 (0) 79 365 57 48 - http://blog.ffwll.ch