* [Intel-gfx] [PATCH] drm/i915: Fix potential bit_17 double-free
@ 2023-01-27 20:05 Rob Clark
2023-01-27 21:02 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Rob Clark @ 2023-01-27 20:05 UTC (permalink / raw)
To: dri-devel
Cc: Rob Clark, intel-gfx, Lucas De Marchi, open list, Chris Wilson,
pengfuyuan, Daniel Vetter, Rodrigo Vivi, David Airlie
From: Rob Clark <robdclark@chromium.org>
A userspace with multiple threads racing I915_GEM_SET_TILING to set the
tiling to I915_TILING_NONE could trigger a double free of the bit_17
bitmask. (Or conversely leak memory on the transition to tiled.) Move
allocation/free'ing of the bitmask within the section protected by the
obj lock.
Fixes: e9b73c67390a ("drm/i915: Reduce memory pressure during shrinker by preallocating swizzle pages")
Signed-off-by: Rob Clark <robdclark@chromium.org>
---
drivers/gpu/drm/i915/gem/i915_gem_tiling.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_tiling.c b/drivers/gpu/drm/i915/gem/i915_gem_tiling.c
index fd42b89b7162..bc21b1c2350a 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_tiling.c
@@ -298,36 +298,37 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj,
vma->fence_alignment =
i915_gem_fence_alignment(i915,
vma->size, tiling, stride);
if (vma->fence)
vma->fence->dirty = true;
}
spin_unlock(&obj->vma.lock);
obj->tiling_and_stride = tiling | stride;
- i915_gem_object_unlock(obj);
-
- /* Force the fence to be reacquired for GTT access */
- i915_gem_object_release_mmap_gtt(obj);
/* Try to preallocate memory required to save swizzling on put-pages */
if (i915_gem_object_needs_bit17_swizzle(obj)) {
if (!obj->bit_17) {
obj->bit_17 = bitmap_zalloc(obj->base.size >> PAGE_SHIFT,
GFP_KERNEL);
}
} else {
bitmap_free(obj->bit_17);
obj->bit_17 = NULL;
}
+ i915_gem_object_unlock(obj);
+
+ /* Force the fence to be reacquired for GTT access */
+ i915_gem_object_release_mmap_gtt(obj);
+
return 0;
}
/**
* i915_gem_set_tiling_ioctl - IOCTL handler to set tiling mode
* @dev: DRM device
* @data: data pointer for the ioctl
* @file: DRM file for the ioctl call
*
* Sets the tiling mode of an object, returning the required swizzling of
--
2.38.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [Intel-gfx] ✓ Fi.CI.BAT: success for drm/i915: Fix potential bit_17 double-free
2023-01-27 20:05 [Intel-gfx] [PATCH] drm/i915: Fix potential bit_17 double-free Rob Clark
@ 2023-01-27 21:02 ` Patchwork
2023-01-28 0:58 ` [Intel-gfx] ✓ Fi.CI.IGT: " Patchwork
2023-01-30 10:08 ` [Intel-gfx] [PATCH] " Tvrtko Ursulin
2 siblings, 0 replies; 4+ messages in thread
From: Patchwork @ 2023-01-27 21:02 UTC (permalink / raw)
To: Rob Clark; +Cc: intel-gfx
[-- Attachment #1: Type: text/plain, Size: 5032 bytes --]
== Series Details ==
Series: drm/i915: Fix potential bit_17 double-free
URL : https://patchwork.freedesktop.org/series/113447/
State : success
== Summary ==
CI Bug Log - changes from CI_DRM_12656 -> Patchwork_113447v1
====================================================
Summary
-------
**SUCCESS**
No regressions found.
External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/index.html
Participating hosts (25 -> 25)
------------------------------
Additional (1): fi-kbl-soraka
Missing (1): fi-snb-2520m
Possible new issues
-------------------
Here are the unknown changes that may have been introduced in Patchwork_113447v1:
### IGT changes ###
#### Suppressed ####
The following results come from untrusted machines, tests, or statuses.
They do not affect the overall result.
* igt@i915_pm_rpm@basic-rte:
- {bat-adln-1}: [PASS][1] -> [ABORT][2]
[1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/bat-adln-1/igt@i915_pm_rpm@basic-rte.html
[2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/bat-adln-1/igt@i915_pm_rpm@basic-rte.html
Known issues
------------
Here are the changes found in Patchwork_113447v1 that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@gem_huc_copy@huc-copy:
- fi-kbl-soraka: NOTRUN -> [SKIP][3] ([fdo#109271] / [i915#2190])
[3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/fi-kbl-soraka/igt@gem_huc_copy@huc-copy.html
* igt@gem_lmem_swapping@basic:
- fi-kbl-soraka: NOTRUN -> [SKIP][4] ([fdo#109271] / [i915#4613]) +3 similar issues
[4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/fi-kbl-soraka/igt@gem_lmem_swapping@basic.html
* igt@i915_selftest@live@dmabuf:
- fi-bsw-nick: [PASS][5] -> [DMESG-FAIL][6] ([i915#7562])
[5]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/fi-bsw-nick/igt@i915_selftest@live@dmabuf.html
[6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/fi-bsw-nick/igt@i915_selftest@live@dmabuf.html
* igt@i915_selftest@live@execlists:
- fi-kbl-soraka: NOTRUN -> [INCOMPLETE][7] ([i915#7156])
[7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/fi-kbl-soraka/igt@i915_selftest@live@execlists.html
* igt@i915_selftest@live@gt_pm:
- fi-kbl-soraka: NOTRUN -> [DMESG-FAIL][8] ([i915#1886])
[8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/fi-kbl-soraka/igt@i915_selftest@live@gt_pm.html
* igt@kms_chamelium_frames@hdmi-crc-fast:
- fi-kbl-soraka: NOTRUN -> [SKIP][9] ([fdo#109271]) +15 similar issues
[9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/fi-kbl-soraka/igt@kms_chamelium_frames@hdmi-crc-fast.html
#### Possible fixes ####
* igt@i915_selftest@live@guc:
- {bat-rpls-2}: [DMESG-WARN][10] ([i915#7852]) -> [PASS][11]
[10]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/bat-rpls-2/igt@i915_selftest@live@guc.html
[11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/bat-rpls-2/igt@i915_selftest@live@guc.html
* igt@i915_suspend@basic-s3-without-i915:
- {bat-adlm-1}: [ABORT][12] -> [PASS][13]
[12]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/bat-adlm-1/igt@i915_suspend@basic-s3-without-i915.html
[13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/bat-adlm-1/igt@i915_suspend@basic-s3-without-i915.html
{name}: This element is suppressed. This means it is ignored when computing
the status of the difference (SUCCESS, WARNING, or FAILURE).
[fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271
[i915#1845]: https://gitlab.freedesktop.org/drm/intel/issues/1845
[i915#1886]: https://gitlab.freedesktop.org/drm/intel/issues/1886
[i915#2190]: https://gitlab.freedesktop.org/drm/intel/issues/2190
[i915#3546]: https://gitlab.freedesktop.org/drm/intel/issues/3546
[i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613
[i915#4983]: https://gitlab.freedesktop.org/drm/intel/issues/4983
[i915#7156]: https://gitlab.freedesktop.org/drm/intel/issues/7156
[i915#7562]: https://gitlab.freedesktop.org/drm/intel/issues/7562
[i915#7677]: https://gitlab.freedesktop.org/drm/intel/issues/7677
[i915#7828]: https://gitlab.freedesktop.org/drm/intel/issues/7828
[i915#7852]: https://gitlab.freedesktop.org/drm/intel/issues/7852
Build changes
-------------
* Linux: CI_DRM_12656 -> Patchwork_113447v1
CI-20190529: 20190529
CI_DRM_12656: 5a9d8eeec978f2373afe9e049eaa42f67b42074a @ git://anongit.freedesktop.org/gfx-ci/linux
IGT_7140: ec87a6a636b9337ac9c8fec57350812bcb48fc09 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git
Patchwork_113447v1: 5a9d8eeec978f2373afe9e049eaa42f67b42074a @ git://anongit.freedesktop.org/gfx-ci/linux
### Linux commits
b24f26e3eebf drm/i915: Fix potential bit_17 double-free
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/index.html
[-- Attachment #2: Type: text/html, Size: 5669 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* [Intel-gfx] ✓ Fi.CI.IGT: success for drm/i915: Fix potential bit_17 double-free
2023-01-27 20:05 [Intel-gfx] [PATCH] drm/i915: Fix potential bit_17 double-free Rob Clark
2023-01-27 21:02 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork
@ 2023-01-28 0:58 ` Patchwork
2023-01-30 10:08 ` [Intel-gfx] [PATCH] " Tvrtko Ursulin
2 siblings, 0 replies; 4+ messages in thread
From: Patchwork @ 2023-01-28 0:58 UTC (permalink / raw)
To: Rob Clark; +Cc: intel-gfx
[-- Attachment #1: Type: text/plain, Size: 18652 bytes --]
== Series Details ==
Series: drm/i915: Fix potential bit_17 double-free
URL : https://patchwork.freedesktop.org/series/113447/
State : success
== Summary ==
CI Bug Log - changes from CI_DRM_12656_full -> Patchwork_113447v1_full
====================================================
Summary
-------
**SUCCESS**
No regressions found.
External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/index.html
Participating hosts (10 -> 10)
------------------------------
No changes in participating hosts
Possible new issues
-------------------
Here are the unknown changes that may have been introduced in Patchwork_113447v1_full:
### IGT changes ###
#### Suppressed ####
The following results come from untrusted machines, tests, or statuses.
They do not affect the overall result.
* igt@gem_ccs@suspend-resume:
- {shard-rkl}: [SKIP][1] ([i915#5325]) -> [SKIP][2]
[1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-rkl-4/igt@gem_ccs@suspend-resume.html
[2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-rkl-5/igt@gem_ccs@suspend-resume.html
Known issues
------------
Here are the changes found in Patchwork_113447v1_full that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@gem_exec_fair@basic-none-solo@rcs0:
- shard-glk: [PASS][3] -> [FAIL][4] ([i915#2842])
[3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-glk5/igt@gem_exec_fair@basic-none-solo@rcs0.html
[4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-glk8/igt@gem_exec_fair@basic-none-solo@rcs0.html
* igt@gem_sync@basic-all:
- shard-glk: [PASS][5] -> [DMESG-WARN][6] ([i915#118])
[5]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-glk7/igt@gem_sync@basic-all.html
[6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-glk2/igt@gem_sync@basic-all.html
* igt@kms_flip@flip-vs-expired-vblank@b-hdmi-a1:
- shard-glk: [PASS][7] -> [FAIL][8] ([i915#79])
[7]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-glk9/igt@kms_flip@flip-vs-expired-vblank@b-hdmi-a1.html
[8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-glk4/igt@kms_flip@flip-vs-expired-vblank@b-hdmi-a1.html
#### Possible fixes ####
* igt@drm_fdinfo@virtual-idle:
- {shard-rkl}: [FAIL][9] ([i915#7742]) -> [PASS][10]
[9]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-rkl-2/igt@drm_fdinfo@virtual-idle.html
[10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-rkl-4/igt@drm_fdinfo@virtual-idle.html
* igt@gem_ctx_exec@basic-nohangcheck:
- {shard-tglu}: [FAIL][11] ([i915#6268]) -> [PASS][12]
[11]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-tglu-2/igt@gem_ctx_exec@basic-nohangcheck.html
[12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-tglu-5/igt@gem_ctx_exec@basic-nohangcheck.html
* igt@gem_exec_balancer@fairslice:
- {shard-rkl}: [SKIP][13] ([i915#6259]) -> [PASS][14]
[13]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-rkl-5/igt@gem_exec_balancer@fairslice.html
[14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-rkl-3/igt@gem_exec_balancer@fairslice.html
* igt@gem_exec_fair@basic-none@vcs0:
- {shard-rkl}: [FAIL][15] ([i915#2842]) -> [PASS][16] +3 similar issues
[15]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-rkl-1/igt@gem_exec_fair@basic-none@vcs0.html
[16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-rkl-5/igt@gem_exec_fair@basic-none@vcs0.html
- shard-glk: [FAIL][17] ([i915#2842]) -> [PASS][18]
[17]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-glk2/igt@gem_exec_fair@basic-none@vcs0.html
[18]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-glk2/igt@gem_exec_fair@basic-none@vcs0.html
* igt@gem_exec_reloc@basic-wc-read-noreloc:
- {shard-rkl}: [SKIP][19] ([i915#3281]) -> [PASS][20] +7 similar issues
[19]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-rkl-4/igt@gem_exec_reloc@basic-wc-read-noreloc.html
[20]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-rkl-5/igt@gem_exec_reloc@basic-wc-read-noreloc.html
* igt@gem_pread@bench:
- {shard-rkl}: [SKIP][21] ([i915#3282]) -> [PASS][22] +5 similar issues
[21]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-rkl-4/igt@gem_pread@bench.html
[22]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-rkl-5/igt@gem_pread@bench.html
* igt@gen9_exec_parse@valid-registers:
- {shard-rkl}: [SKIP][23] ([i915#2527]) -> [PASS][24]
[23]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-rkl-3/igt@gen9_exec_parse@valid-registers.html
[24]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-rkl-5/igt@gen9_exec_parse@valid-registers.html
* igt@i915_pm_rpm@cursor-dpms:
- {shard-rkl}: [SKIP][25] ([i915#1849]) -> [PASS][26]
[25]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-rkl-3/igt@i915_pm_rpm@cursor-dpms.html
[26]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-rkl-6/igt@i915_pm_rpm@cursor-dpms.html
* igt@i915_pm_rpm@modeset-non-lpsp:
- {shard-dg1}: [SKIP][27] ([i915#1397]) -> [PASS][28] +1 similar issue
[27]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-dg1-14/igt@i915_pm_rpm@modeset-non-lpsp.html
[28]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-dg1-15/igt@i915_pm_rpm@modeset-non-lpsp.html
* igt@kms_big_fb@x-tiled-32bpp-rotate-0:
- {shard-rkl}: [SKIP][29] ([i915#1845] / [i915#4098]) -> [PASS][30] +19 similar issues
[29]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-rkl-3/igt@kms_big_fb@x-tiled-32bpp-rotate-0.html
[30]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-rkl-6/igt@kms_big_fb@x-tiled-32bpp-rotate-0.html
* igt@kms_frontbuffer_tracking@fbc-badstride:
- {shard-rkl}: [SKIP][31] ([i915#1849] / [i915#4098]) -> [PASS][32] +13 similar issues
[31]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-rkl-2/igt@kms_frontbuffer_tracking@fbc-badstride.html
[32]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-rkl-6/igt@kms_frontbuffer_tracking@fbc-badstride.html
* igt@kms_psr@sprite_plane_onoff:
- {shard-rkl}: [SKIP][33] ([i915#1072]) -> [PASS][34] +1 similar issue
[33]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-rkl-3/igt@kms_psr@sprite_plane_onoff.html
[34]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-rkl-6/igt@kms_psr@sprite_plane_onoff.html
* igt@kms_psr_stress_test@invalidate-primary-flip-overlay:
- {shard-rkl}: [SKIP][35] ([i915#5461]) -> [PASS][36]
[35]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-rkl-3/igt@kms_psr_stress_test@invalidate-primary-flip-overlay.html
[36]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-rkl-6/igt@kms_psr_stress_test@invalidate-primary-flip-overlay.html
* igt@kms_universal_plane@universal-plane-pageflip-windowed-pipe-b:
- {shard-rkl}: [SKIP][37] ([i915#4098]) -> [PASS][38]
[37]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-rkl-3/igt@kms_universal_plane@universal-plane-pageflip-windowed-pipe-b.html
[38]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-rkl-6/igt@kms_universal_plane@universal-plane-pageflip-windowed-pipe-b.html
* igt@perf_pmu@idle@rcs0:
- {shard-rkl}: [FAIL][39] ([i915#4349]) -> [PASS][40]
[39]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-rkl-4/igt@perf_pmu@idle@rcs0.html
[40]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-rkl-3/igt@perf_pmu@idle@rcs0.html
* igt@prime_vgem@coherency-gtt:
- {shard-rkl}: [SKIP][41] ([fdo#109295] / [fdo#111656] / [i915#3708]) -> [PASS][42]
[41]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12656/shard-rkl-3/igt@prime_vgem@coherency-gtt.html
[42]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/shard-rkl-5/igt@prime_vgem@coherency-gtt.html
{name}: This element is suppressed. This means it is ignored when computing
the status of the difference (SUCCESS, WARNING, or FAILURE).
[fdo#109274]: https://bugs.freedesktop.org/show_bug.cgi?id=109274
[fdo#109280]: https://bugs.freedesktop.org/show_bug.cgi?id=109280
[fdo#109283]: https://bugs.freedesktop.org/show_bug.cgi?id=109283
[fdo#109289]: https://bugs.freedesktop.org/show_bug.cgi?id=109289
[fdo#109295]: https://bugs.freedesktop.org/show_bug.cgi?id=109295
[fdo#109302]: https://bugs.freedesktop.org/show_bug.cgi?id=109302
[fdo#109303]: https://bugs.freedesktop.org/show_bug.cgi?id=109303
[fdo#109312]: https://bugs.freedesktop.org/show_bug.cgi?id=109312
[fdo#109314]: https://bugs.freedesktop.org/show_bug.cgi?id=109314
[fdo#109315]: https://bugs.freedesktop.org/show_bug.cgi?id=109315
[fdo#109506]: https://bugs.freedesktop.org/show_bug.cgi?id=109506
[fdo#109642]: https://bugs.freedesktop.org/show_bug.cgi?id=109642
[fdo#110189]: https://bugs.freedesktop.org/show_bug.cgi?id=110189
[fdo#110723]: https://bugs.freedesktop.org/show_bug.cgi?id=110723
[fdo#111068]: https://bugs.freedesktop.org/show_bug.cgi?id=111068
[fdo#111614]: https://bugs.freedesktop.org/show_bug.cgi?id=111614
[fdo#111615]: https://bugs.freedesktop.org/show_bug.cgi?id=111615
[fdo#111644]: https://bugs.freedesktop.org/show_bug.cgi?id=111644
[fdo#111656]: https://bugs.freedesktop.org/show_bug.cgi?id=111656
[fdo#111825]: https://bugs.freedesktop.org/show_bug.cgi?id=111825
[fdo#111827]: https://bugs.freedesktop.org/show_bug.cgi?id=111827
[fdo#112054]: https://bugs.freedesktop.org/show_bug.cgi?id=112054
[fdo#112283]: https://bugs.freedesktop.org/show_bug.cgi?id=112283
[i915#1072]: https://gitlab.freedesktop.org/drm/intel/issues/1072
[i915#118]: https://gitlab.freedesktop.org/drm/intel/issues/118
[i915#132]: https://gitlab.freedesktop.org/drm/intel/issues/132
[i915#1397]: https://gitlab.freedesktop.org/drm/intel/issues/1397
[i915#1755]: https://gitlab.freedesktop.org/drm/intel/issues/1755
[i915#1825]: https://gitlab.freedesktop.org/drm/intel/issues/1825
[i915#1839]: https://gitlab.freedesktop.org/drm/intel/issues/1839
[i915#1845]: https://gitlab.freedesktop.org/drm/intel/issues/1845
[i915#1849]: https://gitlab.freedesktop.org/drm/intel/issues/1849
[i915#1850]: https://gitlab.freedesktop.org/drm/intel/issues/1850
[i915#1902]: https://gitlab.freedesktop.org/drm/intel/issues/1902
[i915#2434]: https://gitlab.freedesktop.org/drm/intel/issues/2434
[i915#2437]: https://gitlab.freedesktop.org/drm/intel/issues/2437
[i915#2527]: https://gitlab.freedesktop.org/drm/intel/issues/2527
[i915#2575]: https://gitlab.freedesktop.org/drm/intel/issues/2575
[i915#2587]: https://gitlab.freedesktop.org/drm/intel/issues/2587
[i915#2672]: https://gitlab.freedesktop.org/drm/intel/issues/2672
[i915#2705]: https://gitlab.freedesktop.org/drm/intel/issues/2705
[i915#280]: https://gitlab.freedesktop.org/drm/intel/issues/280
[i915#2842]: https://gitlab.freedesktop.org/drm/intel/issues/2842
[i915#2856]: https://gitlab.freedesktop.org/drm/intel/issues/2856
[i915#2920]: https://gitlab.freedesktop.org/drm/intel/issues/2920
[i915#3116]: https://gitlab.freedesktop.org/drm/intel/issues/3116
[i915#3281]: https://gitlab.freedesktop.org/drm/intel/issues/3281
[i915#3282]: https://gitlab.freedesktop.org/drm/intel/issues/3282
[i915#3297]: https://gitlab.freedesktop.org/drm/intel/issues/3297
[i915#3299]: https://gitlab.freedesktop.org/drm/intel/issues/3299
[i915#3318]: https://gitlab.freedesktop.org/drm/intel/issues/3318
[i915#3359]: https://gitlab.freedesktop.org/drm/intel/issues/3359
[i915#3361]: https://gitlab.freedesktop.org/drm/intel/issues/3361
[i915#3458]: https://gitlab.freedesktop.org/drm/intel/issues/3458
[i915#3469]: https://gitlab.freedesktop.org/drm/intel/issues/3469
[i915#3528]: https://gitlab.freedesktop.org/drm/intel/issues/3528
[i915#3539]: https://gitlab.freedesktop.org/drm/intel/issues/3539
[i915#3546]: https://gitlab.freedesktop.org/drm/intel/issues/3546
[i915#3555]: https://gitlab.freedesktop.org/drm/intel/issues/3555
[i915#3637]: https://gitlab.freedesktop.org/drm/intel/issues/3637
[i915#3638]: https://gitlab.freedesktop.org/drm/intel/issues/3638
[i915#3689]: https://gitlab.freedesktop.org/drm/intel/issues/3689
[i915#3708]: https://gitlab.freedesktop.org/drm/intel/issues/3708
[i915#3734]: https://gitlab.freedesktop.org/drm/intel/issues/3734
[i915#3742]: https://gitlab.freedesktop.org/drm/intel/issues/3742
[i915#3886]: https://gitlab.freedesktop.org/drm/intel/issues/3886
[i915#3952]: https://gitlab.freedesktop.org/drm/intel/issues/3952
[i915#4036]: https://gitlab.freedesktop.org/drm/intel/issues/4036
[i915#4070]: https://gitlab.freedesktop.org/drm/intel/issues/4070
[i915#4077]: https://gitlab.freedesktop.org/drm/intel/issues/4077
[i915#4079]: https://gitlab.freedesktop.org/drm/intel/issues/4079
[i915#4083]: https://gitlab.freedesktop.org/drm/intel/issues/4083
[i915#4098]: https://gitlab.freedesktop.org/drm/intel/issues/4098
[i915#4103]: https://gitlab.freedesktop.org/drm/intel/issues/4103
[i915#4212]: https://gitlab.freedesktop.org/drm/intel/issues/4212
[i915#426]: https://gitlab.freedesktop.org/drm/intel/issues/426
[i915#4270]: https://gitlab.freedesktop.org/drm/intel/issues/4270
[i915#433]: https://gitlab.freedesktop.org/drm/intel/issues/433
[i915#4349]: https://gitlab.freedesktop.org/drm/intel/issues/4349
[i915#4538]: https://gitlab.freedesktop.org/drm/intel/issues/4538
[i915#4565]: https://gitlab.freedesktop.org/drm/intel/issues/4565
[i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613
[i915#4767]: https://gitlab.freedesktop.org/drm/intel/issues/4767
[i915#4771]: https://gitlab.freedesktop.org/drm/intel/issues/4771
[i915#4812]: https://gitlab.freedesktop.org/drm/intel/issues/4812
[i915#4833]: https://gitlab.freedesktop.org/drm/intel/issues/4833
[i915#4852]: https://gitlab.freedesktop.org/drm/intel/issues/4852
[i915#4854]: https://gitlab.freedesktop.org/drm/intel/issues/4854
[i915#4860]: https://gitlab.freedesktop.org/drm/intel/issues/4860
[i915#4873]: https://gitlab.freedesktop.org/drm/intel/issues/4873
[i915#4874]: https://gitlab.freedesktop.org/drm/intel/issues/4874
[i915#4879]: https://gitlab.freedesktop.org/drm/intel/issues/4879
[i915#4880]: https://gitlab.freedesktop.org/drm/intel/issues/4880
[i915#4881]: https://gitlab.freedesktop.org/drm/intel/issues/4881
[i915#5176]: https://gitlab.freedesktop.org/drm/intel/issues/5176
[i915#5235]: https://gitlab.freedesktop.org/drm/intel/issues/5235
[i915#5286]: https://gitlab.freedesktop.org/drm/intel/issues/5286
[i915#5288]: https://gitlab.freedesktop.org/drm/intel/issues/5288
[i915#5289]: https://gitlab.freedesktop.org/drm/intel/issues/5289
[i915#5325]: https://gitlab.freedesktop.org/drm/intel/issues/5325
[i915#533]: https://gitlab.freedesktop.org/drm/intel/issues/533
[i915#5439]: https://gitlab.freedesktop.org/drm/intel/issues/5439
[i915#5461]: https://gitlab.freedesktop.org/drm/intel/issues/5461
[i915#5563]: https://gitlab.freedesktop.org/drm/intel/issues/5563
[i915#5784]: https://gitlab.freedesktop.org/drm/intel/issues/5784
[i915#6095]: https://gitlab.freedesktop.org/drm/intel/issues/6095
[i915#6227]: https://gitlab.freedesktop.org/drm/intel/issues/6227
[i915#6230]: https://gitlab.freedesktop.org/drm/intel/issues/6230
[i915#6245]: https://gitlab.freedesktop.org/drm/intel/issues/6245
[i915#6247]: https://gitlab.freedesktop.org/drm/intel/issues/6247
[i915#6248]: https://gitlab.freedesktop.org/drm/intel/issues/6248
[i915#6258]: https://gitlab.freedesktop.org/drm/intel/issues/6258
[i915#6259]: https://gitlab.freedesktop.org/drm/intel/issues/6259
[i915#6268]: https://gitlab.freedesktop.org/drm/intel/issues/6268
[i915#6301]: https://gitlab.freedesktop.org/drm/intel/issues/6301
[i915#6334]: https://gitlab.freedesktop.org/drm/intel/issues/6334
[i915#6335]: https://gitlab.freedesktop.org/drm/intel/issues/6335
[i915#6344]: https://gitlab.freedesktop.org/drm/intel/issues/6344
[i915#6412]: https://gitlab.freedesktop.org/drm/intel/issues/6412
[i915#6433]: https://gitlab.freedesktop.org/drm/intel/issues/6433
[i915#6497]: https://gitlab.freedesktop.org/drm/intel/issues/6497
[i915#6524]: https://gitlab.freedesktop.org/drm/intel/issues/6524
[i915#658]: https://gitlab.freedesktop.org/drm/intel/issues/658
[i915#6590]: https://gitlab.freedesktop.org/drm/intel/issues/6590
[i915#6621]: https://gitlab.freedesktop.org/drm/intel/issues/6621
[i915#6768]: https://gitlab.freedesktop.org/drm/intel/issues/6768
[i915#6944]: https://gitlab.freedesktop.org/drm/intel/issues/6944
[i915#6953]: https://gitlab.freedesktop.org/drm/intel/issues/6953
[i915#7116]: https://gitlab.freedesktop.org/drm/intel/issues/7116
[i915#7118]: https://gitlab.freedesktop.org/drm/intel/issues/7118
[i915#7128]: https://gitlab.freedesktop.org/drm/intel/issues/7128
[i915#7294]: https://gitlab.freedesktop.org/drm/intel/issues/7294
[i915#7456]: https://gitlab.freedesktop.org/drm/intel/issues/7456
[i915#7561]: https://gitlab.freedesktop.org/drm/intel/issues/7561
[i915#7651]: https://gitlab.freedesktop.org/drm/intel/issues/7651
[i915#7697]: https://gitlab.freedesktop.org/drm/intel/issues/7697
[i915#7707]: https://gitlab.freedesktop.org/drm/intel/issues/7707
[i915#7711]: https://gitlab.freedesktop.org/drm/intel/issues/7711
[i915#7742]: https://gitlab.freedesktop.org/drm/intel/issues/7742
[i915#7828]: https://gitlab.freedesktop.org/drm/intel/issues/7828
[i915#79]: https://gitlab.freedesktop.org/drm/intel/issues/79
[i915#7949]: https://gitlab.freedesktop.org/drm/intel/issues/7949
Build changes
-------------
* Linux: CI_DRM_12656 -> Patchwork_113447v1
CI-20190529: 20190529
CI_DRM_12656: 5a9d8eeec978f2373afe9e049eaa42f67b42074a @ git://anongit.freedesktop.org/gfx-ci/linux
IGT_7140: ec87a6a636b9337ac9c8fec57350812bcb48fc09 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git
Patchwork_113447v1: 5a9d8eeec978f2373afe9e049eaa42f67b42074a @ git://anongit.freedesktop.org/gfx-ci/linux
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_113447v1/index.html
[-- Attachment #2: Type: text/html, Size: 11815 bytes --]
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Intel-gfx] [PATCH] drm/i915: Fix potential bit_17 double-free
2023-01-27 20:05 [Intel-gfx] [PATCH] drm/i915: Fix potential bit_17 double-free Rob Clark
2023-01-27 21:02 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork
2023-01-28 0:58 ` [Intel-gfx] ✓ Fi.CI.IGT: " Patchwork
@ 2023-01-30 10:08 ` Tvrtko Ursulin
2 siblings, 0 replies; 4+ messages in thread
From: Tvrtko Ursulin @ 2023-01-30 10:08 UTC (permalink / raw)
To: Rob Clark, dri-devel
Cc: Rob Clark, intel-gfx, Lucas De Marchi, open list, Chris Wilson,
pengfuyuan, Daniel Vetter, Rodrigo Vivi, David Airlie
On 27/01/2023 20:05, Rob Clark wrote:
> From: Rob Clark <robdclark@chromium.org>
>
> A userspace with multiple threads racing I915_GEM_SET_TILING to set the
> tiling to I915_TILING_NONE could trigger a double free of the bit_17
> bitmask. (Or conversely leak memory on the transition to tiled.) Move
> allocation/free'ing of the bitmask within the section protected by the
> obj lock.
>
> Fixes: e9b73c67390a ("drm/i915: Reduce memory pressure during shrinker by preallocating swizzle pages")
Should be:
Fixes: 2850748ef876 ("drm/i915: Pull i915_vma_pin under the vm->mutex")
Before that commit there as a "BKL" (struct_mutex) aroung the call to
i915_gem_object_set_tiling. Otherwise fix looks good:
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
I'll tweak the fixes tag and merge in a minute, thanks for the fix!
Regards,
Tvrtko
> Signed-off-by: Rob Clark <robdclark@chromium.org>
> ---
> drivers/gpu/drm/i915/gem/i915_gem_tiling.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_tiling.c b/drivers/gpu/drm/i915/gem/i915_gem_tiling.c
> index fd42b89b7162..bc21b1c2350a 100644
> --- a/drivers/gpu/drm/i915/gem/i915_gem_tiling.c
> +++ b/drivers/gpu/drm/i915/gem/i915_gem_tiling.c
> @@ -298,36 +298,37 @@ i915_gem_object_set_tiling(struct drm_i915_gem_object *obj,
> vma->fence_alignment =
> i915_gem_fence_alignment(i915,
> vma->size, tiling, stride);
>
> if (vma->fence)
> vma->fence->dirty = true;
> }
> spin_unlock(&obj->vma.lock);
>
> obj->tiling_and_stride = tiling | stride;
> - i915_gem_object_unlock(obj);
> -
> - /* Force the fence to be reacquired for GTT access */
> - i915_gem_object_release_mmap_gtt(obj);
>
> /* Try to preallocate memory required to save swizzling on put-pages */
> if (i915_gem_object_needs_bit17_swizzle(obj)) {
> if (!obj->bit_17) {
> obj->bit_17 = bitmap_zalloc(obj->base.size >> PAGE_SHIFT,
> GFP_KERNEL);
> }
> } else {
> bitmap_free(obj->bit_17);
> obj->bit_17 = NULL;
> }
>
> + i915_gem_object_unlock(obj);
> +
> + /* Force the fence to be reacquired for GTT access */
> + i915_gem_object_release_mmap_gtt(obj);
> +
> return 0;
> }
>
> /**
> * i915_gem_set_tiling_ioctl - IOCTL handler to set tiling mode
> * @dev: DRM device
> * @data: data pointer for the ioctl
> * @file: DRM file for the ioctl call
> *
> * Sets the tiling mode of an object, returning the required swizzling of
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-01-30 10:08 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-01-27 20:05 [Intel-gfx] [PATCH] drm/i915: Fix potential bit_17 double-free Rob Clark
2023-01-27 21:02 ` [Intel-gfx] ✓ Fi.CI.BAT: success for " Patchwork
2023-01-28 0:58 ` [Intel-gfx] ✓ Fi.CI.IGT: " Patchwork
2023-01-30 10:08 ` [Intel-gfx] [PATCH] " Tvrtko Ursulin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox