* [Intel-gfx] [PATCH v6 1/4] drm: avoid circular locks in drm_mode_getconnector
2021-06-30 14:54 [Intel-gfx] [PATCH v6 0/4] drm: address potential UAF bugs with drm_master ptrs Desmond Cheong Zhi Xi
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
2021-06-30 14:54 ` [Intel-gfx] [PATCH v6 2/4] drm: avoid circular locks in __drm_mode_object_find Desmond Cheong Zhi Xi
` (5 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: Daniel Vetter, gregkh, intel-gfx, linux-kernel, dri-devel,
linaro-mm-sig, skhan, Desmond Cheong Zhi Xi, linux-kernel-mentees,
linux-media
In preparation for a future patch to take a lock on
drm_device.master_mutex inside drm_is_current_master(), we first move
the call to drm_is_current_master() in drm_mode_getconnector out from the
section locked by &dev->mode_config.mutex. This avoids creating a
circular lock dependency.
Failing to avoid this lock dependency produces the following lockdep
splat:
======================================================
WARNING: possible circular locking dependency detected
5.13.0-rc7-CI-CI_DRM_10254+ #1 Not tainted
------------------------------------------------------
kms_frontbuffer/1087 is trying to acquire lock:
ffff88810dcd01a8 (&dev->master_mutex){+.+.}-{3:3}, at: drm_is_current_master+0x1b/0x40
but task is already holding lock:
ffff88810dcd0488 (&dev->mode_config.mutex){+.+.}-{3:3}, at: drm_mode_getconnector+0x1c6/0x4a0
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&dev->mode_config.mutex){+.+.}-{3:3}:
__mutex_lock+0xab/0x970
drm_client_modeset_probe+0x22e/0xca0
__drm_fb_helper_initial_config_and_unlock+0x42/0x540
intel_fbdev_initial_config+0xf/0x20 [i915]
async_run_entry_fn+0x28/0x130
process_one_work+0x26d/0x5c0
worker_thread+0x37/0x380
kthread+0x144/0x170
ret_from_fork+0x1f/0x30
-> #1 (&client->modeset_mutex){+.+.}-{3:3}:
__mutex_lock+0xab/0x970
drm_client_modeset_commit_locked+0x1c/0x180
drm_client_modeset_commit+0x1c/0x40
__drm_fb_helper_restore_fbdev_mode_unlocked+0x88/0xb0
drm_fb_helper_set_par+0x34/0x40
intel_fbdev_set_par+0x11/0x40 [i915]
fbcon_init+0x270/0x4f0
visual_init+0xc6/0x130
do_bind_con_driver+0x1e5/0x2d0
do_take_over_console+0x10e/0x180
do_fbcon_takeover+0x53/0xb0
register_framebuffer+0x22d/0x310
__drm_fb_helper_initial_config_and_unlock+0x36c/0x540
intel_fbdev_initial_config+0xf/0x20 [i915]
async_run_entry_fn+0x28/0x130
process_one_work+0x26d/0x5c0
worker_thread+0x37/0x380
kthread+0x144/0x170
ret_from_fork+0x1f/0x30
-> #0 (&dev->master_mutex){+.+.}-{3:3}:
__lock_acquire+0x151e/0x2590
lock_acquire+0xd1/0x3d0
__mutex_lock+0xab/0x970
drm_is_current_master+0x1b/0x40
drm_mode_getconnector+0x37e/0x4a0
drm_ioctl_kernel+0xa8/0xf0
drm_ioctl+0x1e8/0x390
__x64_sys_ioctl+0x6a/0xa0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
other info that might help us debug this:
Chain exists of: &dev->master_mutex --> &client->modeset_mutex --> &dev->mode_config.mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&dev->mode_config.mutex);
lock(&client->modeset_mutex);
lock(&dev->mode_config.mutex);
lock(&dev->master_mutex);
*** DEADLOCK ***
1 lock held by kms_frontbuffer/1087:
#0: ffff88810dcd0488 (&dev->mode_config.mutex){+.+.}-{3:3}, at: drm_mode_getconnector+0x1c6/0x4a0
stack backtrace:
CPU: 7 PID: 1087 Comm: kms_frontbuffer Not tainted 5.13.0-rc7-CI-CI_DRM_10254+ #1
Hardware name: Intel Corporation Ice Lake Client Platform/IceLake U DDR4 SODIMM PD RVP TLC, BIOS ICLSFWR1.R00.3234.A01.1906141750 06/14/2019
Call Trace:
dump_stack+0x7f/0xad
check_noncircular+0x12e/0x150
__lock_acquire+0x151e/0x2590
lock_acquire+0xd1/0x3d0
__mutex_lock+0xab/0x970
drm_is_current_master+0x1b/0x40
drm_mode_getconnector+0x37e/0x4a0
drm_ioctl_kernel+0xa8/0xf0
drm_ioctl+0x1e8/0x390
__x64_sys_ioctl+0x6a/0xa0
do_syscall_64+0x39/0xb0
entry_SYSCALL_64_after_hwframe+0x44/0xae
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
---
drivers/gpu/drm/drm_connector.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index da39e7ff6965..2ba257b1ae20 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -2414,6 +2414,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
struct drm_mode_modeinfo u_mode;
struct drm_mode_modeinfo __user *mode_ptr;
uint32_t __user *encoder_ptr;
+ bool is_current_master;
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
@@ -2444,9 +2445,11 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
out_resp->connector_type = connector->connector_type;
out_resp->connector_type_id = connector->connector_type_id;
+ is_current_master = drm_is_current_master(file_priv);
+
mutex_lock(&dev->mode_config.mutex);
if (out_resp->count_modes == 0) {
- if (drm_is_current_master(file_priv))
+ if (is_current_master)
connector->funcs->fill_modes(connector,
dev->mode_config.max_width,
dev->mode_config.max_height);
--
2.25.1
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply related [flat|nested] 8+ messages in thread* [Intel-gfx] [PATCH v6 3/4] drm: add a locked version of drm_is_current_master
2021-06-30 14:54 [Intel-gfx] [PATCH v6 0/4] drm: address potential UAF bugs with drm_master ptrs Desmond Cheong Zhi Xi
2021-06-30 14:54 ` [Intel-gfx] [PATCH v6 1/4] drm: avoid circular locks in drm_mode_getconnector Desmond Cheong Zhi Xi
2021-06-30 14:54 ` [Intel-gfx] [PATCH v6 2/4] drm: avoid circular locks in __drm_mode_object_find Desmond Cheong Zhi Xi
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
2021-06-30 14:54 ` [Intel-gfx] [PATCH v6 4/4] drm: protect drm_master pointers in drm_lease.c Desmond Cheong Zhi Xi
` (3 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: Daniel Vetter, gregkh, intel-gfx, linux-kernel, dri-devel,
linaro-mm-sig, skhan, Desmond Cheong Zhi Xi, linux-kernel-mentees,
linux-media
While checking the master status of the DRM file in
drm_is_current_master(), the device's master mutex should be
held. Without the mutex, the pointer fpriv->master may be freed
concurrently by another process calling drm_setmaster_ioctl(). This
could lead to use-after-free errors when the pointer is subsequently
dereferenced in drm_lease_owner().
The callers of drm_is_current_master() from drm_auth.c hold the
device's master mutex, but external callers do not. Hence, we implement
drm_is_current_master_locked() to be used within drm_auth.c, and
modify drm_is_current_master() to grab the device's master mutex
before checking the master status.
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
---
drivers/gpu/drm/drm_auth.c | 51 ++++++++++++++++++++++++--------------
1 file changed, 32 insertions(+), 19 deletions(-)
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index f00e5abdbbf4..ab1863c5a5a0 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -61,6 +61,35 @@
* trusted clients.
*/
+static bool drm_is_current_master_locked(struct drm_file *fpriv)
+{
+ lockdep_assert_held_once(&fpriv->minor->dev->master_mutex);
+
+ return fpriv->is_master && drm_lease_owner(fpriv->master) == fpriv->minor->dev->master;
+}
+
+/**
+ * drm_is_current_master - checks whether @priv is the current master
+ * @fpriv: DRM file private
+ *
+ * Checks whether @fpriv is current master on its device. This decides whether a
+ * client is allowed to run DRM_MASTER IOCTLs.
+ *
+ * Most of the modern IOCTL which require DRM_MASTER are for kernel modesetting
+ * - the current master is assumed to own the non-shareable display hardware.
+ */
+bool drm_is_current_master(struct drm_file *fpriv)
+{
+ bool ret;
+
+ mutex_lock(&fpriv->minor->dev->master_mutex);
+ ret = drm_is_current_master_locked(fpriv);
+ mutex_unlock(&fpriv->minor->dev->master_mutex);
+
+ return ret;
+}
+EXPORT_SYMBOL(drm_is_current_master);
+
int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
{
struct drm_auth *auth = data;
@@ -223,7 +252,7 @@ int drm_setmaster_ioctl(struct drm_device *dev, void *data,
if (ret)
goto out_unlock;
- if (drm_is_current_master(file_priv))
+ if (drm_is_current_master_locked(file_priv))
goto out_unlock;
if (dev->master) {
@@ -272,7 +301,7 @@ int drm_dropmaster_ioctl(struct drm_device *dev, void *data,
if (ret)
goto out_unlock;
- if (!drm_is_current_master(file_priv)) {
+ if (!drm_is_current_master_locked(file_priv)) {
ret = -EINVAL;
goto out_unlock;
}
@@ -321,7 +350,7 @@ void drm_master_release(struct drm_file *file_priv)
if (file_priv->magic)
idr_remove(&file_priv->master->magic_map, file_priv->magic);
- if (!drm_is_current_master(file_priv))
+ if (!drm_is_current_master_locked(file_priv))
goto out;
drm_legacy_lock_master_cleanup(dev, master);
@@ -342,22 +371,6 @@ void drm_master_release(struct drm_file *file_priv)
mutex_unlock(&dev->master_mutex);
}
-/**
- * drm_is_current_master - checks whether @priv is the current master
- * @fpriv: DRM file private
- *
- * Checks whether @fpriv is current master on its device. This decides whether a
- * client is allowed to run DRM_MASTER IOCTLs.
- *
- * Most of the modern IOCTL which require DRM_MASTER are for kernel modesetting
- * - the current master is assumed to own the non-shareable display hardware.
- */
-bool drm_is_current_master(struct drm_file *fpriv)
-{
- return fpriv->is_master && drm_lease_owner(fpriv->master) == fpriv->minor->dev->master;
-}
-EXPORT_SYMBOL(drm_is_current_master);
-
/**
* drm_master_get - reference a master pointer
* @master: &struct drm_master
--
2.25.1
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply related [flat|nested] 8+ messages in thread* [Intel-gfx] [PATCH v6 4/4] drm: protect drm_master pointers in drm_lease.c
2021-06-30 14:54 [Intel-gfx] [PATCH v6 0/4] drm: address potential UAF bugs with drm_master ptrs Desmond Cheong Zhi Xi
` (2 preceding siblings ...)
2021-06-30 14:54 ` [Intel-gfx] [PATCH v6 3/4] drm: add a locked version of drm_is_current_master Desmond Cheong Zhi Xi
@ 2021-06-30 14:54 ` Desmond Cheong Zhi Xi
2021-06-30 18:18 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for drm: address potential UAF bugs with drm_master ptrs Patchwork
` (2 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Desmond Cheong Zhi Xi @ 2021-06-30 14:54 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel,
sumit.semwal, christian.koenig
Cc: Daniel Vetter, gregkh, intel-gfx, linux-kernel, dri-devel,
linaro-mm-sig, skhan, Desmond Cheong Zhi Xi, linux-kernel-mentees,
linux-media
Currently, direct copies of drm_file->master pointers should be
protected by drm_device.master_mutex when being dereferenced. This is
because drm_file->master is not invariant for the lifetime of
drm_file. If drm_file is not the creator of master, then
drm_file->is_master is false, and a call to drm_setmaster_ioctl will
invoke drm_new_set_master, which then allocates a new master for
drm_file and puts the old master.
Thus, without holding drm_device.master_mutex, the old value of
drm_file->master could be freed while it is being used by another
concurrent process.
In drm_lease.c, there are multiple instances where drm_file->master is
accessed and dereferenced while drm_device.master_mutex is not
held. This makes drm_lease.c vulnerable to use-after-free bugs.
We address this issue in 3 ways:
1. Clarify in the kerneldoc that drm_file->master is protected by
drm_device.master_mutex.
2. Add a new drm_file_get_master() function that calls drm_master_get
on drm_file->master while holding on to drm_device.master_mutex. Since
drm_master_get increments the reference count of master, this
prevents master from being freed until we unreference it with
drm_master_put.
3. In each case where drm_file->master is directly accessed and
eventually dereferenced in drm_lease.c, we wrap the access in a call
to the new drm_file_get_master function, then unreference the master
pointer once we are done using it.
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
---
drivers/gpu/drm/drm_auth.c | 25 ++++++++++++
drivers/gpu/drm/drm_lease.c | 81 ++++++++++++++++++++++++++++---------
include/drm/drm_auth.h | 1 +
include/drm/drm_file.h | 15 +++++--
4 files changed, 99 insertions(+), 23 deletions(-)
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index ab1863c5a5a0..c36a0b72be26 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -384,6 +384,31 @@ struct drm_master *drm_master_get(struct drm_master *master)
}
EXPORT_SYMBOL(drm_master_get);
+/**
+ * drm_file_get_master - reference &drm_file.master of @file_priv
+ * @file_priv: DRM file private
+ *
+ * Increments the reference count of @file_priv's &drm_file.master and returns
+ * the &drm_file.master. If @file_priv has no &drm_file.master, returns NULL.
+ *
+ * Master pointers returned from this function should be unreferenced using
+ * drm_master_put().
+ */
+struct drm_master *drm_file_get_master(struct drm_file *file_priv)
+{
+ struct drm_master *master = NULL;
+
+ mutex_lock(&file_priv->minor->dev->master_mutex);
+ if (!file_priv->master)
+ goto unlock;
+ master = drm_master_get(file_priv->master);
+
+unlock:
+ mutex_unlock(&file_priv->minor->dev->master_mutex);
+ return master;
+}
+EXPORT_SYMBOL(drm_file_get_master);
+
static void drm_master_destroy(struct kref *kref)
{
struct drm_master *master = container_of(kref, struct drm_master, refcount);
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index 00fb433bcef1..92eac73d9001 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -106,10 +106,19 @@ static bool _drm_has_leased(struct drm_master *master, int id)
*/
bool _drm_lease_held(struct drm_file *file_priv, int id)
{
- if (!file_priv || !file_priv->master)
+ bool ret;
+ struct drm_master *master;
+
+ if (!file_priv)
return true;
- return _drm_lease_held_master(file_priv->master, id);
+ master = drm_file_get_master(file_priv);
+ if (!master)
+ return true;
+ ret = _drm_lease_held_master(master, id);
+ drm_master_put(&master);
+
+ return ret;
}
/**
@@ -128,13 +137,22 @@ bool drm_lease_held(struct drm_file *file_priv, int id)
struct drm_master *master;
bool ret;
- if (!file_priv || !file_priv->master || !file_priv->master->lessor)
+ if (!file_priv)
return true;
- master = file_priv->master;
+ master = drm_file_get_master(file_priv);
+ if (!master)
+ return true;
+ if (!master->lessor) {
+ ret = true;
+ goto out;
+ }
mutex_lock(&master->dev->mode_config.idr_mutex);
ret = _drm_lease_held_master(master, id);
mutex_unlock(&master->dev->mode_config.idr_mutex);
+
+out:
+ drm_master_put(&master);
return ret;
}
@@ -154,10 +172,16 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
int count_in, count_out;
uint32_t crtcs_out = 0;
- if (!file_priv || !file_priv->master || !file_priv->master->lessor)
+ if (!file_priv)
return crtcs_in;
- master = file_priv->master;
+ master = drm_file_get_master(file_priv);
+ if (!master)
+ return crtcs_in;
+ if (!master->lessor) {
+ crtcs_out = crtcs_in;
+ goto out;
+ }
dev = master->dev;
count_in = count_out = 0;
@@ -176,6 +200,9 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
count_in++;
}
mutex_unlock(&master->dev->mode_config.idr_mutex);
+
+out:
+ drm_master_put(&master);
return crtcs_out;
}
@@ -489,7 +516,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
size_t object_count;
int ret = 0;
struct idr leases;
- struct drm_master *lessor = lessor_priv->master;
+ struct drm_master *lessor;
struct drm_master *lessee = NULL;
struct file *lessee_file = NULL;
struct file *lessor_file = lessor_priv->filp;
@@ -501,12 +528,6 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
- /* Do not allow sub-leases */
- if (lessor->lessor) {
- DRM_DEBUG_LEASE("recursive leasing not allowed\n");
- return -EINVAL;
- }
-
/* need some objects */
if (cl->object_count == 0) {
DRM_DEBUG_LEASE("no objects in lease\n");
@@ -518,12 +539,22 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
return -EINVAL;
}
+ lessor = drm_file_get_master(lessor_priv);
+ /* Do not allow sub-leases */
+ if (lessor->lessor) {
+ DRM_DEBUG_LEASE("recursive leasing not allowed\n");
+ ret = -EINVAL;
+ goto out_lessor;
+ }
+
object_count = cl->object_count;
object_ids = memdup_user(u64_to_user_ptr(cl->object_ids),
array_size(object_count, sizeof(__u32)));
- if (IS_ERR(object_ids))
- return PTR_ERR(object_ids);
+ if (IS_ERR(object_ids)) {
+ ret = PTR_ERR(object_ids);
+ goto out_lessor;
+ }
idr_init(&leases);
@@ -534,14 +565,15 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
if (ret) {
DRM_DEBUG_LEASE("lease object lookup failed: %i\n", ret);
idr_destroy(&leases);
- return ret;
+ goto out_lessor;
}
/* Allocate a file descriptor for the lease */
fd = get_unused_fd_flags(cl->flags & (O_CLOEXEC | O_NONBLOCK));
if (fd < 0) {
idr_destroy(&leases);
- return fd;
+ ret = fd;
+ goto out_lessor;
}
DRM_DEBUG_LEASE("Creating lease\n");
@@ -577,6 +609,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
/* Hook up the fd */
fd_install(fd, lessee_file);
+ drm_master_put(&lessor);
DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl succeeded\n");
return 0;
@@ -586,6 +619,8 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
out_leases:
put_unused_fd(fd);
+out_lessor:
+ drm_master_put(&lessor);
DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl failed: %d\n", ret);
return ret;
}
@@ -608,7 +643,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
struct drm_mode_list_lessees *arg = data;
__u32 __user *lessee_ids = (__u32 __user *) (uintptr_t) (arg->lessees_ptr);
__u32 count_lessees = arg->count_lessees;
- struct drm_master *lessor = lessor_priv->master, *lessee;
+ struct drm_master *lessor, *lessee;
int count;
int ret = 0;
@@ -619,6 +654,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
+ lessor = drm_file_get_master(lessor_priv);
DRM_DEBUG_LEASE("List lessees for %d\n", lessor->lessee_id);
mutex_lock(&dev->mode_config.idr_mutex);
@@ -642,6 +678,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
arg->count_lessees = count;
mutex_unlock(&dev->mode_config.idr_mutex);
+ drm_master_put(&lessor);
return ret;
}
@@ -661,7 +698,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
struct drm_mode_get_lease *arg = data;
__u32 __user *object_ids = (__u32 __user *) (uintptr_t) (arg->objects_ptr);
__u32 count_objects = arg->count_objects;
- struct drm_master *lessee = lessee_priv->master;
+ struct drm_master *lessee;
struct idr *object_idr;
int count;
void *entry;
@@ -675,6 +712,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
+ lessee = drm_file_get_master(lessee_priv);
DRM_DEBUG_LEASE("get lease for %d\n", lessee->lessee_id);
mutex_lock(&dev->mode_config.idr_mutex);
@@ -702,6 +740,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
arg->count_objects = count;
mutex_unlock(&dev->mode_config.idr_mutex);
+ drm_master_put(&lessee);
return ret;
}
@@ -720,7 +759,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
void *data, struct drm_file *lessor_priv)
{
struct drm_mode_revoke_lease *arg = data;
- struct drm_master *lessor = lessor_priv->master;
+ struct drm_master *lessor;
struct drm_master *lessee;
int ret = 0;
@@ -730,6 +769,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
+ lessor = drm_file_get_master(lessor_priv);
mutex_lock(&dev->mode_config.idr_mutex);
lessee = _drm_find_lessee(lessor, arg->lessee_id);
@@ -750,6 +790,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
fail:
mutex_unlock(&dev->mode_config.idr_mutex);
+ drm_master_put(&lessor);
return ret;
}
diff --git a/include/drm/drm_auth.h b/include/drm/drm_auth.h
index 6bf8b2b78991..f99d3417f304 100644
--- a/include/drm/drm_auth.h
+++ b/include/drm/drm_auth.h
@@ -107,6 +107,7 @@ struct drm_master {
};
struct drm_master *drm_master_get(struct drm_master *master);
+struct drm_master *drm_file_get_master(struct drm_file *file_priv);
void drm_master_put(struct drm_master **master);
bool drm_is_current_master(struct drm_file *fpriv);
diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h
index b81b3bfb08c8..d5c3e67134d6 100644
--- a/include/drm/drm_file.h
+++ b/include/drm/drm_file.h
@@ -226,9 +226,18 @@ struct drm_file {
/**
* @master:
*
- * Master this node is currently associated with. Only relevant if
- * drm_is_primary_client() returns true. Note that this only
- * matches &drm_device.master if the master is the currently active one.
+ * Master this node is currently associated with. Protected by struct
+ * &drm_device.master_mutex.
+ *
+ * Only relevant if drm_is_primary_client() returns true. Note that
+ * this only matches &drm_device.master if the master is the currently
+ * active one.
+ *
+ * When dereferencing this pointer, either hold struct
+ * &drm_device.master_mutex for the duration of the pointer's use, or
+ * use drm_file_get_master() if struct &drm_device.master_mutex is not
+ * currently held and there is no other need to hold it. This prevents
+ * @master from being freed during use.
*
* See also @authentication and @is_master and the :ref:`section on
* primary nodes and authentication <drm_primary_node>`.
--
2.25.1
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply related [flat|nested] 8+ messages in thread* [Intel-gfx] ✗ Fi.CI.IGT: failure for drm: address potential UAF bugs with drm_master ptrs
2021-06-30 14:54 [Intel-gfx] [PATCH v6 0/4] drm: address potential UAF bugs with drm_master ptrs Desmond Cheong Zhi Xi
` (5 preceding siblings ...)
2021-06-30 18:31 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork
@ 2021-07-01 1:04 ` Patchwork
6 siblings, 0 replies; 8+ messages in thread
From: Patchwork @ 2021-07-01 1:04 UTC (permalink / raw)
To: Desmond Cheong Zhi Xi; +Cc: intel-gfx
[-- Attachment #1.1: Type: text/plain, Size: 30275 bytes --]
== Series Details ==
Series: drm: address potential UAF bugs with drm_master ptrs
URL : https://patchwork.freedesktop.org/series/92076/
State : failure
== Summary ==
CI Bug Log - changes from CI_DRM_10295_full -> Patchwork_20495_full
====================================================
Summary
-------
**FAILURE**
Serious unknown changes coming with Patchwork_20495_full absolutely need to be
verified manually.
If you think the reported changes have nothing to do with the changes
introduced in Patchwork_20495_full, please notify your bug team to allow them
to document this new failure mode, which will reduce false positives in CI.
Possible new issues
-------------------
Here are the unknown changes that may have been introduced in Patchwork_20495_full:
### IGT changes ###
#### Possible regressions ####
* igt@gem_exec_reloc@basic-cpu-wc:
- shard-kbl: [PASS][1] -> [DMESG-WARN][2] +1 similar issue
[1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl3/igt@gem_exec_reloc@basic-cpu-wc.html
[2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl3/igt@gem_exec_reloc@basic-cpu-wc.html
* igt@gem_exec_reloc@basic-write-wc:
- shard-snb: [PASS][3] -> [DMESG-WARN][4] +7 similar issues
[3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-snb2/igt@gem_exec_reloc@basic-write-wc.html
[4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-snb7/igt@gem_exec_reloc@basic-write-wc.html
* igt@kms_frontbuffer_tracking@fbc-1p-primscrn-cur-indfb-draw-blt:
- shard-snb: NOTRUN -> [DMESG-WARN][5] +2 similar issues
[5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-snb2/igt@kms_frontbuffer_tracking@fbc-1p-primscrn-cur-indfb-draw-blt.html
* igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb:
- shard-iclb: [PASS][6] -> [DMESG-WARN][7] +12 similar issues
[6]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-iclb2/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
[7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb7/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
* igt@kms_vblank@pipe-a-wait-busy:
- shard-tglb: [PASS][8] -> [DMESG-WARN][9] +9 similar issues
[8]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-tglb5/igt@kms_vblank@pipe-a-wait-busy.html
[9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb6/igt@kms_vblank@pipe-a-wait-busy.html
#### Warnings ####
* igt@runner@aborted:
- shard-iclb: ([FAIL][10], [FAIL][11]) ([i915#3002]) -> ([FAIL][12], [FAIL][13], [FAIL][14], [FAIL][15], [FAIL][16], [FAIL][17], [FAIL][18], [FAIL][19], [FAIL][20], [FAIL][21], [FAIL][22], [FAIL][23], [FAIL][24], [FAIL][25], [FAIL][26], [FAIL][27], [FAIL][28], [FAIL][29], [FAIL][30], [FAIL][31], [FAIL][32], [FAIL][33], [FAIL][34], [FAIL][35], [FAIL][36]) ([i915#1814] / [i915#2426] / [i915#3690])
[10]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-iclb3/igt@runner@aborted.html
[11]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-iclb2/igt@runner@aborted.html
[12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb1/igt@runner@aborted.html
[13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb4/igt@runner@aborted.html
[14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb6/igt@runner@aborted.html
[15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb4/igt@runner@aborted.html
[16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb7/igt@runner@aborted.html
[17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb7/igt@runner@aborted.html
[18]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb3/igt@runner@aborted.html
[19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb8/igt@runner@aborted.html
[20]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb6/igt@runner@aborted.html
[21]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb4/igt@runner@aborted.html
[22]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb3/igt@runner@aborted.html
[23]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb7/igt@runner@aborted.html
[24]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb3/igt@runner@aborted.html
[25]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb1/igt@runner@aborted.html
[26]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb5/igt@runner@aborted.html
[27]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb3/igt@runner@aborted.html
[28]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb2/igt@runner@aborted.html
[29]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb6/igt@runner@aborted.html
[30]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb6/igt@runner@aborted.html
[31]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb1/igt@runner@aborted.html
[32]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb8/igt@runner@aborted.html
[33]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb2/igt@runner@aborted.html
[34]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb1/igt@runner@aborted.html
[35]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb5/igt@runner@aborted.html
[36]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb5/igt@runner@aborted.html
- shard-tglb: ([FAIL][37], [FAIL][38], [FAIL][39]) ([i915#1814] / [i915#2426] / [i915#3002] / [i915#3690]) -> ([FAIL][40], [FAIL][41], [FAIL][42], [FAIL][43], [FAIL][44], [FAIL][45], [FAIL][46], [FAIL][47], [FAIL][48], [FAIL][49], [FAIL][50], [FAIL][51], [FAIL][52], [FAIL][53], [FAIL][54], [FAIL][55], [FAIL][56], [FAIL][57], [FAIL][58], [FAIL][59], [FAIL][60], [FAIL][61], [FAIL][62], [FAIL][63], [FAIL][64]) ([i915#1436] / [i915#1602] / [i915#1814] / [i915#2426] / [i915#3690] / [i915#402] / [i915#456])
[37]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-tglb1/igt@runner@aborted.html
[38]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-tglb6/igt@runner@aborted.html
[39]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-tglb7/igt@runner@aborted.html
[40]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb3/igt@runner@aborted.html
[41]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb2/igt@runner@aborted.html
[42]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb2/igt@runner@aborted.html
[43]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb2/igt@runner@aborted.html
[44]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb3/igt@runner@aborted.html
[45]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb2/igt@runner@aborted.html
[46]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb2/igt@runner@aborted.html
[47]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb2/igt@runner@aborted.html
[48]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb1/igt@runner@aborted.html
[49]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb3/igt@runner@aborted.html
[50]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb1/igt@runner@aborted.html
[51]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb1/igt@runner@aborted.html
[52]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb1/igt@runner@aborted.html
[53]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb5/igt@runner@aborted.html
[54]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb1/igt@runner@aborted.html
[55]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb5/igt@runner@aborted.html
[56]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb5/igt@runner@aborted.html
[57]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb6/igt@runner@aborted.html
[58]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb6/igt@runner@aborted.html
[59]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb6/igt@runner@aborted.html
[60]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb6/igt@runner@aborted.html
[61]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb7/igt@runner@aborted.html
[62]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb7/igt@runner@aborted.html
[63]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb7/igt@runner@aborted.html
[64]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb7/igt@runner@aborted.html
#### Suppressed ####
The following results come from untrusted machines, tests, or statuses.
They do not affect the overall result.
* igt@gem_exec_reloc@basic-cpu-wc:
- {shard-rkl}: [PASS][65] -> [DMESG-WARN][66] +1 similar issue
[65]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-rkl-6/igt@gem_exec_reloc@basic-cpu-wc.html
[66]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@gem_exec_reloc@basic-cpu-wc.html
* igt@kms_addfb_basic@clobberred-modifier:
- {shard-rkl}: NOTRUN -> [DMESG-WARN][67]
[67]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-5/igt@kms_addfb_basic@clobberred-modifier.html
* igt@kms_ccs@pipe-c-crc-sprite-planes-basic-y_tiled_gen12_rc_ccs_cc:
- {shard-rkl}: [FAIL][68] -> [DMESG-WARN][69]
[68]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-rkl-2/igt@kms_ccs@pipe-c-crc-sprite-planes-basic-y_tiled_gen12_rc_ccs_cc.html
[69]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-6/igt@kms_ccs@pipe-c-crc-sprite-planes-basic-y_tiled_gen12_rc_ccs_cc.html
* igt@kms_cursor_crc@pipe-a-cursor-128x128-onscreen:
- {shard-rkl}: [SKIP][70] -> [DMESG-WARN][71]
[70]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-rkl-5/igt@kms_cursor_crc@pipe-a-cursor-128x128-onscreen.html
[71]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-6/igt@kms_cursor_crc@pipe-a-cursor-128x128-onscreen.html
* igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-cur-indfb-draw-mmap-wc:
- {shard-rkl}: [SKIP][72] ([i915#1849]) -> [SKIP][73]
[72]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-rkl-5/igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-cur-indfb-draw-mmap-wc.html
[73]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@kms_frontbuffer_tracking@fbcpsr-1p-primscrn-cur-indfb-draw-mmap-wc.html
* igt@kms_frontbuffer_tracking@fbcpsr-2p-primscrn-spr-indfb-draw-mmap-cpu:
- {shard-rkl}: [SKIP][74] ([fdo#111825] / [i915#1825]) -> [SKIP][75]
[74]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-rkl-6/igt@kms_frontbuffer_tracking@fbcpsr-2p-primscrn-spr-indfb-draw-mmap-cpu.html
[75]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@kms_frontbuffer_tracking@fbcpsr-2p-primscrn-spr-indfb-draw-mmap-cpu.html
* igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb:
- {shard-rkl}: [PASS][76] -> [SKIP][77]
[76]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-rkl-6/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
[77]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
* igt@runner@aborted:
- {shard-rkl}: ([FAIL][78], [FAIL][79]) ([i915#3002]) -> ([FAIL][80], [FAIL][81], [FAIL][82], [FAIL][83], [FAIL][84], [FAIL][85], [FAIL][86], [FAIL][87], [FAIL][88], [FAIL][89], [FAIL][90], [FAIL][91], [FAIL][92], [FAIL][93], [FAIL][94], [FAIL][95], [FAIL][96], [FAIL][97], [FAIL][98], [FAIL][99], [FAIL][100], [FAIL][101], [FAIL][102], [FAIL][103], [FAIL][104]) ([i915#1602])
[78]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-rkl-5/igt@runner@aborted.html
[79]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-rkl-1/igt@runner@aborted.html
[80]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-6/igt@runner@aborted.html
[81]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-6/igt@runner@aborted.html
[82]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-6/igt@runner@aborted.html
[83]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-6/igt@runner@aborted.html
[84]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-6/igt@runner@aborted.html
[85]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-5/igt@runner@aborted.html
[86]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-5/igt@runner@aborted.html
[87]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-5/igt@runner@aborted.html
[88]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-5/igt@runner@aborted.html
[89]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-5/igt@runner@aborted.html
[90]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-5/igt@runner@aborted.html
[91]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-5/igt@runner@aborted.html
[92]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-2/igt@runner@aborted.html
[93]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-2/igt@runner@aborted.html
[94]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-2/igt@runner@aborted.html
[95]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-2/igt@runner@aborted.html
[96]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-2/igt@runner@aborted.html
[97]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-2/igt@runner@aborted.html
[98]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@runner@aborted.html
[99]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@runner@aborted.html
[100]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@runner@aborted.html
[101]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@runner@aborted.html
[102]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@runner@aborted.html
[103]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@runner@aborted.html
[104]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-rkl-1/igt@runner@aborted.html
Known issues
------------
Here are the changes found in Patchwork_20495_full that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@gem_ctx_persistence@engines-queued:
- shard-snb: NOTRUN -> [SKIP][105] ([fdo#109271] / [i915#1099])
[105]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-snb7/igt@gem_ctx_persistence@engines-queued.html
* igt@gem_eio@in-flight-suspend:
- shard-skl: [PASS][106] -> [DMESG-WARN][107] ([i915#1610]) +7 similar issues
[106]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-skl7/igt@gem_eio@in-flight-suspend.html
[107]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-skl1/igt@gem_eio@in-flight-suspend.html
* igt@kms_addfb_basic@clobberred-modifier:
- shard-glk: NOTRUN -> [DMESG-WARN][108] ([i915#1610])
[108]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-glk2/igt@kms_addfb_basic@clobberred-modifier.html
* igt@kms_big_fb@yf-tiled-max-hw-stride-32bpp-rotate-0-async-flip:
- shard-apl: [PASS][109] -> [DMESG-WARN][110] ([i915#1610]) +5 similar issues
[109]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-apl1/igt@kms_big_fb@yf-tiled-max-hw-stride-32bpp-rotate-0-async-flip.html
[110]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl3/igt@kms_big_fb@yf-tiled-max-hw-stride-32bpp-rotate-0-async-flip.html
* igt@kms_color@pipe-b-gamma:
- shard-iclb: [PASS][111] -> [DMESG-WARN][112] ([i915#1149])
[111]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-iclb2/igt@kms_color@pipe-b-gamma.html
[112]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-iclb6/igt@kms_color@pipe-b-gamma.html
- shard-apl: NOTRUN -> [DMESG-WARN][113] ([i915#1610]) +3 similar issues
[113]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl6/igt@kms_color@pipe-b-gamma.html
- shard-tglb: [PASS][114] -> [DMESG-WARN][115] ([i915#1149])
[114]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-tglb2/igt@kms_color@pipe-b-gamma.html
[115]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb1/igt@kms_color@pipe-b-gamma.html
* igt@kms_cursor_legacy@cursorb-vs-flipa-legacy:
- shard-apl: NOTRUN -> [SKIP][116] ([fdo#109271]) +2 similar issues
[116]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl7/igt@kms_cursor_legacy@cursorb-vs-flipa-legacy.html
* igt@kms_frontbuffer_tracking@fbcpsr-2p-primscrn-spr-indfb-draw-mmap-cpu:
- shard-snb: NOTRUN -> [SKIP][117] ([fdo#109271]) +4 similar issues
[117]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-snb7/igt@kms_frontbuffer_tracking@fbcpsr-2p-primscrn-spr-indfb-draw-mmap-cpu.html
* igt@kms_plane_cursor@pipe-a-primary-size-256:
- shard-kbl: [PASS][118] -> [DMESG-WARN][119] ([i915#1610]) +8 similar issues
[118]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl2/igt@kms_plane_cursor@pipe-a-primary-size-256.html
[119]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl7/igt@kms_plane_cursor@pipe-a-primary-size-256.html
- shard-skl: NOTRUN -> [DMESG-WARN][120] ([i915#1610])
[120]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-skl7/igt@kms_plane_cursor@pipe-a-primary-size-256.html
* igt@kms_plane_cursor@pipe-a-primary-size-64:
- shard-glk: [PASS][121] -> [DMESG-WARN][122] ([i915#1610]) +11 similar issues
[121]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-glk3/igt@kms_plane_cursor@pipe-a-primary-size-64.html
[122]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-glk9/igt@kms_plane_cursor@pipe-a-primary-size-64.html
* igt@kms_psr2_su@page_flip:
- shard-apl: NOTRUN -> [SKIP][123] ([fdo#109271] / [i915#658])
[123]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl3/igt@kms_psr2_su@page_flip.html
* igt@kms_vblank@pipe-a-ts-continuation-suspend:
- shard-kbl: [PASS][124] -> [DMESG-WARN][125] ([i915#1610] / [i915#295])
[124]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl1/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
[125]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl4/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
- shard-tglb: [PASS][126] -> [DMESG-WARN][127] ([i915#2411]) +1 similar issue
[126]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-tglb6/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
[127]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-tglb7/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
- shard-glk: [PASS][128] -> [DMESG-WARN][129] ([i915#1610] / [i915#295])
[128]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-glk9/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
[129]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-glk7/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
- shard-skl: [PASS][130] -> [DMESG-WARN][131] ([i915#1610] / [i915#295])
[130]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-skl10/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
[131]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-skl1/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
#### Warnings ####
* igt@kms_big_fb@yf-tiled-max-hw-stride-32bpp-rotate-0-async-flip:
- shard-skl: [FAIL][132] -> [DMESG-FAIL][133] ([i915#1610])
[132]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-skl10/igt@kms_big_fb@yf-tiled-max-hw-stride-32bpp-rotate-0-async-flip.html
[133]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-skl1/igt@kms_big_fb@yf-tiled-max-hw-stride-32bpp-rotate-0-async-flip.html
* igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb:
- shard-skl: [FAIL][134] ([i915#265]) -> [DMESG-FAIL][135] ([i915#1610] / [i915#265])
[134]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-skl4/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
[135]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-skl6/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
- shard-apl: [FAIL][136] ([i915#265]) -> [DMESG-FAIL][137] ([i915#1610] / [i915#265])
[136]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-apl7/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
[137]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl6/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
- shard-glk: [FAIL][138] ([i915#265]) -> [DMESG-FAIL][139] ([i915#1610] / [i915#265])
[138]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-glk9/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
[139]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-glk1/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
- shard-kbl: [FAIL][140] ([i915#265]) -> [DMESG-FAIL][141] ([i915#1610] / [i915#265])
[140]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl1/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
[141]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl2/igt@kms_plane_alpha_blend@pipe-a-alpha-transparent-fb.html
* igt@kms_vblank@pipe-a-ts-continuation-suspend:
- shard-apl: [DMESG-WARN][142] ([i915#180] / [i915#295]) -> [DMESG-WARN][143] ([i915#1610] / [i915#295])
[142]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-apl6/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
[143]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl3/igt@kms_vblank@pipe-a-ts-continuation-suspend.html
* igt@runner@aborted:
- shard-kbl: ([FAIL][144], [FAIL][145], [FAIL][146], [FAIL][147], [FAIL][148], [FAIL][149], [FAIL][150], [FAIL][151], [FAIL][152], [FAIL][153], [FAIL][154], [FAIL][155], [FAIL][156]) ([i915#1436] / [i915#180] / [i915#1814] / [i915#3002] / [i915#3363] / [i915#602] / [i915#92]) -> ([FAIL][157], [FAIL][158], [FAIL][159], [FAIL][160], [FAIL][161], [FAIL][162], [FAIL][163], [FAIL][164], [FAIL][165], [FAIL][166], [FAIL][167], [FAIL][168], [FAIL][169], [FAIL][170], [FAIL][171], [FAIL][172], [FAIL][173], [FAIL][174], [FAIL][175], [FAIL][176], [FAIL][177], [FAIL][178], [FAIL][179], [FAIL][180], [FAIL][181]) ([fdo#109271] / [i915#1436] / [i915#1814] / [i915#2426] / [i915#2505] / [i915#3363] / [i915#602])
[144]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl2/igt@runner@aborted.html
[145]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl3/igt@runner@aborted.html
[146]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl2/igt@runner@aborted.html
[147]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl7/igt@runner@aborted.html
[148]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl7/igt@runner@aborted.html
[149]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl4/igt@runner@aborted.html
[150]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl7/igt@runner@aborted.html
[151]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl4/igt@runner@aborted.html
[152]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl2/igt@runner@aborted.html
[153]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl1/igt@runner@aborted.html
[154]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl3/igt@runner@aborted.html
[155]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl2/igt@runner@aborted.html
[156]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-kbl7/igt@runner@aborted.html
[157]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl7/igt@runner@aborted.html
[158]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl7/igt@runner@aborted.html
[159]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl7/igt@runner@aborted.html
[160]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl7/igt@runner@aborted.html
[161]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl7/igt@runner@aborted.html
[162]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl6/igt@runner@aborted.html
[163]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl6/igt@runner@aborted.html
[164]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl6/igt@runner@aborted.html
[165]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl6/igt@runner@aborted.html
[166]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl4/igt@runner@aborted.html
[167]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl2/igt@runner@aborted.html
[168]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl4/igt@runner@aborted.html
[169]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl1/igt@runner@aborted.html
[170]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl2/igt@runner@aborted.html
[171]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl3/igt@runner@aborted.html
[172]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl4/igt@runner@aborted.html
[173]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl6/igt@runner@aborted.html
[174]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl3/igt@runner@aborted.html
[175]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl3/igt@runner@aborted.html
[176]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl1/igt@runner@aborted.html
[177]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl2/igt@runner@aborted.html
[178]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl3/igt@runner@aborted.html
[179]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl4/igt@runner@aborted.html
[180]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl4/igt@runner@aborted.html
[181]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-kbl2/igt@runner@aborted.html
- shard-apl: ([FAIL][182], [FAIL][183], [FAIL][184], [FAIL][185]) ([fdo#109271] / [i915#180] / [i915#1814] / [i915#3363]) -> ([FAIL][186], [FAIL][187], [FAIL][188], [FAIL][189], [FAIL][190], [FAIL][191], [FAIL][192], [FAIL][193], [FAIL][194], [FAIL][195], [FAIL][196], [FAIL][197], [FAIL][198], [FAIL][199], [FAIL][200], [FAIL][201], [FAIL][202], [FAIL][203], [FAIL][204], [FAIL][205], [FAIL][206], [FAIL][207]) ([fdo#109271] / [i915#1610] / [i915#1814] / [i915#2426] / [i915#3363])
[182]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-apl6/igt@runner@aborted.html
[183]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-apl6/igt@runner@aborted.html
[184]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-apl8/igt@runner@aborted.html
[185]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_10295/shard-apl3/igt@runner@aborted.html
[186]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl1/igt@runner@aborted.html
[187]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl6/igt@runner@aborted.html
[188]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl3/igt@runner@aborted.html
[189]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl2/igt@runner@aborted.html
[190]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl6/igt@runner@aborted.html
[191]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl8/igt@runner@aborted.html
[192]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl8/igt@runner@aborted.html
[193]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl6/igt@runner@aborted.html
[194]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl7/igt@runner@aborted.html
[195]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl1/igt@runner@aborted.html
[196]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl3/igt@runner@aborted.html
[197]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl7/igt@runner@aborted.html
[198]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl1/igt@runner@aborted.html
[199]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl6/igt@runner@aborted.html
[200]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl8/igt@runner@aborted.html
[201]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl2/igt@runner@aborted.html
[202]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/shard-apl1/igt@runner@aborted.html
[203]: h
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_20495/index.html
[-- Attachment #1.2: Type: text/html, Size: 31835 bytes --]
[-- Attachment #2: Type: text/plain, Size: 160 bytes --]
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
^ permalink raw reply [flat|nested] 8+ messages in thread