* [Intel-gfx] [PATCH v14 1/7] overflow: Introduce overflows_type() and castable_to_type()
2022-11-02 14:53 [Intel-gfx] [PATCH v14 0/7] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun
@ 2022-11-02 14:53 ` Gwan-gyeong Mun
2022-11-03 9:48 ` Gwan-gyeong Mun
2022-11-02 14:53 ` [Intel-gfx] [PATCH v14 2/7] drm/i915/gem: Typecheck page lookups Gwan-gyeong Mun
` (11 subsequent siblings)
12 siblings, 1 reply; 18+ messages in thread
From: Gwan-gyeong Mun @ 2022-11-02 14:53 UTC (permalink / raw)
To: intel-gfx
Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld,
mchehab, nirmoy.das
From: Kees Cook <keescook@chromium.org>
Implement a robust overflows_type() macro to test if a variable or
constant value would overflow another variable or type. This can be
used as a constant expression for static_assert() (which requires a
constant expression[1][2]) when used on constant values. This must be
constructed manually, since __builtin_add_overflow() does not produce
a constant expression[3].
Additionally adds castable_to_type(), similar to __same_type(), but for
checking if a constant value would overflow if cast to a given type.
Add unit tests for overflows_type(), __same_type(), and castable_to_type()
to the existing KUnit "overflow" test:
[16:03:33] ================== overflow (21 subtests) ==================
...
[16:03:33] [PASSED] overflows_type_test
[16:03:33] [PASSED] same_type_test
[16:03:33] [PASSED] castable_to_type_test
[16:03:33] ==================== [PASSED] overflow =====================
[16:03:33] ============================================================
[16:03:33] Testing complete. Ran 21 tests: passed: 21
[16:03:33] Elapsed time: 24.022s total, 0.002s configuring, 22.598s building, 0.767s running
[1] https://en.cppreference.com/w/c/language/_Static_assert
[2] C11 standard (ISO/IEC 9899:2011): 6.7.10 Static assertions
[3] https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins.html
6.56 Built-in Functions to Perform Arithmetic with Overflow Checking
Built-in Function: bool __builtin_add_overflow (type1 a, type2 b,
Cc: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Tom Rix <trix@redhat.com>
Cc: Daniel Latypov <dlatypov@google.com>
Cc: Vitor Massaru Iha <vitor@massaru.org>
Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Cc: Jani Nikula <jani.nikula@intel.com>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: linux-hardening@vger.kernel.org
Cc: llvm@lists.linux.dev
Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20221024201125.1416422-1-gwan-gyeong.mun@intel.com
---
drivers/gpu/drm/i915/i915_user_extensions.c | 2 +-
drivers/gpu/drm/i915/i915_utils.h | 4 -
include/linux/compiler.h | 1 +
include/linux/overflow.h | 48 +++
lib/Makefile | 1 +
lib/overflow_kunit.c | 381 ++++++++++++++++++++
6 files changed, 432 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/i915/i915_user_extensions.c b/drivers/gpu/drm/i915/i915_user_extensions.c
index c822d0aafd2d..e3f808372c47 100644
--- a/drivers/gpu/drm/i915/i915_user_extensions.c
+++ b/drivers/gpu/drm/i915/i915_user_extensions.c
@@ -51,7 +51,7 @@ int i915_user_extensions(struct i915_user_extension __user *ext,
return err;
if (get_user(next, &ext->next_extension) ||
- overflows_type(next, ext))
+ overflows_type(next, uintptr_t))
return -EFAULT;
ext = u64_to_user_ptr(next);
diff --git a/drivers/gpu/drm/i915/i915_utils.h b/drivers/gpu/drm/i915/i915_utils.h
index 6c14d13364bf..67a66d4d5c70 100644
--- a/drivers/gpu/drm/i915/i915_utils.h
+++ b/drivers/gpu/drm/i915/i915_utils.h
@@ -111,10 +111,6 @@ bool i915_error_injected(void);
#define range_overflows_end_t(type, start, size, max) \
range_overflows_end((type)(start), (type)(size), (type)(max))
-/* Note we don't consider signbits :| */
-#define overflows_type(x, T) \
- (sizeof(x) > sizeof(T) && (x) >> BITS_PER_TYPE(T))
-
#define ptr_mask_bits(ptr, n) ({ \
unsigned long __v = (unsigned long)(ptr); \
(typeof(ptr))(__v & -BIT(n)); \
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 973a1bfd7ef5..947a60b801db 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -236,6 +236,7 @@ static inline void *offset_to_ptr(const int *off)
* bool and also pointer types.
*/
#define is_signed_type(type) (((type)(-1)) < (__force type)1)
+#define is_unsigned_type(type) (!is_signed_type(type))
/*
* This is needed in functions which generate the stack canary, see
diff --git a/include/linux/overflow.h b/include/linux/overflow.h
index 1d3be1a2204c..16ae8d912390 100644
--- a/include/linux/overflow.h
+++ b/include/linux/overflow.h
@@ -128,6 +128,54 @@ static inline bool __must_check __must_check_overflow(bool overflow)
(*_d >> _to_shift) != _a); \
}))
+#define __overflows_type_constexpr(x, T) ( \
+ is_unsigned_type(typeof(x)) ? \
+ (x) > type_max(typeof(T)) ? 1 : 0 \
+ : is_unsigned_type(typeof(T)) ? \
+ (x) < 0 || (x) > type_max(typeof(T)) ? 1 : 0 \
+ : (x) < type_min(typeof(T)) || \
+ (x) > type_max(typeof(T)) ? 1 : 0)
+
+#define __overflows_type(x, T) ({ \
+ typeof(T) v = 0; \
+ check_add_overflow((x), v, &v); \
+})
+
+/**
+ * overflows_type - helper for checking the overflows between value, variables,
+ * or data type
+ *
+ * @n: source constant value or variable to be checked
+ * @T: destination variable or data type proposed to store @x
+ *
+ * Compares the @x expression for whether or not it can safely fit in
+ * the storage of the type in @T. @x and @T can have different types.
+ * If @x is a constant expression, this will also resolve to a constant
+ * expression.
+ *
+ * Returns: true if overflow can occur, false otherwise.
+ */
+#define overflows_type(n, T) \
+ __builtin_choose_expr(__is_constexpr(n), \
+ __overflows_type_constexpr(n, T), \
+ __overflows_type(n, T))
+
+/**
+ * castable_to_type - like __same_type(), but also allows for casted literals
+ *
+ * @n: variable or constant value
+ * @T: variable or data type
+ *
+ * Unlike the __same_type() macro, this allows a constant value as the
+ * first argument. If this value would not overflow into an assignment
+ * of the second argument's type, it returns true. Otherwise, this falls
+ * back to __same_type().
+ */
+#define castable_to_type(n, T) \
+ __builtin_choose_expr(__is_constexpr(n), \
+ !__overflows_type_constexpr(n, T), \
+ __same_type(n, T))
+
/**
* size_mul() - Calculate size_t multiplication with saturation at SIZE_MAX
* @factor1: first factor
diff --git a/lib/Makefile b/lib/Makefile
index 161d6a724ff7..452802d30718 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -376,6 +376,7 @@ obj-$(CONFIG_CMDLINE_KUNIT_TEST) += cmdline_kunit.o
obj-$(CONFIG_SLUB_KUNIT_TEST) += slub_kunit.o
obj-$(CONFIG_MEMCPY_KUNIT_TEST) += memcpy_kunit.o
obj-$(CONFIG_IS_SIGNED_TYPE_KUNIT_TEST) += is_signed_type_kunit.o
+CFLAGS_overflow_kunit.o = $(call cc-disable-warning, tautological-constant-out-of-range-compare)
obj-$(CONFIG_OVERFLOW_KUNIT_TEST) += overflow_kunit.o
CFLAGS_stackinit_kunit.o += $(call cc-disable-warning, switch-unreachable)
obj-$(CONFIG_STACKINIT_KUNIT_TEST) += stackinit_kunit.o
diff --git a/lib/overflow_kunit.c b/lib/overflow_kunit.c
index b8556a2e7bb1..dcd3ba102db6 100644
--- a/lib/overflow_kunit.c
+++ b/lib/overflow_kunit.c
@@ -736,6 +736,384 @@ static void overflow_size_helpers_test(struct kunit *test)
#undef check_one_size_helper
}
+static void overflows_type_test(struct kunit *test)
+{
+ int count = 0;
+ unsigned int var;
+
+#define __TEST_OVERFLOWS_TYPE(func, arg1, arg2, of) do { \
+ bool __of = func(arg1, arg2); \
+ KUNIT_EXPECT_EQ_MSG(test, __of, of, \
+ "expected " #func "(" #arg1 ", " #arg2 " to%s overflow\n",\
+ of ? "" : " not"); \
+ count++; \
+} while (0)
+
+/* Args are: first type, second type, value, overflow expected */
+#define TEST_OVERFLOWS_TYPE(__t1, __t2, v, of) do { \
+ __t1 t1 = (v); \
+ __t2 t2; \
+ __TEST_OVERFLOWS_TYPE(__overflows_type, t1, t2, of); \
+ __TEST_OVERFLOWS_TYPE(__overflows_type, t1, __t2, of); \
+ __TEST_OVERFLOWS_TYPE(__overflows_type_constexpr, t1, t2, of); \
+ __TEST_OVERFLOWS_TYPE(__overflows_type_constexpr, t1, __t2, of);\
+} while (0)
+
+ TEST_OVERFLOWS_TYPE(u8, u8, U8_MAX, false);
+ TEST_OVERFLOWS_TYPE(u8, u16, U8_MAX, false);
+ TEST_OVERFLOWS_TYPE(u8, s8, U8_MAX, true);
+ TEST_OVERFLOWS_TYPE(u8, s8, S8_MAX, false);
+ TEST_OVERFLOWS_TYPE(u8, s8, (u8)S8_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(u8, s16, U8_MAX, false);
+ TEST_OVERFLOWS_TYPE(s8, u8, S8_MAX, false);
+ TEST_OVERFLOWS_TYPE(s8, u8, -1, true);
+ TEST_OVERFLOWS_TYPE(s8, u8, S8_MIN, true);
+ TEST_OVERFLOWS_TYPE(s8, u16, S8_MAX, false);
+ TEST_OVERFLOWS_TYPE(s8, u16, -1, true);
+ TEST_OVERFLOWS_TYPE(s8, u16, S8_MIN, true);
+ TEST_OVERFLOWS_TYPE(s8, u32, S8_MAX, false);
+ TEST_OVERFLOWS_TYPE(s8, u32, -1, true);
+ TEST_OVERFLOWS_TYPE(s8, u32, S8_MIN, true);
+#if BITS_PER_LONG == 64
+ TEST_OVERFLOWS_TYPE(s8, u64, S8_MAX, false);
+ TEST_OVERFLOWS_TYPE(s8, u64, -1, true);
+ TEST_OVERFLOWS_TYPE(s8, u64, S8_MIN, true);
+#endif
+ TEST_OVERFLOWS_TYPE(s8, s8, S8_MAX, false);
+ TEST_OVERFLOWS_TYPE(s8, s8, S8_MIN, false);
+ TEST_OVERFLOWS_TYPE(s8, s16, S8_MAX, false);
+ TEST_OVERFLOWS_TYPE(s8, s16, S8_MIN, false);
+ TEST_OVERFLOWS_TYPE(u16, u8, U8_MAX, false);
+ TEST_OVERFLOWS_TYPE(u16, u8, (u16)U8_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(u16, u8, U16_MAX, true);
+ TEST_OVERFLOWS_TYPE(u16, s8, S8_MAX, false);
+ TEST_OVERFLOWS_TYPE(u16, s8, (u16)S8_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(u16, s8, U16_MAX, true);
+ TEST_OVERFLOWS_TYPE(u16, s16, S16_MAX, false);
+ TEST_OVERFLOWS_TYPE(u16, s16, (u16)S16_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(u16, s16, U16_MAX, true);
+ TEST_OVERFLOWS_TYPE(u16, u32, U16_MAX, false);
+ TEST_OVERFLOWS_TYPE(u16, s32, U16_MAX, false);
+ TEST_OVERFLOWS_TYPE(s16, u8, U8_MAX, false);
+ TEST_OVERFLOWS_TYPE(s16, u8, (s16)U8_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(s16, u8, -1, true);
+ TEST_OVERFLOWS_TYPE(s16, u8, S16_MIN, true);
+ TEST_OVERFLOWS_TYPE(s16, u16, S16_MAX, false);
+ TEST_OVERFLOWS_TYPE(s16, u16, -1, true);
+ TEST_OVERFLOWS_TYPE(s16, u16, S16_MIN, true);
+ TEST_OVERFLOWS_TYPE(s16, u32, S16_MAX, false);
+ TEST_OVERFLOWS_TYPE(s16, u32, -1, true);
+ TEST_OVERFLOWS_TYPE(s16, u32, S16_MIN, true);
+#if BITS_PER_LONG == 64
+ TEST_OVERFLOWS_TYPE(s16, u64, S16_MAX, false);
+ TEST_OVERFLOWS_TYPE(s16, u64, -1, true);
+ TEST_OVERFLOWS_TYPE(s16, u64, S16_MIN, true);
+#endif
+ TEST_OVERFLOWS_TYPE(s16, s8, S8_MAX, false);
+ TEST_OVERFLOWS_TYPE(s16, s8, S8_MIN, false);
+ TEST_OVERFLOWS_TYPE(s16, s8, (s16)S8_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(s16, s8, (s16)S8_MIN - 1, true);
+ TEST_OVERFLOWS_TYPE(s16, s8, S16_MAX, true);
+ TEST_OVERFLOWS_TYPE(s16, s8, S16_MIN, true);
+ TEST_OVERFLOWS_TYPE(s16, s16, S16_MAX, false);
+ TEST_OVERFLOWS_TYPE(s16, s16, S16_MIN, false);
+ TEST_OVERFLOWS_TYPE(s16, s32, S16_MAX, false);
+ TEST_OVERFLOWS_TYPE(s16, s32, S16_MIN, false);
+ TEST_OVERFLOWS_TYPE(u32, u8, U8_MAX, false);
+ TEST_OVERFLOWS_TYPE(u32, u8, (u32)U8_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(u32, u8, U32_MAX, true);
+ TEST_OVERFLOWS_TYPE(u32, s8, S8_MAX, false);
+ TEST_OVERFLOWS_TYPE(u32, s8, (u32)S8_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(u32, s8, U32_MAX, true);
+ TEST_OVERFLOWS_TYPE(u32, u16, U16_MAX, false);
+ TEST_OVERFLOWS_TYPE(u32, u16, U16_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(u32, u16, U32_MAX, true);
+ TEST_OVERFLOWS_TYPE(u32, s16, S16_MAX, false);
+ TEST_OVERFLOWS_TYPE(u32, s16, (u32)S16_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(u32, s16, U32_MAX, true);
+ TEST_OVERFLOWS_TYPE(u32, u32, U32_MAX, false);
+ TEST_OVERFLOWS_TYPE(u32, s32, S32_MAX, false);
+ TEST_OVERFLOWS_TYPE(u32, s32, U32_MAX, true);
+ TEST_OVERFLOWS_TYPE(u32, s32, (u32)S32_MAX + 1, true);
+#if BITS_PER_LONG == 64
+ TEST_OVERFLOWS_TYPE(u32, u64, U32_MAX, false);
+ TEST_OVERFLOWS_TYPE(u32, s64, U32_MAX, false);
+#endif
+ TEST_OVERFLOWS_TYPE(s32, u8, U8_MAX, false);
+ TEST_OVERFLOWS_TYPE(s32, u8, (s32)U8_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(s32, u16, S32_MAX, true);
+ TEST_OVERFLOWS_TYPE(s32, u8, -1, true);
+ TEST_OVERFLOWS_TYPE(s32, u8, S32_MIN, true);
+ TEST_OVERFLOWS_TYPE(s32, u16, U16_MAX, false);
+ TEST_OVERFLOWS_TYPE(s32, u16, (s32)U16_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(s32, u16, S32_MAX, true);
+ TEST_OVERFLOWS_TYPE(s32, u16, -1, true);
+ TEST_OVERFLOWS_TYPE(s32, u16, S32_MIN, true);
+ TEST_OVERFLOWS_TYPE(s32, u32, S32_MAX, false);
+ TEST_OVERFLOWS_TYPE(s32, u32, -1, true);
+ TEST_OVERFLOWS_TYPE(s32, u32, S32_MIN, true);
+#if BITS_PER_LONG == 64
+ TEST_OVERFLOWS_TYPE(s32, u64, S32_MAX, false);
+ TEST_OVERFLOWS_TYPE(s32, u64, -1, true);
+ TEST_OVERFLOWS_TYPE(s32, u64, S32_MIN, true);
+#endif
+ TEST_OVERFLOWS_TYPE(s32, s8, S8_MAX, false);
+ TEST_OVERFLOWS_TYPE(s32, s8, S8_MIN, false);
+ TEST_OVERFLOWS_TYPE(s32, s8, (s32)S8_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(s32, s8, (s32)S8_MIN - 1, true);
+ TEST_OVERFLOWS_TYPE(s32, s8, S32_MAX, true);
+ TEST_OVERFLOWS_TYPE(s32, s8, S32_MIN, true);
+ TEST_OVERFLOWS_TYPE(s32, s16, S16_MAX, false);
+ TEST_OVERFLOWS_TYPE(s32, s16, S16_MIN, false);
+ TEST_OVERFLOWS_TYPE(s32, s16, (s32)S16_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(s32, s16, (s32)S16_MIN - 1, true);
+ TEST_OVERFLOWS_TYPE(s32, s16, S32_MAX, true);
+ TEST_OVERFLOWS_TYPE(s32, s16, S32_MIN, true);
+ TEST_OVERFLOWS_TYPE(s32, s32, S32_MAX, false);
+ TEST_OVERFLOWS_TYPE(s32, s32, S32_MIN, false);
+#if BITS_PER_LONG == 64
+ TEST_OVERFLOWS_TYPE(s32, s64, S32_MAX, false);
+ TEST_OVERFLOWS_TYPE(s32, s64, S32_MIN, false);
+ TEST_OVERFLOWS_TYPE(u64, u8, U64_MAX, true);
+ TEST_OVERFLOWS_TYPE(u64, u8, U8_MAX, false);
+ TEST_OVERFLOWS_TYPE(u64, u8, (u64)U8_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(u64, u16, U64_MAX, true);
+ TEST_OVERFLOWS_TYPE(u64, u16, U16_MAX, false);
+ TEST_OVERFLOWS_TYPE(u64, u16, (u64)U16_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(u64, u32, U64_MAX, true);
+ TEST_OVERFLOWS_TYPE(u64, u32, U32_MAX, false);
+ TEST_OVERFLOWS_TYPE(u64, u32, (u64)U32_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(u64, u64, U64_MAX, false);
+ TEST_OVERFLOWS_TYPE(u64, s8, S8_MAX, false);
+ TEST_OVERFLOWS_TYPE(u64, s8, (u64)S8_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(u64, s8, U64_MAX, true);
+ TEST_OVERFLOWS_TYPE(u64, s16, S16_MAX, false);
+ TEST_OVERFLOWS_TYPE(u64, s16, (u64)S16_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(u64, s16, U64_MAX, true);
+ TEST_OVERFLOWS_TYPE(u64, s32, S32_MAX, false);
+ TEST_OVERFLOWS_TYPE(u64, s32, (u64)S32_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(u64, s32, U64_MAX, true);
+ TEST_OVERFLOWS_TYPE(u64, s64, S64_MAX, false);
+ TEST_OVERFLOWS_TYPE(u64, s64, U64_MAX, true);
+ TEST_OVERFLOWS_TYPE(u64, s64, (u64)S64_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(s64, u8, S64_MAX, true);
+ TEST_OVERFLOWS_TYPE(s64, u8, S64_MIN, true);
+ TEST_OVERFLOWS_TYPE(s64, u8, -1, true);
+ TEST_OVERFLOWS_TYPE(s64, u8, U8_MAX, false);
+ TEST_OVERFLOWS_TYPE(s64, u8, (s64)U8_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(s64, u16, S64_MAX, true);
+ TEST_OVERFLOWS_TYPE(s64, u16, S64_MIN, true);
+ TEST_OVERFLOWS_TYPE(s64, u16, -1, true);
+ TEST_OVERFLOWS_TYPE(s64, u16, U16_MAX, false);
+ TEST_OVERFLOWS_TYPE(s64, u16, (s64)U16_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(s64, u32, S64_MAX, true);
+ TEST_OVERFLOWS_TYPE(s64, u32, S64_MIN, true);
+ TEST_OVERFLOWS_TYPE(s64, u32, -1, true);
+ TEST_OVERFLOWS_TYPE(s64, u32, U32_MAX, false);
+ TEST_OVERFLOWS_TYPE(s64, u32, (s64)U32_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(s64, u64, S64_MAX, false);
+ TEST_OVERFLOWS_TYPE(s64, u64, S64_MIN, true);
+ TEST_OVERFLOWS_TYPE(s64, u64, -1, true);
+ TEST_OVERFLOWS_TYPE(s64, s8, S8_MAX, false);
+ TEST_OVERFLOWS_TYPE(s64, s8, S8_MIN, false);
+ TEST_OVERFLOWS_TYPE(s64, s8, (s64)S8_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(s64, s8, (s64)S8_MIN - 1, true);
+ TEST_OVERFLOWS_TYPE(s64, s8, S64_MAX, true);
+ TEST_OVERFLOWS_TYPE(s64, s16, S16_MAX, false);
+ TEST_OVERFLOWS_TYPE(s64, s16, S16_MIN, false);
+ TEST_OVERFLOWS_TYPE(s64, s16, (s64)S16_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(s64, s16, (s64)S16_MIN - 1, true);
+ TEST_OVERFLOWS_TYPE(s64, s16, S64_MAX, true);
+ TEST_OVERFLOWS_TYPE(s64, s32, S32_MAX, false);
+ TEST_OVERFLOWS_TYPE(s64, s32, S32_MIN, false);
+ TEST_OVERFLOWS_TYPE(s64, s32, (s64)S32_MAX + 1, true);
+ TEST_OVERFLOWS_TYPE(s64, s32, (s64)S32_MIN - 1, true);
+ TEST_OVERFLOWS_TYPE(s64, s32, S64_MAX, true);
+ TEST_OVERFLOWS_TYPE(s64, s64, S64_MAX, false);
+ TEST_OVERFLOWS_TYPE(s64, s64, S64_MIN, false);
+#endif
+
+ /* Check for macro side-effects. */
+ var = INT_MAX - 1;
+ __TEST_OVERFLOWS_TYPE(__overflows_type, var++, int, false);
+ __TEST_OVERFLOWS_TYPE(__overflows_type, var++, int, false);
+ __TEST_OVERFLOWS_TYPE(__overflows_type, var++, int, true);
+ var = INT_MAX - 1;
+ __TEST_OVERFLOWS_TYPE(overflows_type, var++, int, false);
+ __TEST_OVERFLOWS_TYPE(overflows_type, var++, int, false);
+ __TEST_OVERFLOWS_TYPE(overflows_type, var++, int, true);
+
+ kunit_info(test, "%d overflows_type() tests finished\n", count);
+#undef TEST_OVERFLOWS_TYPE
+#undef __TEST_OVERFLOWS_TYPE
+}
+
+static void same_type_test(struct kunit *test)
+{
+ int count = 0;
+ int var;
+
+#define TEST_SAME_TYPE(t1, t2, same) do { \
+ typeof(t1) __t1h = type_max(t1); \
+ typeof(t1) __t1l = type_min(t1); \
+ typeof(t2) __t2h = type_max(t2); \
+ typeof(t2) __t2l = type_min(t2); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t1, __t1h)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t1, __t1l)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t1h, t1)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t1l, t1)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t2, __t2h)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t2, __t2l)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t2h, t2)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t2l, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t2, __t1h)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t2, __t1l)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t1h, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t1l, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, __t2h)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, __t2l)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t2h, t1)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t2l, t1)); \
+} while (0)
+
+#if BITS_PER_LONG == 64
+# define TEST_SAME_TYPE64(base, t, m) TEST_SAME_TYPE(base, t, m)
+#else
+# define TEST_SAME_TYPE64(base, t, m) do { } while (0)
+#endif
+
+#define TEST_TYPE_SETS(base, mu8, mu16, mu32, ms8, ms16, ms32, mu64, ms64) \
+do { \
+ TEST_SAME_TYPE(base, u8, mu8); \
+ TEST_SAME_TYPE(base, u16, mu16); \
+ TEST_SAME_TYPE(base, u32, mu32); \
+ TEST_SAME_TYPE(base, s8, ms8); \
+ TEST_SAME_TYPE(base, s16, ms16); \
+ TEST_SAME_TYPE(base, s32, ms32); \
+ TEST_SAME_TYPE64(base, u64, mu64); \
+ TEST_SAME_TYPE64(base, s64, ms64); \
+} while (0)
+
+ TEST_TYPE_SETS(u8, true, false, false, false, false, false, false, false);
+ TEST_TYPE_SETS(u16, false, true, false, false, false, false, false, false);
+ TEST_TYPE_SETS(u32, false, false, true, false, false, false, false, false);
+ TEST_TYPE_SETS(s8, false, false, false, true, false, false, false, false);
+ TEST_TYPE_SETS(s16, false, false, false, false, true, false, false, false);
+ TEST_TYPE_SETS(s32, false, false, false, false, false, true, false, false);
+#if BITS_PER_LONG == 64
+ TEST_TYPE_SETS(u64, false, false, false, false, false, false, true, false);
+ TEST_TYPE_SETS(s64, false, false, false, false, false, false, false, true);
+#endif
+
+ /* Check for macro side-effects. */
+ var = 4;
+ KUNIT_EXPECT_EQ(test, var, 4);
+ KUNIT_EXPECT_TRUE(test, __same_type(var++, int));
+ KUNIT_EXPECT_EQ(test, var, 4);
+ KUNIT_EXPECT_TRUE(test, __same_type(int, var++));
+ KUNIT_EXPECT_EQ(test, var, 4);
+ KUNIT_EXPECT_TRUE(test, __same_type(var++, var++));
+ KUNIT_EXPECT_EQ(test, var, 4);
+
+ kunit_info(test, "%d __same_type() tests finished\n", count);
+
+#undef TEST_TYPE_SETS
+#undef TEST_SAME_TYPE64
+#undef TEST_SAME_TYPE
+}
+
+static void castable_to_type_test(struct kunit *test)
+{
+ int count = 0;
+
+#define TEST_CASTABLE_TO_TYPE(arg1, arg2, pass) do { \
+ bool __pass = castable_to_type(arg1, arg2); \
+ KUNIT_EXPECT_EQ_MSG(test, __pass, pass, \
+ "expected castable_to_type(" #arg1 ", " #arg2 ") to%s pass\n",\
+ pass ? "" : " not"); \
+ count++; \
+} while (0)
+
+ TEST_CASTABLE_TO_TYPE(16, u8, true);
+ TEST_CASTABLE_TO_TYPE(16, u16, true);
+ TEST_CASTABLE_TO_TYPE(16, u32, true);
+ TEST_CASTABLE_TO_TYPE(16, s8, true);
+ TEST_CASTABLE_TO_TYPE(16, s16, true);
+ TEST_CASTABLE_TO_TYPE(16, s32, true);
+ TEST_CASTABLE_TO_TYPE(-16, s8, true);
+ TEST_CASTABLE_TO_TYPE(-16, s16, true);
+ TEST_CASTABLE_TO_TYPE(-16, s32, true);
+#if BITS_PER_LONG == 64
+ TEST_CASTABLE_TO_TYPE(16, u64, true);
+ TEST_CASTABLE_TO_TYPE(-16, s64, true);
+#endif
+
+#define TEST_CASTABLE_TO_TYPE_VAR(width) do { \
+ u ## width u ## width ## var = 0; \
+ s ## width s ## width ## var = 0; \
+ \
+ /* Constant expressions that fit types. */ \
+ TEST_CASTABLE_TO_TYPE(type_max(u ## width), u ## width, true); \
+ TEST_CASTABLE_TO_TYPE(type_min(u ## width), u ## width, true); \
+ TEST_CASTABLE_TO_TYPE(type_max(u ## width), u ## width ## var, true); \
+ TEST_CASTABLE_TO_TYPE(type_min(u ## width), u ## width ## var, true); \
+ TEST_CASTABLE_TO_TYPE(type_max(s ## width), s ## width, true); \
+ TEST_CASTABLE_TO_TYPE(type_min(s ## width), s ## width, true); \
+ TEST_CASTABLE_TO_TYPE(type_max(s ## width), s ## width ## var, true); \
+ TEST_CASTABLE_TO_TYPE(type_min(u ## width), s ## width ## var, true); \
+ /* Constant expressions that do not fit types. */ \
+ TEST_CASTABLE_TO_TYPE(type_max(u ## width), s ## width, false); \
+ TEST_CASTABLE_TO_TYPE(type_max(u ## width), s ## width ## var, false); \
+ TEST_CASTABLE_TO_TYPE(type_min(s ## width), u ## width, false); \
+ TEST_CASTABLE_TO_TYPE(type_min(s ## width), u ## width ## var, false); \
+ /* Non-constant expression with mismatched type. */ \
+ TEST_CASTABLE_TO_TYPE(s ## width ## var, u ## width, false); \
+ TEST_CASTABLE_TO_TYPE(u ## width ## var, s ## width, false); \
+} while (0)
+
+#define TEST_CASTABLE_TO_TYPE_RANGE(width) do { \
+ unsigned long big = U ## width ## _MAX; \
+ signed long small = S ## width ## _MIN; \
+ u ## width u ## width ## var = 0; \
+ s ## width s ## width ## var = 0; \
+ \
+ /* Constant expression in range. */ \
+ TEST_CASTABLE_TO_TYPE(U ## width ## _MAX, u ## width, true); \
+ TEST_CASTABLE_TO_TYPE(U ## width ## _MAX, u ## width ## var, true); \
+ TEST_CASTABLE_TO_TYPE(S ## width ## _MIN, s ## width, true); \
+ TEST_CASTABLE_TO_TYPE(S ## width ## _MIN, s ## width ## var, true); \
+ /* Constant expression out of range. */ \
+ TEST_CASTABLE_TO_TYPE((unsigned long)U ## width ## _MAX + 1, u ## width, false); \
+ TEST_CASTABLE_TO_TYPE((unsigned long)U ## width ## _MAX + 1, u ## width ## var, false); \
+ TEST_CASTABLE_TO_TYPE((signed long)S ## width ## _MIN - 1, s ## width, false); \
+ TEST_CASTABLE_TO_TYPE((signed long)S ## width ## _MIN - 1, s ## width ## var, false); \
+ /* Non-constant expression with mismatched type. */ \
+ TEST_CASTABLE_TO_TYPE(big, u ## width, false); \
+ TEST_CASTABLE_TO_TYPE(big, u ## width ## var, false); \
+ TEST_CASTABLE_TO_TYPE(small, s ## width, false); \
+ TEST_CASTABLE_TO_TYPE(small, s ## width ## var, false); \
+} while (0)
+
+ TEST_CASTABLE_TO_TYPE_VAR(8);
+ TEST_CASTABLE_TO_TYPE_VAR(16);
+ TEST_CASTABLE_TO_TYPE_VAR(32);
+#if BITS_PER_LONG == 64
+ TEST_CASTABLE_TO_TYPE_VAR(64);
+#endif
+
+ TEST_CASTABLE_TO_TYPE_RANGE(8);
+ TEST_CASTABLE_TO_TYPE_RANGE(16);
+#if BITS_PER_LONG == 64
+ TEST_CASTABLE_TO_TYPE_RANGE(32);
+#endif
+ kunit_info(test, "%d castable_to_type() tests finished\n", count);
+
+#undef TEST_CASTABLE_TO_TYPE_RANGE
+#undef TEST_CASTABLE_TO_TYPE_VAR
+#undef TEST_CASTABLE_TO_TYPE
+}
+
static struct kunit_case overflow_test_cases[] = {
KUNIT_CASE(u8_u8__u8_overflow_test),
KUNIT_CASE(s8_s8__s8_overflow_test),
@@ -755,6 +1133,9 @@ static struct kunit_case overflow_test_cases[] = {
KUNIT_CASE(shift_nonsense_test),
KUNIT_CASE(overflow_allocation_test),
KUNIT_CASE(overflow_size_helpers_test),
+ KUNIT_CASE(overflows_type_test),
+ KUNIT_CASE(same_type_test),
+ KUNIT_CASE(castable_to_type_test),
{}
};
--
2.37.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* Re: [Intel-gfx] [PATCH v14 1/7] overflow: Introduce overflows_type() and castable_to_type()
2022-11-02 14:53 ` [Intel-gfx] [PATCH v14 1/7] overflow: Introduce overflows_type() and castable_to_type() Gwan-gyeong Mun
@ 2022-11-03 9:48 ` Gwan-gyeong Mun
0 siblings, 0 replies; 18+ messages in thread
From: Gwan-gyeong Mun @ 2022-11-03 9:48 UTC (permalink / raw)
To: intel-gfx
Cc: thomas.hellstrom, jani.nikula, chris, matthew.auld, andrzej.hajda,
mchehab, nirmoy.das
This patch has merged to linux-next.
On 11/2/22 4:53 PM, Gwan-gyeong Mun wrote:
> From: Kees Cook <keescook@chromium.org>
>
> Implement a robust overflows_type() macro to test if a variable or
> constant value would overflow another variable or type. This can be
> used as a constant expression for static_assert() (which requires a
> constant expression[1][2]) when used on constant values. This must be
> constructed manually, since __builtin_add_overflow() does not produce
> a constant expression[3].
>
> Additionally adds castable_to_type(), similar to __same_type(), but for
> checking if a constant value would overflow if cast to a given type.
>
> Add unit tests for overflows_type(), __same_type(), and castable_to_type()
> to the existing KUnit "overflow" test:
>
> [16:03:33] ================== overflow (21 subtests) ==================
> ...
> [16:03:33] [PASSED] overflows_type_test
> [16:03:33] [PASSED] same_type_test
> [16:03:33] [PASSED] castable_to_type_test
> [16:03:33] ==================== [PASSED] overflow =====================
> [16:03:33] ============================================================
> [16:03:33] Testing complete. Ran 21 tests: passed: 21
> [16:03:33] Elapsed time: 24.022s total, 0.002s configuring, 22.598s building, 0.767s running
>
> [1] https://en.cppreference.com/w/c/language/_Static_assert
> [2] C11 standard (ISO/IEC 9899:2011): 6.7.10 Static assertions
> [3] https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins.html
> 6.56 Built-in Functions to Perform Arithmetic with Overflow Checking
> Built-in Function: bool __builtin_add_overflow (type1 a, type2 b,
>
> Cc: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
> Cc: Nathan Chancellor <nathan@kernel.org>
> Cc: Nick Desaulniers <ndesaulniers@google.com>
> Cc: Tom Rix <trix@redhat.com>
> Cc: Daniel Latypov <dlatypov@google.com>
> Cc: Vitor Massaru Iha <vitor@massaru.org>
> Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
> Cc: Jani Nikula <jani.nikula@intel.com>
> Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
> Cc: linux-hardening@vger.kernel.org
> Cc: llvm@lists.linux.dev
> Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
> Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> Link: https://lore.kernel.org/r/20221024201125.1416422-1-gwan-gyeong.mun@intel.com
> ---
> drivers/gpu/drm/i915/i915_user_extensions.c | 2 +-
> drivers/gpu/drm/i915/i915_utils.h | 4 -
> include/linux/compiler.h | 1 +
> include/linux/overflow.h | 48 +++
> lib/Makefile | 1 +
> lib/overflow_kunit.c | 381 ++++++++++++++++++++
> 6 files changed, 432 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/i915_user_extensions.c b/drivers/gpu/drm/i915/i915_user_extensions.c
> index c822d0aafd2d..e3f808372c47 100644
> --- a/drivers/gpu/drm/i915/i915_user_extensions.c
> +++ b/drivers/gpu/drm/i915/i915_user_extensions.c
> @@ -51,7 +51,7 @@ int i915_user_extensions(struct i915_user_extension __user *ext,
> return err;
>
> if (get_user(next, &ext->next_extension) ||
> - overflows_type(next, ext))
> + overflows_type(next, uintptr_t))
> return -EFAULT;
>
> ext = u64_to_user_ptr(next);
> diff --git a/drivers/gpu/drm/i915/i915_utils.h b/drivers/gpu/drm/i915/i915_utils.h
> index 6c14d13364bf..67a66d4d5c70 100644
> --- a/drivers/gpu/drm/i915/i915_utils.h
> +++ b/drivers/gpu/drm/i915/i915_utils.h
> @@ -111,10 +111,6 @@ bool i915_error_injected(void);
> #define range_overflows_end_t(type, start, size, max) \
> range_overflows_end((type)(start), (type)(size), (type)(max))
>
> -/* Note we don't consider signbits :| */
> -#define overflows_type(x, T) \
> - (sizeof(x) > sizeof(T) && (x) >> BITS_PER_TYPE(T))
> -
> #define ptr_mask_bits(ptr, n) ({ \
> unsigned long __v = (unsigned long)(ptr); \
> (typeof(ptr))(__v & -BIT(n)); \
> diff --git a/include/linux/compiler.h b/include/linux/compiler.h
> index 973a1bfd7ef5..947a60b801db 100644
> --- a/include/linux/compiler.h
> +++ b/include/linux/compiler.h
> @@ -236,6 +236,7 @@ static inline void *offset_to_ptr(const int *off)
> * bool and also pointer types.
> */
> #define is_signed_type(type) (((type)(-1)) < (__force type)1)
> +#define is_unsigned_type(type) (!is_signed_type(type))
>
> /*
> * This is needed in functions which generate the stack canary, see
> diff --git a/include/linux/overflow.h b/include/linux/overflow.h
> index 1d3be1a2204c..16ae8d912390 100644
> --- a/include/linux/overflow.h
> +++ b/include/linux/overflow.h
> @@ -128,6 +128,54 @@ static inline bool __must_check __must_check_overflow(bool overflow)
> (*_d >> _to_shift) != _a); \
> }))
>
> +#define __overflows_type_constexpr(x, T) ( \
> + is_unsigned_type(typeof(x)) ? \
> + (x) > type_max(typeof(T)) ? 1 : 0 \
> + : is_unsigned_type(typeof(T)) ? \
> + (x) < 0 || (x) > type_max(typeof(T)) ? 1 : 0 \
> + : (x) < type_min(typeof(T)) || \
> + (x) > type_max(typeof(T)) ? 1 : 0)
> +
> +#define __overflows_type(x, T) ({ \
> + typeof(T) v = 0; \
> + check_add_overflow((x), v, &v); \
> +})
> +
> +/**
> + * overflows_type - helper for checking the overflows between value, variables,
> + * or data type
> + *
> + * @n: source constant value or variable to be checked
> + * @T: destination variable or data type proposed to store @x
> + *
> + * Compares the @x expression for whether or not it can safely fit in
> + * the storage of the type in @T. @x and @T can have different types.
> + * If @x is a constant expression, this will also resolve to a constant
> + * expression.
> + *
> + * Returns: true if overflow can occur, false otherwise.
> + */
> +#define overflows_type(n, T) \
> + __builtin_choose_expr(__is_constexpr(n), \
> + __overflows_type_constexpr(n, T), \
> + __overflows_type(n, T))
> +
> +/**
> + * castable_to_type - like __same_type(), but also allows for casted literals
> + *
> + * @n: variable or constant value
> + * @T: variable or data type
> + *
> + * Unlike the __same_type() macro, this allows a constant value as the
> + * first argument. If this value would not overflow into an assignment
> + * of the second argument's type, it returns true. Otherwise, this falls
> + * back to __same_type().
> + */
> +#define castable_to_type(n, T) \
> + __builtin_choose_expr(__is_constexpr(n), \
> + !__overflows_type_constexpr(n, T), \
> + __same_type(n, T))
> +
> /**
> * size_mul() - Calculate size_t multiplication with saturation at SIZE_MAX
> * @factor1: first factor
> diff --git a/lib/Makefile b/lib/Makefile
> index 161d6a724ff7..452802d30718 100644
> --- a/lib/Makefile
> +++ b/lib/Makefile
> @@ -376,6 +376,7 @@ obj-$(CONFIG_CMDLINE_KUNIT_TEST) += cmdline_kunit.o
> obj-$(CONFIG_SLUB_KUNIT_TEST) += slub_kunit.o
> obj-$(CONFIG_MEMCPY_KUNIT_TEST) += memcpy_kunit.o
> obj-$(CONFIG_IS_SIGNED_TYPE_KUNIT_TEST) += is_signed_type_kunit.o
> +CFLAGS_overflow_kunit.o = $(call cc-disable-warning, tautological-constant-out-of-range-compare)
> obj-$(CONFIG_OVERFLOW_KUNIT_TEST) += overflow_kunit.o
> CFLAGS_stackinit_kunit.o += $(call cc-disable-warning, switch-unreachable)
> obj-$(CONFIG_STACKINIT_KUNIT_TEST) += stackinit_kunit.o
> diff --git a/lib/overflow_kunit.c b/lib/overflow_kunit.c
> index b8556a2e7bb1..dcd3ba102db6 100644
> --- a/lib/overflow_kunit.c
> +++ b/lib/overflow_kunit.c
> @@ -736,6 +736,384 @@ static void overflow_size_helpers_test(struct kunit *test)
> #undef check_one_size_helper
> }
>
> +static void overflows_type_test(struct kunit *test)
> +{
> + int count = 0;
> + unsigned int var;
> +
> +#define __TEST_OVERFLOWS_TYPE(func, arg1, arg2, of) do { \
> + bool __of = func(arg1, arg2); \
> + KUNIT_EXPECT_EQ_MSG(test, __of, of, \
> + "expected " #func "(" #arg1 ", " #arg2 " to%s overflow\n",\
> + of ? "" : " not"); \
> + count++; \
> +} while (0)
> +
> +/* Args are: first type, second type, value, overflow expected */
> +#define TEST_OVERFLOWS_TYPE(__t1, __t2, v, of) do { \
> + __t1 t1 = (v); \
> + __t2 t2; \
> + __TEST_OVERFLOWS_TYPE(__overflows_type, t1, t2, of); \
> + __TEST_OVERFLOWS_TYPE(__overflows_type, t1, __t2, of); \
> + __TEST_OVERFLOWS_TYPE(__overflows_type_constexpr, t1, t2, of); \
> + __TEST_OVERFLOWS_TYPE(__overflows_type_constexpr, t1, __t2, of);\
> +} while (0)
> +
> + TEST_OVERFLOWS_TYPE(u8, u8, U8_MAX, false);
> + TEST_OVERFLOWS_TYPE(u8, u16, U8_MAX, false);
> + TEST_OVERFLOWS_TYPE(u8, s8, U8_MAX, true);
> + TEST_OVERFLOWS_TYPE(u8, s8, S8_MAX, false);
> + TEST_OVERFLOWS_TYPE(u8, s8, (u8)S8_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(u8, s16, U8_MAX, false);
> + TEST_OVERFLOWS_TYPE(s8, u8, S8_MAX, false);
> + TEST_OVERFLOWS_TYPE(s8, u8, -1, true);
> + TEST_OVERFLOWS_TYPE(s8, u8, S8_MIN, true);
> + TEST_OVERFLOWS_TYPE(s8, u16, S8_MAX, false);
> + TEST_OVERFLOWS_TYPE(s8, u16, -1, true);
> + TEST_OVERFLOWS_TYPE(s8, u16, S8_MIN, true);
> + TEST_OVERFLOWS_TYPE(s8, u32, S8_MAX, false);
> + TEST_OVERFLOWS_TYPE(s8, u32, -1, true);
> + TEST_OVERFLOWS_TYPE(s8, u32, S8_MIN, true);
> +#if BITS_PER_LONG == 64
> + TEST_OVERFLOWS_TYPE(s8, u64, S8_MAX, false);
> + TEST_OVERFLOWS_TYPE(s8, u64, -1, true);
> + TEST_OVERFLOWS_TYPE(s8, u64, S8_MIN, true);
> +#endif
> + TEST_OVERFLOWS_TYPE(s8, s8, S8_MAX, false);
> + TEST_OVERFLOWS_TYPE(s8, s8, S8_MIN, false);
> + TEST_OVERFLOWS_TYPE(s8, s16, S8_MAX, false);
> + TEST_OVERFLOWS_TYPE(s8, s16, S8_MIN, false);
> + TEST_OVERFLOWS_TYPE(u16, u8, U8_MAX, false);
> + TEST_OVERFLOWS_TYPE(u16, u8, (u16)U8_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(u16, u8, U16_MAX, true);
> + TEST_OVERFLOWS_TYPE(u16, s8, S8_MAX, false);
> + TEST_OVERFLOWS_TYPE(u16, s8, (u16)S8_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(u16, s8, U16_MAX, true);
> + TEST_OVERFLOWS_TYPE(u16, s16, S16_MAX, false);
> + TEST_OVERFLOWS_TYPE(u16, s16, (u16)S16_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(u16, s16, U16_MAX, true);
> + TEST_OVERFLOWS_TYPE(u16, u32, U16_MAX, false);
> + TEST_OVERFLOWS_TYPE(u16, s32, U16_MAX, false);
> + TEST_OVERFLOWS_TYPE(s16, u8, U8_MAX, false);
> + TEST_OVERFLOWS_TYPE(s16, u8, (s16)U8_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(s16, u8, -1, true);
> + TEST_OVERFLOWS_TYPE(s16, u8, S16_MIN, true);
> + TEST_OVERFLOWS_TYPE(s16, u16, S16_MAX, false);
> + TEST_OVERFLOWS_TYPE(s16, u16, -1, true);
> + TEST_OVERFLOWS_TYPE(s16, u16, S16_MIN, true);
> + TEST_OVERFLOWS_TYPE(s16, u32, S16_MAX, false);
> + TEST_OVERFLOWS_TYPE(s16, u32, -1, true);
> + TEST_OVERFLOWS_TYPE(s16, u32, S16_MIN, true);
> +#if BITS_PER_LONG == 64
> + TEST_OVERFLOWS_TYPE(s16, u64, S16_MAX, false);
> + TEST_OVERFLOWS_TYPE(s16, u64, -1, true);
> + TEST_OVERFLOWS_TYPE(s16, u64, S16_MIN, true);
> +#endif
> + TEST_OVERFLOWS_TYPE(s16, s8, S8_MAX, false);
> + TEST_OVERFLOWS_TYPE(s16, s8, S8_MIN, false);
> + TEST_OVERFLOWS_TYPE(s16, s8, (s16)S8_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(s16, s8, (s16)S8_MIN - 1, true);
> + TEST_OVERFLOWS_TYPE(s16, s8, S16_MAX, true);
> + TEST_OVERFLOWS_TYPE(s16, s8, S16_MIN, true);
> + TEST_OVERFLOWS_TYPE(s16, s16, S16_MAX, false);
> + TEST_OVERFLOWS_TYPE(s16, s16, S16_MIN, false);
> + TEST_OVERFLOWS_TYPE(s16, s32, S16_MAX, false);
> + TEST_OVERFLOWS_TYPE(s16, s32, S16_MIN, false);
> + TEST_OVERFLOWS_TYPE(u32, u8, U8_MAX, false);
> + TEST_OVERFLOWS_TYPE(u32, u8, (u32)U8_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(u32, u8, U32_MAX, true);
> + TEST_OVERFLOWS_TYPE(u32, s8, S8_MAX, false);
> + TEST_OVERFLOWS_TYPE(u32, s8, (u32)S8_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(u32, s8, U32_MAX, true);
> + TEST_OVERFLOWS_TYPE(u32, u16, U16_MAX, false);
> + TEST_OVERFLOWS_TYPE(u32, u16, U16_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(u32, u16, U32_MAX, true);
> + TEST_OVERFLOWS_TYPE(u32, s16, S16_MAX, false);
> + TEST_OVERFLOWS_TYPE(u32, s16, (u32)S16_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(u32, s16, U32_MAX, true);
> + TEST_OVERFLOWS_TYPE(u32, u32, U32_MAX, false);
> + TEST_OVERFLOWS_TYPE(u32, s32, S32_MAX, false);
> + TEST_OVERFLOWS_TYPE(u32, s32, U32_MAX, true);
> + TEST_OVERFLOWS_TYPE(u32, s32, (u32)S32_MAX + 1, true);
> +#if BITS_PER_LONG == 64
> + TEST_OVERFLOWS_TYPE(u32, u64, U32_MAX, false);
> + TEST_OVERFLOWS_TYPE(u32, s64, U32_MAX, false);
> +#endif
> + TEST_OVERFLOWS_TYPE(s32, u8, U8_MAX, false);
> + TEST_OVERFLOWS_TYPE(s32, u8, (s32)U8_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(s32, u16, S32_MAX, true);
> + TEST_OVERFLOWS_TYPE(s32, u8, -1, true);
> + TEST_OVERFLOWS_TYPE(s32, u8, S32_MIN, true);
> + TEST_OVERFLOWS_TYPE(s32, u16, U16_MAX, false);
> + TEST_OVERFLOWS_TYPE(s32, u16, (s32)U16_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(s32, u16, S32_MAX, true);
> + TEST_OVERFLOWS_TYPE(s32, u16, -1, true);
> + TEST_OVERFLOWS_TYPE(s32, u16, S32_MIN, true);
> + TEST_OVERFLOWS_TYPE(s32, u32, S32_MAX, false);
> + TEST_OVERFLOWS_TYPE(s32, u32, -1, true);
> + TEST_OVERFLOWS_TYPE(s32, u32, S32_MIN, true);
> +#if BITS_PER_LONG == 64
> + TEST_OVERFLOWS_TYPE(s32, u64, S32_MAX, false);
> + TEST_OVERFLOWS_TYPE(s32, u64, -1, true);
> + TEST_OVERFLOWS_TYPE(s32, u64, S32_MIN, true);
> +#endif
> + TEST_OVERFLOWS_TYPE(s32, s8, S8_MAX, false);
> + TEST_OVERFLOWS_TYPE(s32, s8, S8_MIN, false);
> + TEST_OVERFLOWS_TYPE(s32, s8, (s32)S8_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(s32, s8, (s32)S8_MIN - 1, true);
> + TEST_OVERFLOWS_TYPE(s32, s8, S32_MAX, true);
> + TEST_OVERFLOWS_TYPE(s32, s8, S32_MIN, true);
> + TEST_OVERFLOWS_TYPE(s32, s16, S16_MAX, false);
> + TEST_OVERFLOWS_TYPE(s32, s16, S16_MIN, false);
> + TEST_OVERFLOWS_TYPE(s32, s16, (s32)S16_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(s32, s16, (s32)S16_MIN - 1, true);
> + TEST_OVERFLOWS_TYPE(s32, s16, S32_MAX, true);
> + TEST_OVERFLOWS_TYPE(s32, s16, S32_MIN, true);
> + TEST_OVERFLOWS_TYPE(s32, s32, S32_MAX, false);
> + TEST_OVERFLOWS_TYPE(s32, s32, S32_MIN, false);
> +#if BITS_PER_LONG == 64
> + TEST_OVERFLOWS_TYPE(s32, s64, S32_MAX, false);
> + TEST_OVERFLOWS_TYPE(s32, s64, S32_MIN, false);
> + TEST_OVERFLOWS_TYPE(u64, u8, U64_MAX, true);
> + TEST_OVERFLOWS_TYPE(u64, u8, U8_MAX, false);
> + TEST_OVERFLOWS_TYPE(u64, u8, (u64)U8_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(u64, u16, U64_MAX, true);
> + TEST_OVERFLOWS_TYPE(u64, u16, U16_MAX, false);
> + TEST_OVERFLOWS_TYPE(u64, u16, (u64)U16_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(u64, u32, U64_MAX, true);
> + TEST_OVERFLOWS_TYPE(u64, u32, U32_MAX, false);
> + TEST_OVERFLOWS_TYPE(u64, u32, (u64)U32_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(u64, u64, U64_MAX, false);
> + TEST_OVERFLOWS_TYPE(u64, s8, S8_MAX, false);
> + TEST_OVERFLOWS_TYPE(u64, s8, (u64)S8_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(u64, s8, U64_MAX, true);
> + TEST_OVERFLOWS_TYPE(u64, s16, S16_MAX, false);
> + TEST_OVERFLOWS_TYPE(u64, s16, (u64)S16_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(u64, s16, U64_MAX, true);
> + TEST_OVERFLOWS_TYPE(u64, s32, S32_MAX, false);
> + TEST_OVERFLOWS_TYPE(u64, s32, (u64)S32_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(u64, s32, U64_MAX, true);
> + TEST_OVERFLOWS_TYPE(u64, s64, S64_MAX, false);
> + TEST_OVERFLOWS_TYPE(u64, s64, U64_MAX, true);
> + TEST_OVERFLOWS_TYPE(u64, s64, (u64)S64_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(s64, u8, S64_MAX, true);
> + TEST_OVERFLOWS_TYPE(s64, u8, S64_MIN, true);
> + TEST_OVERFLOWS_TYPE(s64, u8, -1, true);
> + TEST_OVERFLOWS_TYPE(s64, u8, U8_MAX, false);
> + TEST_OVERFLOWS_TYPE(s64, u8, (s64)U8_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(s64, u16, S64_MAX, true);
> + TEST_OVERFLOWS_TYPE(s64, u16, S64_MIN, true);
> + TEST_OVERFLOWS_TYPE(s64, u16, -1, true);
> + TEST_OVERFLOWS_TYPE(s64, u16, U16_MAX, false);
> + TEST_OVERFLOWS_TYPE(s64, u16, (s64)U16_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(s64, u32, S64_MAX, true);
> + TEST_OVERFLOWS_TYPE(s64, u32, S64_MIN, true);
> + TEST_OVERFLOWS_TYPE(s64, u32, -1, true);
> + TEST_OVERFLOWS_TYPE(s64, u32, U32_MAX, false);
> + TEST_OVERFLOWS_TYPE(s64, u32, (s64)U32_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(s64, u64, S64_MAX, false);
> + TEST_OVERFLOWS_TYPE(s64, u64, S64_MIN, true);
> + TEST_OVERFLOWS_TYPE(s64, u64, -1, true);
> + TEST_OVERFLOWS_TYPE(s64, s8, S8_MAX, false);
> + TEST_OVERFLOWS_TYPE(s64, s8, S8_MIN, false);
> + TEST_OVERFLOWS_TYPE(s64, s8, (s64)S8_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(s64, s8, (s64)S8_MIN - 1, true);
> + TEST_OVERFLOWS_TYPE(s64, s8, S64_MAX, true);
> + TEST_OVERFLOWS_TYPE(s64, s16, S16_MAX, false);
> + TEST_OVERFLOWS_TYPE(s64, s16, S16_MIN, false);
> + TEST_OVERFLOWS_TYPE(s64, s16, (s64)S16_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(s64, s16, (s64)S16_MIN - 1, true);
> + TEST_OVERFLOWS_TYPE(s64, s16, S64_MAX, true);
> + TEST_OVERFLOWS_TYPE(s64, s32, S32_MAX, false);
> + TEST_OVERFLOWS_TYPE(s64, s32, S32_MIN, false);
> + TEST_OVERFLOWS_TYPE(s64, s32, (s64)S32_MAX + 1, true);
> + TEST_OVERFLOWS_TYPE(s64, s32, (s64)S32_MIN - 1, true);
> + TEST_OVERFLOWS_TYPE(s64, s32, S64_MAX, true);
> + TEST_OVERFLOWS_TYPE(s64, s64, S64_MAX, false);
> + TEST_OVERFLOWS_TYPE(s64, s64, S64_MIN, false);
> +#endif
> +
> + /* Check for macro side-effects. */
> + var = INT_MAX - 1;
> + __TEST_OVERFLOWS_TYPE(__overflows_type, var++, int, false);
> + __TEST_OVERFLOWS_TYPE(__overflows_type, var++, int, false);
> + __TEST_OVERFLOWS_TYPE(__overflows_type, var++, int, true);
> + var = INT_MAX - 1;
> + __TEST_OVERFLOWS_TYPE(overflows_type, var++, int, false);
> + __TEST_OVERFLOWS_TYPE(overflows_type, var++, int, false);
> + __TEST_OVERFLOWS_TYPE(overflows_type, var++, int, true);
> +
> + kunit_info(test, "%d overflows_type() tests finished\n", count);
> +#undef TEST_OVERFLOWS_TYPE
> +#undef __TEST_OVERFLOWS_TYPE
> +}
> +
> +static void same_type_test(struct kunit *test)
> +{
> + int count = 0;
> + int var;
> +
> +#define TEST_SAME_TYPE(t1, t2, same) do { \
> + typeof(t1) __t1h = type_max(t1); \
> + typeof(t1) __t1l = type_min(t1); \
> + typeof(t2) __t2h = type_max(t2); \
> + typeof(t2) __t2l = type_min(t2); \
> + KUNIT_EXPECT_EQ(test, true, __same_type(t1, __t1h)); \
> + KUNIT_EXPECT_EQ(test, true, __same_type(t1, __t1l)); \
> + KUNIT_EXPECT_EQ(test, true, __same_type(__t1h, t1)); \
> + KUNIT_EXPECT_EQ(test, true, __same_type(__t1l, t1)); \
> + KUNIT_EXPECT_EQ(test, true, __same_type(t2, __t2h)); \
> + KUNIT_EXPECT_EQ(test, true, __same_type(t2, __t2l)); \
> + KUNIT_EXPECT_EQ(test, true, __same_type(__t2h, t2)); \
> + KUNIT_EXPECT_EQ(test, true, __same_type(__t2l, t2)); \
> + KUNIT_EXPECT_EQ(test, same, __same_type(t1, t2)); \
> + KUNIT_EXPECT_EQ(test, same, __same_type(t2, __t1h)); \
> + KUNIT_EXPECT_EQ(test, same, __same_type(t2, __t1l)); \
> + KUNIT_EXPECT_EQ(test, same, __same_type(__t1h, t2)); \
> + KUNIT_EXPECT_EQ(test, same, __same_type(__t1l, t2)); \
> + KUNIT_EXPECT_EQ(test, same, __same_type(t1, __t2h)); \
> + KUNIT_EXPECT_EQ(test, same, __same_type(t1, __t2l)); \
> + KUNIT_EXPECT_EQ(test, same, __same_type(__t2h, t1)); \
> + KUNIT_EXPECT_EQ(test, same, __same_type(__t2l, t1)); \
> +} while (0)
> +
> +#if BITS_PER_LONG == 64
> +# define TEST_SAME_TYPE64(base, t, m) TEST_SAME_TYPE(base, t, m)
> +#else
> +# define TEST_SAME_TYPE64(base, t, m) do { } while (0)
> +#endif
> +
> +#define TEST_TYPE_SETS(base, mu8, mu16, mu32, ms8, ms16, ms32, mu64, ms64) \
> +do { \
> + TEST_SAME_TYPE(base, u8, mu8); \
> + TEST_SAME_TYPE(base, u16, mu16); \
> + TEST_SAME_TYPE(base, u32, mu32); \
> + TEST_SAME_TYPE(base, s8, ms8); \
> + TEST_SAME_TYPE(base, s16, ms16); \
> + TEST_SAME_TYPE(base, s32, ms32); \
> + TEST_SAME_TYPE64(base, u64, mu64); \
> + TEST_SAME_TYPE64(base, s64, ms64); \
> +} while (0)
> +
> + TEST_TYPE_SETS(u8, true, false, false, false, false, false, false, false);
> + TEST_TYPE_SETS(u16, false, true, false, false, false, false, false, false);
> + TEST_TYPE_SETS(u32, false, false, true, false, false, false, false, false);
> + TEST_TYPE_SETS(s8, false, false, false, true, false, false, false, false);
> + TEST_TYPE_SETS(s16, false, false, false, false, true, false, false, false);
> + TEST_TYPE_SETS(s32, false, false, false, false, false, true, false, false);
> +#if BITS_PER_LONG == 64
> + TEST_TYPE_SETS(u64, false, false, false, false, false, false, true, false);
> + TEST_TYPE_SETS(s64, false, false, false, false, false, false, false, true);
> +#endif
> +
> + /* Check for macro side-effects. */
> + var = 4;
> + KUNIT_EXPECT_EQ(test, var, 4);
> + KUNIT_EXPECT_TRUE(test, __same_type(var++, int));
> + KUNIT_EXPECT_EQ(test, var, 4);
> + KUNIT_EXPECT_TRUE(test, __same_type(int, var++));
> + KUNIT_EXPECT_EQ(test, var, 4);
> + KUNIT_EXPECT_TRUE(test, __same_type(var++, var++));
> + KUNIT_EXPECT_EQ(test, var, 4);
> +
> + kunit_info(test, "%d __same_type() tests finished\n", count);
> +
> +#undef TEST_TYPE_SETS
> +#undef TEST_SAME_TYPE64
> +#undef TEST_SAME_TYPE
> +}
> +
> +static void castable_to_type_test(struct kunit *test)
> +{
> + int count = 0;
> +
> +#define TEST_CASTABLE_TO_TYPE(arg1, arg2, pass) do { \
> + bool __pass = castable_to_type(arg1, arg2); \
> + KUNIT_EXPECT_EQ_MSG(test, __pass, pass, \
> + "expected castable_to_type(" #arg1 ", " #arg2 ") to%s pass\n",\
> + pass ? "" : " not"); \
> + count++; \
> +} while (0)
> +
> + TEST_CASTABLE_TO_TYPE(16, u8, true);
> + TEST_CASTABLE_TO_TYPE(16, u16, true);
> + TEST_CASTABLE_TO_TYPE(16, u32, true);
> + TEST_CASTABLE_TO_TYPE(16, s8, true);
> + TEST_CASTABLE_TO_TYPE(16, s16, true);
> + TEST_CASTABLE_TO_TYPE(16, s32, true);
> + TEST_CASTABLE_TO_TYPE(-16, s8, true);
> + TEST_CASTABLE_TO_TYPE(-16, s16, true);
> + TEST_CASTABLE_TO_TYPE(-16, s32, true);
> +#if BITS_PER_LONG == 64
> + TEST_CASTABLE_TO_TYPE(16, u64, true);
> + TEST_CASTABLE_TO_TYPE(-16, s64, true);
> +#endif
> +
> +#define TEST_CASTABLE_TO_TYPE_VAR(width) do { \
> + u ## width u ## width ## var = 0; \
> + s ## width s ## width ## var = 0; \
> + \
> + /* Constant expressions that fit types. */ \
> + TEST_CASTABLE_TO_TYPE(type_max(u ## width), u ## width, true); \
> + TEST_CASTABLE_TO_TYPE(type_min(u ## width), u ## width, true); \
> + TEST_CASTABLE_TO_TYPE(type_max(u ## width), u ## width ## var, true); \
> + TEST_CASTABLE_TO_TYPE(type_min(u ## width), u ## width ## var, true); \
> + TEST_CASTABLE_TO_TYPE(type_max(s ## width), s ## width, true); \
> + TEST_CASTABLE_TO_TYPE(type_min(s ## width), s ## width, true); \
> + TEST_CASTABLE_TO_TYPE(type_max(s ## width), s ## width ## var, true); \
> + TEST_CASTABLE_TO_TYPE(type_min(u ## width), s ## width ## var, true); \
> + /* Constant expressions that do not fit types. */ \
> + TEST_CASTABLE_TO_TYPE(type_max(u ## width), s ## width, false); \
> + TEST_CASTABLE_TO_TYPE(type_max(u ## width), s ## width ## var, false); \
> + TEST_CASTABLE_TO_TYPE(type_min(s ## width), u ## width, false); \
> + TEST_CASTABLE_TO_TYPE(type_min(s ## width), u ## width ## var, false); \
> + /* Non-constant expression with mismatched type. */ \
> + TEST_CASTABLE_TO_TYPE(s ## width ## var, u ## width, false); \
> + TEST_CASTABLE_TO_TYPE(u ## width ## var, s ## width, false); \
> +} while (0)
> +
> +#define TEST_CASTABLE_TO_TYPE_RANGE(width) do { \
> + unsigned long big = U ## width ## _MAX; \
> + signed long small = S ## width ## _MIN; \
> + u ## width u ## width ## var = 0; \
> + s ## width s ## width ## var = 0; \
> + \
> + /* Constant expression in range. */ \
> + TEST_CASTABLE_TO_TYPE(U ## width ## _MAX, u ## width, true); \
> + TEST_CASTABLE_TO_TYPE(U ## width ## _MAX, u ## width ## var, true); \
> + TEST_CASTABLE_TO_TYPE(S ## width ## _MIN, s ## width, true); \
> + TEST_CASTABLE_TO_TYPE(S ## width ## _MIN, s ## width ## var, true); \
> + /* Constant expression out of range. */ \
> + TEST_CASTABLE_TO_TYPE((unsigned long)U ## width ## _MAX + 1, u ## width, false); \
> + TEST_CASTABLE_TO_TYPE((unsigned long)U ## width ## _MAX + 1, u ## width ## var, false); \
> + TEST_CASTABLE_TO_TYPE((signed long)S ## width ## _MIN - 1, s ## width, false); \
> + TEST_CASTABLE_TO_TYPE((signed long)S ## width ## _MIN - 1, s ## width ## var, false); \
> + /* Non-constant expression with mismatched type. */ \
> + TEST_CASTABLE_TO_TYPE(big, u ## width, false); \
> + TEST_CASTABLE_TO_TYPE(big, u ## width ## var, false); \
> + TEST_CASTABLE_TO_TYPE(small, s ## width, false); \
> + TEST_CASTABLE_TO_TYPE(small, s ## width ## var, false); \
> +} while (0)
> +
> + TEST_CASTABLE_TO_TYPE_VAR(8);
> + TEST_CASTABLE_TO_TYPE_VAR(16);
> + TEST_CASTABLE_TO_TYPE_VAR(32);
> +#if BITS_PER_LONG == 64
> + TEST_CASTABLE_TO_TYPE_VAR(64);
> +#endif
> +
> + TEST_CASTABLE_TO_TYPE_RANGE(8);
> + TEST_CASTABLE_TO_TYPE_RANGE(16);
> +#if BITS_PER_LONG == 64
> + TEST_CASTABLE_TO_TYPE_RANGE(32);
> +#endif
> + kunit_info(test, "%d castable_to_type() tests finished\n", count);
> +
> +#undef TEST_CASTABLE_TO_TYPE_RANGE
> +#undef TEST_CASTABLE_TO_TYPE_VAR
> +#undef TEST_CASTABLE_TO_TYPE
> +}
> +
> static struct kunit_case overflow_test_cases[] = {
> KUNIT_CASE(u8_u8__u8_overflow_test),
> KUNIT_CASE(s8_s8__s8_overflow_test),
> @@ -755,6 +1133,9 @@ static struct kunit_case overflow_test_cases[] = {
> KUNIT_CASE(shift_nonsense_test),
> KUNIT_CASE(overflow_allocation_test),
> KUNIT_CASE(overflow_size_helpers_test),
> + KUNIT_CASE(overflows_type_test),
> + KUNIT_CASE(same_type_test),
> + KUNIT_CASE(castable_to_type_test),
> {}
> };
>
^ permalink raw reply [flat|nested] 18+ messages in thread
* [Intel-gfx] [PATCH v14 2/7] drm/i915/gem: Typecheck page lookups
2022-11-02 14:53 [Intel-gfx] [PATCH v14 0/7] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun
2022-11-02 14:53 ` [Intel-gfx] [PATCH v14 1/7] overflow: Introduce overflows_type() and castable_to_type() Gwan-gyeong Mun
@ 2022-11-02 14:53 ` Gwan-gyeong Mun
2022-11-02 14:53 ` [Intel-gfx] [PATCH v14 3/7] drm/i915: Check for integer truncation on scatterlist creation Gwan-gyeong Mun
` (10 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Gwan-gyeong Mun @ 2022-11-02 14:53 UTC (permalink / raw)
To: intel-gfx
Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld,
mchehab, nirmoy.das
From: Chris Wilson <chris@chris-wilson.co.uk>
We need to check that we avoid integer overflows when looking up a page,
and so fix all the instances where we have mistakenly used a plain
integer instead of a more suitable long. Be pedantic and add integer
typechecking to the lookup so that we can be sure that we are safe.
And it also uses pgoff_t as our page lookups must remain compatible with
the page cache, pgoff_t is currently exactly unsigned long.
v2: Move added i915_utils's macro into drm_util header (Jani N)
v3: Make not use the same macro name on a function. (Mauro)
For kernel-doc, macros and functions are handled in the same namespace,
the same macro name on a function prevents ever adding documentation
for it.
v4: Add kernel-doc markups to the kAPI functions and macros (Mauoro)
v5: Fix an alignment to match open parenthesis
v6: Rebase
v10: Use assert_typable instead of exactly_pgoff_t() macro. (Kees)
v11: Change the use of assert_typable to assert_same_typable (G.G)
v12: Change to use static_assert(__castable_to_type(n ,T)) style since
the assert_same_typable() macro has been dropped. (G.G)
v13: Change the use of __castable_to_type() to castable_to_type()
Remove an unnecessary header include line. (G.G)
Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Kees Cook <keescook@chromium.org>
Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com> (v2)
Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org> (v3)
Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com> (v5)
---
drivers/gpu/drm/i915/gem/i915_gem_object.c | 7 +-
drivers/gpu/drm/i915/gem/i915_gem_object.h | 293 ++++++++++++++++--
drivers/gpu/drm/i915/gem/i915_gem_pages.c | 27 +-
drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 2 +-
.../drm/i915/gem/selftests/i915_gem_context.c | 12 +-
.../drm/i915/gem/selftests/i915_gem_mman.c | 8 +-
.../drm/i915/gem/selftests/i915_gem_object.c | 8 +-
drivers/gpu/drm/i915/i915_gem.c | 18 +-
drivers/gpu/drm/i915/i915_vma.c | 8 +-
9 files changed, 322 insertions(+), 61 deletions(-)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object.c b/drivers/gpu/drm/i915/gem/i915_gem_object.c
index 733696057761..c04206aac862 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_object.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_object.c
@@ -427,10 +427,11 @@ void __i915_gem_object_invalidate_frontbuffer(struct drm_i915_gem_object *obj,
static void
i915_gem_object_read_from_page_kmap(struct drm_i915_gem_object *obj, u64 offset, void *dst, int size)
{
+ pgoff_t idx = offset >> PAGE_SHIFT;
void *src_map;
void *src_ptr;
- src_map = kmap_atomic(i915_gem_object_get_page(obj, offset >> PAGE_SHIFT));
+ src_map = kmap_atomic(i915_gem_object_get_page(obj, idx));
src_ptr = src_map + offset_in_page(offset);
if (!(obj->cache_coherent & I915_BO_CACHE_COHERENT_FOR_READ))
@@ -443,9 +444,10 @@ i915_gem_object_read_from_page_kmap(struct drm_i915_gem_object *obj, u64 offset,
static void
i915_gem_object_read_from_page_iomap(struct drm_i915_gem_object *obj, u64 offset, void *dst, int size)
{
+ pgoff_t idx = offset >> PAGE_SHIFT;
+ dma_addr_t dma = i915_gem_object_get_dma_address(obj, idx);
void __iomem *src_map;
void __iomem *src_ptr;
- dma_addr_t dma = i915_gem_object_get_dma_address(obj, offset >> PAGE_SHIFT);
src_map = io_mapping_map_wc(&obj->mm.region->iomap,
dma - obj->mm.region->region.start,
@@ -484,6 +486,7 @@ static bool object_has_mappable_iomem(struct drm_i915_gem_object *obj)
*/
int i915_gem_object_read_from_page(struct drm_i915_gem_object *obj, u64 offset, void *dst, int size)
{
+ GEM_BUG_ON(overflows_type(offset >> PAGE_SHIFT, pgoff_t));
GEM_BUG_ON(offset >= obj->base.size);
GEM_BUG_ON(offset_in_page(offset) > PAGE_SIZE - size);
GEM_BUG_ON(!i915_gem_object_has_pinned_pages(obj));
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object.h b/drivers/gpu/drm/i915/gem/i915_gem_object.h
index 6b9ecff42bb5..55817d287676 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_object.h
+++ b/drivers/gpu/drm/i915/gem/i915_gem_object.h
@@ -27,8 +27,10 @@ enum intel_region_id;
* spot such a local variable, please consider fixing!
*
* Aside from our own locals (for which we have no excuse!):
- * - sg_table embeds unsigned int for num_pages
- * - get_user_pages*() mixed ints with longs
+ * - sg_table embeds unsigned int for nents
+ *
+ * We can check for invalidly typed locals with typecheck(), see for example
+ * i915_gem_object_get_sg().
*/
#define GEM_CHECK_SIZE_OVERFLOW(sz) \
GEM_WARN_ON((sz) >> PAGE_SHIFT > INT_MAX)
@@ -363,44 +365,289 @@ i915_gem_object_get_tile_row_size(const struct drm_i915_gem_object *obj)
int i915_gem_object_set_tiling(struct drm_i915_gem_object *obj,
unsigned int tiling, unsigned int stride);
+/**
+ * __i915_gem_object_page_iter_get_sg - helper to find the target scatterlist
+ * pointer and the target page position using pgoff_t n input argument and
+ * i915_gem_object_page_iter
+ * @obj: i915 GEM buffer object
+ * @iter: i915 GEM buffer object page iterator
+ * @n: page offset
+ * @offset: searched physical offset,
+ * it will be used for returning physical page offset value
+ *
+ * Context: Takes and releases the mutex lock of the i915_gem_object_page_iter.
+ * Takes and releases the RCU lock to search the radix_tree of
+ * i915_gem_object_page_iter.
+ *
+ * Returns:
+ * The target scatterlist pointer and the target page position.
+ *
+ * Recommended to use wrapper macro: i915_gem_object_page_iter_get_sg()
+ */
struct scatterlist *
-__i915_gem_object_get_sg(struct drm_i915_gem_object *obj,
- struct i915_gem_object_page_iter *iter,
- unsigned int n,
- unsigned int *offset, bool dma);
+__i915_gem_object_page_iter_get_sg(struct drm_i915_gem_object *obj,
+ struct i915_gem_object_page_iter *iter,
+ pgoff_t n,
+ unsigned int *offset);
+/**
+ * i915_gem_object_page_iter_get_sg - wrapper macro for
+ * __i915_gem_object_page_iter_get_sg()
+ * @obj: i915 GEM buffer object
+ * @it: i915 GEM buffer object page iterator
+ * @n: page offset
+ * @offset: searched physical offset,
+ * it will be used for returning physical page offset value
+ *
+ * Context: Takes and releases the mutex lock of the i915_gem_object_page_iter.
+ * Takes and releases the RCU lock to search the radix_tree of
+ * i915_gem_object_page_iter.
+ *
+ * Returns:
+ * The target scatterlist pointer and the target page position.
+ *
+ * In order to avoid the truncation of the input parameter, it checks the page
+ * offset n's type from the input parameter before calling
+ * __i915_gem_object_page_iter_get_sg().
+ */
+#define i915_gem_object_page_iter_get_sg(obj, it, n, offset) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_page_iter_get_sg(obj, it, n, offset); \
+})
+
+/**
+ * __i915_gem_object_get_sg - helper to find the target scatterlist
+ * pointer and the target page position using pgoff_t n input argument and
+ * drm_i915_gem_object. It uses an internal shmem scatterlist lookup function.
+ * @obj: i915 GEM buffer object
+ * @n: page offset
+ * @offset: searched physical offset,
+ * it will be used for returning physical page offset value
+ *
+ * It uses drm_i915_gem_object's internal shmem scatterlist lookup function as
+ * i915_gem_object_page_iter and calls __i915_gem_object_page_iter_get_sg().
+ *
+ * Returns:
+ * The target scatterlist pointer and the target page position.
+ *
+ * Recommended to use wrapper macro: i915_gem_object_get_sg()
+ * See also __i915_gem_object_page_iter_get_sg()
+ */
static inline struct scatterlist *
-i915_gem_object_get_sg(struct drm_i915_gem_object *obj,
- unsigned int n,
- unsigned int *offset)
+__i915_gem_object_get_sg(struct drm_i915_gem_object *obj, pgoff_t n,
+ unsigned int *offset)
{
- return __i915_gem_object_get_sg(obj, &obj->mm.get_page, n, offset, false);
+ return __i915_gem_object_page_iter_get_sg(obj, &obj->mm.get_page, n, offset);
}
+/**
+ * i915_gem_object_get_sg - wrapper macro for __i915_gem_object_get_sg()
+ * @obj: i915 GEM buffer object
+ * @n: page offset
+ * @offset: searched physical offset,
+ * it will be used for returning physical page offset value
+ *
+ * Returns:
+ * The target scatterlist pointer and the target page position.
+ *
+ * In order to avoid the truncation of the input parameter, it checks the page
+ * offset n's type from the input parameter before calling
+ * __i915_gem_object_get_sg().
+ * See also __i915_gem_object_page_iter_get_sg()
+ */
+#define i915_gem_object_get_sg(obj, n, offset) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_sg(obj, n, offset); \
+})
+
+/**
+ * __i915_gem_object_get_sg_dma - helper to find the target scatterlist
+ * pointer and the target page position using pgoff_t n input argument and
+ * drm_i915_gem_object. It uses an internal DMA mapped scatterlist lookup function
+ * @obj: i915 GEM buffer object
+ * @n: page offset
+ * @offset: searched physical offset,
+ * it will be used for returning physical page offset value
+ *
+ * It uses drm_i915_gem_object's internal DMA mapped scatterlist lookup function
+ * as i915_gem_object_page_iter and calls __i915_gem_object_page_iter_get_sg().
+ *
+ * Returns:
+ * The target scatterlist pointer and the target page position.
+ *
+ * Recommended to use wrapper macro: i915_gem_object_get_sg_dma()
+ * See also __i915_gem_object_page_iter_get_sg()
+ */
static inline struct scatterlist *
-i915_gem_object_get_sg_dma(struct drm_i915_gem_object *obj,
- unsigned int n,
- unsigned int *offset)
+__i915_gem_object_get_sg_dma(struct drm_i915_gem_object *obj, pgoff_t n,
+ unsigned int *offset)
{
- return __i915_gem_object_get_sg(obj, &obj->mm.get_dma_page, n, offset, true);
+ return __i915_gem_object_page_iter_get_sg(obj, &obj->mm.get_dma_page, n, offset);
}
+/**
+ * i915_gem_object_get_sg_dma - wrapper macro for __i915_gem_object_get_sg_dma()
+ * @obj: i915 GEM buffer object
+ * @n: page offset
+ * @offset: searched physical offset,
+ * it will be used for returning physical page offset value
+ *
+ * Returns:
+ * The target scatterlist pointer and the target page position.
+ *
+ * In order to avoid the truncation of the input parameter, it checks the page
+ * offset n's type from the input parameter before calling
+ * __i915_gem_object_get_sg_dma().
+ * See also __i915_gem_object_page_iter_get_sg()
+ */
+#define i915_gem_object_get_sg_dma(obj, n, offset) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_sg_dma(obj, n, offset); \
+})
+
+/**
+ * __i915_gem_object_get_page - helper to find the target page with a page offset
+ * @obj: i915 GEM buffer object
+ * @n: page offset
+ *
+ * It uses drm_i915_gem_object's internal shmem scatterlist lookup function as
+ * i915_gem_object_page_iter and calls __i915_gem_object_page_iter_get_sg()
+ * internally.
+ *
+ * Returns:
+ * The target page pointer.
+ *
+ * Recommended to use wrapper macro: i915_gem_object_get_page()
+ * See also __i915_gem_object_page_iter_get_sg()
+ */
struct page *
-i915_gem_object_get_page(struct drm_i915_gem_object *obj,
- unsigned int n);
+__i915_gem_object_get_page(struct drm_i915_gem_object *obj, pgoff_t n);
+/**
+ * i915_gem_object_get_page - wrapper macro for __i915_gem_object_get_page
+ * @obj: i915 GEM buffer object
+ * @n: page offset
+ *
+ * Returns:
+ * The target page pointer.
+ *
+ * In order to avoid the truncation of the input parameter, it checks the page
+ * offset n's type from the input parameter before calling
+ * __i915_gem_object_get_page().
+ * See also __i915_gem_object_page_iter_get_sg()
+ */
+#define i915_gem_object_get_page(obj, n) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_page(obj, n); \
+})
+
+/**
+ * __i915_gem_object_get_dirty_page - helper to find the target page with a page
+ * offset
+ * @obj: i915 GEM buffer object
+ * @n: page offset
+ *
+ * It works like i915_gem_object_get_page(), but it marks the returned page dirty.
+ *
+ * Returns:
+ * The target page pointer.
+ *
+ * Recommended to use wrapper macro: i915_gem_object_get_dirty_page()
+ * See also __i915_gem_object_page_iter_get_sg() and __i915_gem_object_get_page()
+ */
struct page *
-i915_gem_object_get_dirty_page(struct drm_i915_gem_object *obj,
- unsigned int n);
+__i915_gem_object_get_dirty_page(struct drm_i915_gem_object *obj, pgoff_t n);
+
+/**
+ * i915_gem_object_get_dirty_page - wrapper macro for __i915_gem_object_get_dirty_page
+ * @obj: i915 GEM buffer object
+ * @n: page offset
+ *
+ * Returns:
+ * The target page pointer.
+ *
+ * In order to avoid the truncation of the input parameter, it checks the page
+ * offset n's type from the input parameter before calling
+ * __i915_gem_object_get_dirty_page().
+ * See also __i915_gem_object_page_iter_get_sg() and __i915_gem_object_get_page()
+ */
+#define i915_gem_object_get_dirty_page(obj, n) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_dirty_page(obj, n); \
+})
+/**
+ * __i915_gem_object_get_dma_address_len - helper to get bus addresses of
+ * targeted DMA mapped scatterlist from i915 GEM buffer object and it's length
+ * @obj: i915 GEM buffer object
+ * @n: page offset
+ * @len: DMA mapped scatterlist's DMA bus addresses length to return
+ *
+ * Returns:
+ * Bus addresses of targeted DMA mapped scatterlist
+ *
+ * Recommended to use wrapper macro: i915_gem_object_get_dma_address_len()
+ * See also __i915_gem_object_page_iter_get_sg() and __i915_gem_object_get_sg_dma()
+ */
dma_addr_t
-i915_gem_object_get_dma_address_len(struct drm_i915_gem_object *obj,
- unsigned long n,
- unsigned int *len);
+__i915_gem_object_get_dma_address_len(struct drm_i915_gem_object *obj, pgoff_t n,
+ unsigned int *len);
+/**
+ * i915_gem_object_get_dma_address_len - wrapper macro for
+ * __i915_gem_object_get_dma_address_len
+ * @obj: i915 GEM buffer object
+ * @n: page offset
+ * @len: DMA mapped scatterlist's DMA bus addresses length to return
+ *
+ * Returns:
+ * Bus addresses of targeted DMA mapped scatterlist
+ *
+ * In order to avoid the truncation of the input parameter, it checks the page
+ * offset n's type from the input parameter before calling
+ * __i915_gem_object_get_dma_address_len().
+ * See also __i915_gem_object_page_iter_get_sg() and
+ * __i915_gem_object_get_dma_address_len()
+ */
+#define i915_gem_object_get_dma_address_len(obj, n, len) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_dma_address_len(obj, n, len); \
+})
+
+/**
+ * __i915_gem_object_get_dma_address - helper to get bus addresses of
+ * targeted DMA mapped scatterlist from i915 GEM buffer object
+ * @obj: i915 GEM buffer object
+ * @n: page offset
+ *
+ * Returns:
+ * Bus addresses of targeted DMA mapped scatterlis
+ *
+ * Recommended to use wrapper macro: i915_gem_object_get_dma_address()
+ * See also __i915_gem_object_page_iter_get_sg() and __i915_gem_object_get_sg_dma()
+ */
dma_addr_t
-i915_gem_object_get_dma_address(struct drm_i915_gem_object *obj,
- unsigned long n);
+__i915_gem_object_get_dma_address(struct drm_i915_gem_object *obj, pgoff_t n);
+
+/**
+ * i915_gem_object_get_dma_address - wrapper macro for
+ * __i915_gem_object_get_dma_address
+ * @obj: i915 GEM buffer object
+ * @n: page offset
+ *
+ * Returns:
+ * Bus addresses of targeted DMA mapped scatterlist
+ *
+ * In order to avoid the truncation of the input parameter, it checks the page
+ * offset n's type from the input parameter before calling
+ * __i915_gem_object_get_dma_address().
+ * See also __i915_gem_object_page_iter_get_sg() and
+ * __i915_gem_object_get_dma_address()
+ */
+#define i915_gem_object_get_dma_address(obj, n) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_dma_address(obj, n); \
+})
void __i915_gem_object_set_pages(struct drm_i915_gem_object *obj,
struct sg_table *pages,
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_pages.c b/drivers/gpu/drm/i915/gem/i915_gem_pages.c
index 16f845663ff2..383dc9d63e46 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_pages.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_pages.c
@@ -522,14 +522,16 @@ void __i915_gem_object_release_map(struct drm_i915_gem_object *obj)
}
struct scatterlist *
-__i915_gem_object_get_sg(struct drm_i915_gem_object *obj,
- struct i915_gem_object_page_iter *iter,
- unsigned int n,
- unsigned int *offset,
- bool dma)
+__i915_gem_object_page_iter_get_sg(struct drm_i915_gem_object *obj,
+ struct i915_gem_object_page_iter *iter,
+ pgoff_t n,
+ unsigned int *offset)
+
{
- struct scatterlist *sg;
+ const bool dma = iter == &obj->mm.get_dma_page ||
+ iter == &obj->ttm.get_io_page;
unsigned int idx, count;
+ struct scatterlist *sg;
might_sleep();
GEM_BUG_ON(n >= obj->base.size >> PAGE_SHIFT);
@@ -637,7 +639,7 @@ __i915_gem_object_get_sg(struct drm_i915_gem_object *obj,
}
struct page *
-i915_gem_object_get_page(struct drm_i915_gem_object *obj, unsigned int n)
+__i915_gem_object_get_page(struct drm_i915_gem_object *obj, pgoff_t n)
{
struct scatterlist *sg;
unsigned int offset;
@@ -650,8 +652,7 @@ i915_gem_object_get_page(struct drm_i915_gem_object *obj, unsigned int n)
/* Like i915_gem_object_get_page(), but mark the returned page dirty */
struct page *
-i915_gem_object_get_dirty_page(struct drm_i915_gem_object *obj,
- unsigned int n)
+__i915_gem_object_get_dirty_page(struct drm_i915_gem_object *obj, pgoff_t n)
{
struct page *page;
@@ -663,9 +664,8 @@ i915_gem_object_get_dirty_page(struct drm_i915_gem_object *obj,
}
dma_addr_t
-i915_gem_object_get_dma_address_len(struct drm_i915_gem_object *obj,
- unsigned long n,
- unsigned int *len)
+__i915_gem_object_get_dma_address_len(struct drm_i915_gem_object *obj,
+ pgoff_t n, unsigned int *len)
{
struct scatterlist *sg;
unsigned int offset;
@@ -679,8 +679,7 @@ i915_gem_object_get_dma_address_len(struct drm_i915_gem_object *obj,
}
dma_addr_t
-i915_gem_object_get_dma_address(struct drm_i915_gem_object *obj,
- unsigned long n)
+__i915_gem_object_get_dma_address(struct drm_i915_gem_object *obj, pgoff_t n)
{
return i915_gem_object_get_dma_address_len(obj, n, NULL);
}
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
index 25129af70f70..721b716942bb 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
@@ -685,7 +685,7 @@ static unsigned long i915_ttm_io_mem_pfn(struct ttm_buffer_object *bo,
GEM_WARN_ON(bo->ttm);
base = obj->mm.region->iomap.base - obj->mm.region->region.start;
- sg = __i915_gem_object_get_sg(obj, &obj->ttm.get_io_page, page_offset, &ofs, true);
+ sg = i915_gem_object_page_iter_get_sg(obj, &obj->ttm.get_io_page, page_offset, &ofs);
return ((base + sg_dma_address(sg)) >> PAGE_SHIFT) + ofs;
}
diff --git a/drivers/gpu/drm/i915/gem/selftests/i915_gem_context.c b/drivers/gpu/drm/i915/gem/selftests/i915_gem_context.c
index d8864444432b..87aee0e88593 100644
--- a/drivers/gpu/drm/i915/gem/selftests/i915_gem_context.c
+++ b/drivers/gpu/drm/i915/gem/selftests/i915_gem_context.c
@@ -469,7 +469,8 @@ static int gpu_fill(struct intel_context *ce,
static int cpu_fill(struct drm_i915_gem_object *obj, u32 value)
{
const bool has_llc = HAS_LLC(to_i915(obj->base.dev));
- unsigned int n, m, need_flush;
+ unsigned int need_flush;
+ unsigned long n, m;
int err;
i915_gem_object_lock(obj, NULL);
@@ -499,7 +500,8 @@ static int cpu_fill(struct drm_i915_gem_object *obj, u32 value)
static noinline int cpu_check(struct drm_i915_gem_object *obj,
unsigned int idx, unsigned int max)
{
- unsigned int n, m, needs_flush;
+ unsigned int needs_flush;
+ unsigned long n;
int err;
i915_gem_object_lock(obj, NULL);
@@ -508,7 +510,7 @@ static noinline int cpu_check(struct drm_i915_gem_object *obj,
goto out_unlock;
for (n = 0; n < real_page_count(obj); n++) {
- u32 *map;
+ u32 *map, m;
map = kmap_atomic(i915_gem_object_get_page(obj, n));
if (needs_flush & CLFLUSH_BEFORE)
@@ -516,7 +518,7 @@ static noinline int cpu_check(struct drm_i915_gem_object *obj,
for (m = 0; m < max; m++) {
if (map[m] != m) {
- pr_err("%pS: Invalid value at object %d page %d/%ld, offset %d/%d: found %x expected %x\n",
+ pr_err("%pS: Invalid value at object %d page %ld/%ld, offset %d/%d: found %x expected %x\n",
__builtin_return_address(0), idx,
n, real_page_count(obj), m, max,
map[m], m);
@@ -527,7 +529,7 @@ static noinline int cpu_check(struct drm_i915_gem_object *obj,
for (; m < DW_PER_PAGE; m++) {
if (map[m] != STACK_MAGIC) {
- pr_err("%pS: Invalid value at object %d page %d, offset %d: found %x expected %x (uninitialised)\n",
+ pr_err("%pS: Invalid value at object %d page %ld, offset %d: found %x expected %x (uninitialised)\n",
__builtin_return_address(0), idx, n, m,
map[m], STACK_MAGIC);
err = -EINVAL;
diff --git a/drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c b/drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c
index 1cae24349a96..e56e0fe88515 100644
--- a/drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c
+++ b/drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c
@@ -96,11 +96,11 @@ static int check_partial_mapping(struct drm_i915_gem_object *obj,
struct drm_i915_private *i915 = to_i915(obj->base.dev);
struct i915_gtt_view view;
struct i915_vma *vma;
+ unsigned long offset;
unsigned long page;
u32 __iomem *io;
struct page *p;
unsigned int n;
- u64 offset;
u32 *cpu;
int err;
@@ -157,7 +157,7 @@ static int check_partial_mapping(struct drm_i915_gem_object *obj,
cpu = kmap(p) + offset_in_page(offset);
drm_clflush_virt_range(cpu, sizeof(*cpu));
if (*cpu != (u32)page) {
- pr_err("Partial view for %lu [%u] (offset=%llu, size=%u [%llu, row size %u], fence=%d, tiling=%d, stride=%d) misalignment, expected write to page (%llu + %u [0x%llx]) of 0x%x, found 0x%x\n",
+ pr_err("Partial view for %lu [%u] (offset=%llu, size=%u [%llu, row size %u], fence=%d, tiling=%d, stride=%d) misalignment, expected write to page (%lu + %u [0x%lx]) of 0x%x, found 0x%x\n",
page, n,
view.partial.offset,
view.partial.size,
@@ -213,10 +213,10 @@ static int check_partial_mappings(struct drm_i915_gem_object *obj,
for_each_prime_number_from(page, 1, npages) {
struct i915_gtt_view view =
compute_partial_view(obj, page, MIN_CHUNK_PAGES);
+ unsigned long offset;
u32 __iomem *io;
struct page *p;
unsigned int n;
- u64 offset;
u32 *cpu;
GEM_BUG_ON(view.partial.size > nreal);
@@ -253,7 +253,7 @@ static int check_partial_mappings(struct drm_i915_gem_object *obj,
cpu = kmap(p) + offset_in_page(offset);
drm_clflush_virt_range(cpu, sizeof(*cpu));
if (*cpu != (u32)page) {
- pr_err("Partial view for %lu [%u] (offset=%llu, size=%u [%llu, row size %u], fence=%d, tiling=%d, stride=%d) misalignment, expected write to page (%llu + %u [0x%llx]) of 0x%x, found 0x%x\n",
+ pr_err("Partial view for %lu [%u] (offset=%llu, size=%u [%llu, row size %u], fence=%d, tiling=%d, stride=%d) misalignment, expected write to page (%lu + %u [0x%lx]) of 0x%x, found 0x%x\n",
page, n,
view.partial.offset,
view.partial.size,
diff --git a/drivers/gpu/drm/i915/gem/selftests/i915_gem_object.c b/drivers/gpu/drm/i915/gem/selftests/i915_gem_object.c
index bdf5bb40ccf1..19e374f68ff7 100644
--- a/drivers/gpu/drm/i915/gem/selftests/i915_gem_object.c
+++ b/drivers/gpu/drm/i915/gem/selftests/i915_gem_object.c
@@ -33,10 +33,10 @@ static int igt_gem_object(void *arg)
static int igt_gem_huge(void *arg)
{
- const unsigned int nreal = 509; /* just to be awkward */
+ const unsigned long nreal = 509; /* just to be awkward */
struct drm_i915_private *i915 = arg;
struct drm_i915_gem_object *obj;
- unsigned int n;
+ unsigned long n;
int err;
/* Basic sanitycheck of our huge fake object allocation */
@@ -49,7 +49,7 @@ static int igt_gem_huge(void *arg)
err = i915_gem_object_pin_pages_unlocked(obj);
if (err) {
- pr_err("Failed to allocate %u pages (%lu total), err=%d\n",
+ pr_err("Failed to allocate %lu pages (%lu total), err=%d\n",
nreal, obj->base.size / PAGE_SIZE, err);
goto out;
}
@@ -57,7 +57,7 @@ static int igt_gem_huge(void *arg)
for (n = 0; n < obj->base.size / PAGE_SIZE; n++) {
if (i915_gem_object_get_page(obj, n) !=
i915_gem_object_get_page(obj, n % nreal)) {
- pr_err("Page lookup mismatch at index %u [%u]\n",
+ pr_err("Page lookup mismatch at index %lu [%lu]\n",
n, n % nreal);
err = -EINVAL;
goto out_unpin;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 299f94a9fb87..34c6b5e6b3f5 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -229,8 +229,9 @@ i915_gem_shmem_pread(struct drm_i915_gem_object *obj,
struct drm_i915_gem_pread *args)
{
unsigned int needs_clflush;
- unsigned int idx, offset;
char __user *user_data;
+ unsigned long offset;
+ pgoff_t idx;
u64 remain;
int ret;
@@ -383,13 +384,17 @@ i915_gem_gtt_pread(struct drm_i915_gem_object *obj,
{
struct drm_i915_private *i915 = to_i915(obj->base.dev);
struct i915_ggtt *ggtt = to_gt(i915)->ggtt;
+ unsigned long remain, offset;
intel_wakeref_t wakeref;
struct drm_mm_node node;
void __user *user_data;
struct i915_vma *vma;
- u64 remain, offset;
int ret = 0;
+ if (overflows_type(args->size, remain) ||
+ overflows_type(args->offset, offset))
+ return -EINVAL;
+
wakeref = intel_runtime_pm_get(&i915->runtime_pm);
vma = i915_gem_gtt_prepare(obj, &node, false);
@@ -540,13 +545,17 @@ i915_gem_gtt_pwrite_fast(struct drm_i915_gem_object *obj,
struct drm_i915_private *i915 = to_i915(obj->base.dev);
struct i915_ggtt *ggtt = to_gt(i915)->ggtt;
struct intel_runtime_pm *rpm = &i915->runtime_pm;
+ unsigned long remain, offset;
intel_wakeref_t wakeref;
struct drm_mm_node node;
struct i915_vma *vma;
- u64 remain, offset;
void __user *user_data;
int ret = 0;
+ if (overflows_type(args->size, remain) ||
+ overflows_type(args->offset, offset))
+ return -EINVAL;
+
if (i915_gem_object_has_struct_page(obj)) {
/*
* Avoid waking the device up if we can fallback, as
@@ -654,8 +663,9 @@ i915_gem_shmem_pwrite(struct drm_i915_gem_object *obj,
{
unsigned int partial_cacheline_write;
unsigned int needs_clflush;
- unsigned int offset, idx;
void __user *user_data;
+ unsigned long offset;
+ pgoff_t idx;
u64 remain;
int ret;
diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c
index c39488eb9eeb..36bc059aa0bc 100644
--- a/drivers/gpu/drm/i915/i915_vma.c
+++ b/drivers/gpu/drm/i915/i915_vma.c
@@ -904,7 +904,7 @@ rotate_pages(struct drm_i915_gem_object *obj, unsigned int offset,
struct sg_table *st, struct scatterlist *sg)
{
unsigned int column, row;
- unsigned int src_idx;
+ pgoff_t src_idx;
for (column = 0; column < width; column++) {
unsigned int left;
@@ -1010,7 +1010,7 @@ add_padding_pages(unsigned int count,
static struct scatterlist *
remap_tiled_color_plane_pages(struct drm_i915_gem_object *obj,
- unsigned int offset, unsigned int alignment_pad,
+ unsigned long offset, unsigned int alignment_pad,
unsigned int width, unsigned int height,
unsigned int src_stride, unsigned int dst_stride,
struct sg_table *st, struct scatterlist *sg,
@@ -1069,7 +1069,7 @@ remap_tiled_color_plane_pages(struct drm_i915_gem_object *obj,
static struct scatterlist *
remap_contiguous_pages(struct drm_i915_gem_object *obj,
- unsigned int obj_offset,
+ pgoff_t obj_offset,
unsigned int count,
struct sg_table *st, struct scatterlist *sg)
{
@@ -1102,7 +1102,7 @@ remap_contiguous_pages(struct drm_i915_gem_object *obj,
static struct scatterlist *
remap_linear_color_plane_pages(struct drm_i915_gem_object *obj,
- unsigned int obj_offset, unsigned int alignment_pad,
+ pgoff_t obj_offset, unsigned int alignment_pad,
unsigned int size,
struct sg_table *st, struct scatterlist *sg,
unsigned int *gtt_offset)
--
2.37.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* [Intel-gfx] [PATCH v14 3/7] drm/i915: Check for integer truncation on scatterlist creation
2022-11-02 14:53 [Intel-gfx] [PATCH v14 0/7] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun
2022-11-02 14:53 ` [Intel-gfx] [PATCH v14 1/7] overflow: Introduce overflows_type() and castable_to_type() Gwan-gyeong Mun
2022-11-02 14:53 ` [Intel-gfx] [PATCH v14 2/7] drm/i915/gem: Typecheck page lookups Gwan-gyeong Mun
@ 2022-11-02 14:53 ` Gwan-gyeong Mun
2022-11-03 10:30 ` Gwan-gyeong Mun
2022-11-02 14:53 ` [Intel-gfx] [PATCH v14 4/7] drm/i915: Check for integer truncation on the configuration of ttm place Gwan-gyeong Mun
` (9 subsequent siblings)
12 siblings, 1 reply; 18+ messages in thread
From: Gwan-gyeong Mun @ 2022-11-02 14:53 UTC (permalink / raw)
To: intel-gfx
Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld,
mchehab, nirmoy.das
From: Chris Wilson <chris@chris-wilson.co.uk>
There is an impedance mismatch between the scatterlist API using unsigned
int and our memory/page accounting in unsigned long. That is we may try
to create a scatterlist for a large object that overflows returning a
small table into which we try to fit very many pages. As the object size
is under the control of userspace, we have to be prudent and catch the
conversion errors.
To catch the implicit truncation we check before calling scattterlist
creation Apis. we use overflows_type check and report E2BIG if the
overflows may raise. When caller does not return errno, use WARN_ON to
report a problem.
This is already used in our create ioctls to indicate if the uABI request
is simply too large for the backing store. Failing that type check,
we have a second check at sg_alloc_table time to make sure the values
we are passing into the scatterlist API are not truncated.
v2: Move added i915_utils's macro into drm_util header (Jani N)
v5: Fix macros to be enclosed in parentheses for complex values
Fix too long line warning
v8: Replace safe_conversion() with check_assign() (Kees)
v14: Remove shadowing macros of scatterlist creation api and fix to
explicitly overflow check where the scatterlist creation APIs are
called. (Jani)
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Brian Welty <brian.welty@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com>
---
drivers/gpu/drm/i915/gem/i915_gem_internal.c | 7 +++++--
drivers/gpu/drm/i915/gem/i915_gem_object.h | 3 ---
drivers/gpu/drm/i915/gem/i915_gem_phys.c | 4 ++++
drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 9 ++++++---
drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 4 ++++
drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 6 +++++-
drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c | 6 +++++-
drivers/gpu/drm/i915/gem/selftests/huge_pages.c | 8 ++++++++
drivers/gpu/drm/i915/gvt/dmabuf.c | 10 ++++++----
drivers/gpu/drm/i915/i915_scatterlist.c | 5 +++++
drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 4 ++++
drivers/gpu/drm/i915/selftests/scatterlist.c | 4 ++++
12 files changed, 56 insertions(+), 14 deletions(-)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_internal.c b/drivers/gpu/drm/i915/gem/i915_gem_internal.c
index 629acb403a2c..b0e6b464bf59 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_internal.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_internal.c
@@ -36,11 +36,15 @@ static int i915_gem_object_get_pages_internal(struct drm_i915_gem_object *obj)
struct sg_table *st;
struct scatterlist *sg;
unsigned int sg_page_sizes;
- unsigned int npages;
+ unsigned int npages; /* restricted by sg_alloc_table */
int max_order = MAX_ORDER;
unsigned int max_segment;
gfp_t gfp;
+ if (overflows_type(obj->base.size >> PAGE_SHIFT, npages))
+ return -E2BIG;
+
+ npages = obj->base.size >> PAGE_SHIFT;
max_segment = i915_sg_segment_size(i915->drm.dev) >> PAGE_SHIFT;
max_order = min(max_order, get_order(max_segment));
@@ -56,7 +60,6 @@ static int i915_gem_object_get_pages_internal(struct drm_i915_gem_object *obj)
if (!st)
return -ENOMEM;
- npages = obj->base.size / PAGE_SIZE;
if (sg_alloc_table(st, npages, GFP_KERNEL)) {
kfree(st);
return -ENOMEM;
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object.h b/drivers/gpu/drm/i915/gem/i915_gem_object.h
index 55817d287676..8cd8d2041c5a 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_object.h
+++ b/drivers/gpu/drm/i915/gem/i915_gem_object.h
@@ -26,9 +26,6 @@ enum intel_region_id;
* this and catch if we ever need to fix it. In the meantime, if you do
* spot such a local variable, please consider fixing!
*
- * Aside from our own locals (for which we have no excuse!):
- * - sg_table embeds unsigned int for nents
- *
* We can check for invalidly typed locals with typecheck(), see for example
* i915_gem_object_get_sg().
*/
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_phys.c b/drivers/gpu/drm/i915/gem/i915_gem_phys.c
index 0d0e46dae559..88ba7266a3a5 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_phys.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_phys.c
@@ -28,6 +28,10 @@ static int i915_gem_object_get_pages_phys(struct drm_i915_gem_object *obj)
void *dst;
int i;
+ /* Contiguous chunk, with a single scatterlist element */
+ if (overflows_type(obj->base.size, sg->length))
+ return -E2BIG;
+
if (GEM_WARN_ON(i915_gem_object_needs_bit17_swizzle(obj)))
return -EINVAL;
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
index 11125c32dd35..fdd9d151ac1f 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
@@ -60,7 +60,7 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st,
struct address_space *mapping,
unsigned int max_segment)
{
- const unsigned long page_count = size / PAGE_SIZE;
+ unsigned int page_count; /* restricted by sg_alloc_table */
unsigned long i;
struct scatterlist *sg;
struct page *page;
@@ -68,6 +68,10 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st,
gfp_t noreclaim;
int ret;
+ if (overflows_type(size / PAGE_SIZE, page_count))
+ return -E2BIG;
+
+ page_count = size / PAGE_SIZE;
/*
* If there's no chance of allocating enough pages for the whole
* object, bail early.
@@ -193,7 +197,6 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj)
struct drm_i915_private *i915 = to_i915(obj->base.dev);
struct intel_memory_region *mem = obj->mm.region;
struct address_space *mapping = obj->base.filp->f_mapping;
- const unsigned long page_count = obj->base.size / PAGE_SIZE;
unsigned int max_segment = i915_sg_segment_size(i915->drm.dev);
struct sg_table *st;
struct sgt_iter sgt_iter;
@@ -236,7 +239,7 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj)
} else {
dev_warn(i915->drm.dev,
"Failed to DMA remap %lu pages\n",
- page_count);
+ obj->base.size >> PAGE_SHIFT);
goto err_pages;
}
}
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
index 721b716942bb..2cd7a17c720d 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
@@ -829,6 +829,10 @@ static int i915_ttm_get_pages(struct drm_i915_gem_object *obj)
struct ttm_place requested, busy[I915_TTM_MAX_PLACEMENTS];
struct ttm_placement placement;
+ /* restricted by sg_alloc_table */
+ if (overflows_type(obj->base.size >> PAGE_SHIFT, unsigned int))
+ return -E2BIG;
+
GEM_BUG_ON(obj->mm.n_placements > I915_TTM_MAX_PLACEMENTS);
/* Move to the requested placement. */
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
index 1b1a22716722..893c03f4a794 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
@@ -128,13 +128,17 @@ static void i915_gem_object_userptr_drop_ref(struct drm_i915_gem_object *obj)
static int i915_gem_userptr_get_pages(struct drm_i915_gem_object *obj)
{
- const unsigned long num_pages = obj->base.size >> PAGE_SHIFT;
unsigned int max_segment = i915_sg_segment_size(obj->base.dev->dev);
struct sg_table *st;
unsigned int sg_page_sizes;
struct page **pvec;
+ unsigned int num_pages; /* limited by sg_alloc_table_from_pages_segment */
int ret;
+ if (overflows_type(obj->base.size >> PAGE_SHIFT, num_pages))
+ return -E2BIG;
+
+ num_pages = obj->base.size >> PAGE_SHIFT;
st = kmalloc(sizeof(*st), GFP_KERNEL);
if (!st)
return -ENOMEM;
diff --git a/drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c b/drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c
index f963b8e1e37b..bb1e8f1657a6 100644
--- a/drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c
+++ b/drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c
@@ -29,11 +29,15 @@ static int huge_get_pages(struct drm_i915_gem_object *obj)
{
#define GFP (GFP_KERNEL | __GFP_NOWARN | __GFP_RETRY_MAYFAIL)
const unsigned long nreal = obj->scratch / PAGE_SIZE;
- const unsigned long npages = obj->base.size / PAGE_SIZE;
+ unsigned int npages; /* restricted by sg_alloc_table */
struct scatterlist *sg, *src, *end;
struct sg_table *pages;
unsigned long n;
+ if (overflows_type(obj->base.size / PAGE_SIZE, npages))
+ return -E2BIG;
+
+ npages = obj->base.size / PAGE_SIZE;
pages = kmalloc(sizeof(*pages), GFP);
if (!pages)
return -ENOMEM;
diff --git a/drivers/gpu/drm/i915/gem/selftests/huge_pages.c b/drivers/gpu/drm/i915/gem/selftests/huge_pages.c
index 0cb99e75b0bc..1120a7960d47 100644
--- a/drivers/gpu/drm/i915/gem/selftests/huge_pages.c
+++ b/drivers/gpu/drm/i915/gem/selftests/huge_pages.c
@@ -84,6 +84,10 @@ static int get_huge_pages(struct drm_i915_gem_object *obj)
unsigned int sg_page_sizes;
u64 rem;
+ /* restricted by sg_alloc_table */
+ if (overflows_type(obj->base.size >> PAGE_SHIFT, unsigned int))
+ return -E2BIG;
+
st = kmalloc(sizeof(*st), GFP);
if (!st)
return -ENOMEM;
@@ -213,6 +217,10 @@ static int fake_get_huge_pages(struct drm_i915_gem_object *obj)
unsigned int sg_page_sizes;
u64 rem;
+ /* restricted by sg_alloc_table */
+ if (overflows_type(obj->base.size >> PAGE_SHIFT, unsigned int))
+ return -E2BIG;
+
st = kmalloc(sizeof(*st), GFP);
if (!st)
return -ENOMEM;
diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c
index 01e54b45c5c1..e61cf3beeeba 100644
--- a/drivers/gpu/drm/i915/gvt/dmabuf.c
+++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
@@ -42,8 +42,7 @@
#define GEN8_DECODE_PTE(pte) (pte & GENMASK_ULL(63, 12))
-static int vgpu_gem_get_pages(
- struct drm_i915_gem_object *obj)
+static int vgpu_gem_get_pages(struct drm_i915_gem_object *obj)
{
struct drm_i915_private *dev_priv = to_i915(obj->base.dev);
struct intel_vgpu *vgpu;
@@ -52,8 +51,12 @@ static int vgpu_gem_get_pages(
int i, j, ret;
gen8_pte_t __iomem *gtt_entries;
struct intel_vgpu_fb_info *fb_info;
- u32 page_num;
+ unsigned int page_num; /* limited by sg_alloc_table */
+ if (overflows_type(obj->base.size >> PAGE_SHIFT, page_num))
+ return -E2BIG;
+
+ page_num = obj->base.size >> PAGE_SHIFT;
fb_info = (struct intel_vgpu_fb_info *)obj->gvt_info;
if (drm_WARN_ON(&dev_priv->drm, !fb_info))
return -ENODEV;
@@ -66,7 +69,6 @@ static int vgpu_gem_get_pages(
if (unlikely(!st))
return -ENOMEM;
- page_num = obj->base.size >> PAGE_SHIFT;
ret = sg_alloc_table(st, page_num, GFP_KERNEL);
if (ret) {
kfree(st);
diff --git a/drivers/gpu/drm/i915/i915_scatterlist.c b/drivers/gpu/drm/i915/i915_scatterlist.c
index 114e5e39aa72..c9dc3a917d66 100644
--- a/drivers/gpu/drm/i915/i915_scatterlist.c
+++ b/drivers/gpu/drm/i915/i915_scatterlist.c
@@ -96,6 +96,9 @@ struct i915_refct_sgt *i915_rsgt_from_mm_node(const struct drm_mm_node *node,
i915_refct_sgt_init(rsgt, node->size << PAGE_SHIFT);
st = &rsgt->table;
+ /* restricted by sg_alloc_table */
+ WARN_ON(overflows_type(DIV_ROUND_UP_ULL(node->size, segment_pages),
+ unsigned int));
if (sg_alloc_table(st, DIV_ROUND_UP_ULL(node->size, segment_pages),
GFP_KERNEL)) {
i915_refct_sgt_put(rsgt);
@@ -177,6 +180,8 @@ struct i915_refct_sgt *i915_rsgt_from_buddy_resource(struct ttm_resource *res,
i915_refct_sgt_init(rsgt, size);
st = &rsgt->table;
+ /* restricted by sg_alloc_table */
+ WARN_ON(overflows_type(PFN_UP(res->size), unsigned int));
if (sg_alloc_table(st, PFN_UP(res->size), GFP_KERNEL)) {
i915_refct_sgt_put(rsgt);
return ERR_PTR(-ENOMEM);
diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
index 27c733b00976..097be1e89dba 100644
--- a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
@@ -69,6 +69,10 @@ static int fake_get_pages(struct drm_i915_gem_object *obj)
return -ENOMEM;
rem = round_up(obj->base.size, BIT(31)) >> 31;
+ /* restricted by sg_alloc_table */
+ if (overflows_type(rem, unsigned int))
+ return -E2BIG;
+
if (sg_alloc_table(pages, rem, GFP)) {
kfree(pages);
return -ENOMEM;
diff --git a/drivers/gpu/drm/i915/selftests/scatterlist.c b/drivers/gpu/drm/i915/selftests/scatterlist.c
index d599186d5b71..805c4bfb85fe 100644
--- a/drivers/gpu/drm/i915/selftests/scatterlist.c
+++ b/drivers/gpu/drm/i915/selftests/scatterlist.c
@@ -220,6 +220,10 @@ static int alloc_table(struct pfn_table *pt,
struct scatterlist *sg;
unsigned long n, pfn;
+ /* restricted by sg_alloc_table */
+ if (overflows_type(max, unsigned int))
+ return -E2BIG;
+
if (sg_alloc_table(&pt->st, max,
GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN))
return alloc_error;
--
2.37.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* Re: [Intel-gfx] [PATCH v14 3/7] drm/i915: Check for integer truncation on scatterlist creation
2022-11-02 14:53 ` [Intel-gfx] [PATCH v14 3/7] drm/i915: Check for integer truncation on scatterlist creation Gwan-gyeong Mun
@ 2022-11-03 10:30 ` Gwan-gyeong Mun
2022-11-03 10:51 ` Jani Nikula
0 siblings, 1 reply; 18+ messages in thread
From: Gwan-gyeong Mun @ 2022-11-03 10:30 UTC (permalink / raw)
To: jani.nikula
Cc: thomas.hellstrom, intel-gfx, chris, matthew.auld, andrzej.hajda,
mchehab, nirmoy.das
On 11/2/22 4:53 PM, Gwan-gyeong Mun wrote:
> From: Chris Wilson <chris@chris-wilson.co.uk>
>
> There is an impedance mismatch between the scatterlist API using unsigned
> int and our memory/page accounting in unsigned long. That is we may try
> to create a scatterlist for a large object that overflows returning a
> small table into which we try to fit very many pages. As the object size
> is under the control of userspace, we have to be prudent and catch the
> conversion errors.
>
> To catch the implicit truncation we check before calling scattterlist
> creation Apis. we use overflows_type check and report E2BIG if the
> overflows may raise. When caller does not return errno, use WARN_ON to
> report a problem.
>
> This is already used in our create ioctls to indicate if the uABI request
> is simply too large for the backing store. Failing that type check,
> we have a second check at sg_alloc_table time to make sure the values
> we are passing into the scatterlist API are not truncated.
>
> v2: Move added i915_utils's macro into drm_util header (Jani N)
> v5: Fix macros to be enclosed in parentheses for complex values
> Fix too long line warning
> v8: Replace safe_conversion() with check_assign() (Kees)
> v14: Remove shadowing macros of scatterlist creation api and fix to
> explicitly overflow check where the scatterlist creation APIs are
> called. (Jani)
>
Hi Jani,
This version has removed shadowing macros of scatterlist creation api as
per last comment of you.
Can I please have your ack or review comment?
Br,
G.G.
> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
> Cc: Brian Welty <brian.welty@intel.com>
> Cc: Matthew Auld <matthew.auld@intel.com>
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
> Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
> Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org>
> Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com>
> ---
> drivers/gpu/drm/i915/gem/i915_gem_internal.c | 7 +++++--
> drivers/gpu/drm/i915/gem/i915_gem_object.h | 3 ---
> drivers/gpu/drm/i915/gem/i915_gem_phys.c | 4 ++++
> drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 9 ++++++---
> drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 4 ++++
> drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 6 +++++-
> drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c | 6 +++++-
> drivers/gpu/drm/i915/gem/selftests/huge_pages.c | 8 ++++++++
> drivers/gpu/drm/i915/gvt/dmabuf.c | 10 ++++++----
> drivers/gpu/drm/i915/i915_scatterlist.c | 5 +++++
> drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 4 ++++
> drivers/gpu/drm/i915/selftests/scatterlist.c | 4 ++++
> 12 files changed, 56 insertions(+), 14 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_internal.c b/drivers/gpu/drm/i915/gem/i915_gem_internal.c
> index 629acb403a2c..b0e6b464bf59 100644
> --- a/drivers/gpu/drm/i915/gem/i915_gem_internal.c
> +++ b/drivers/gpu/drm/i915/gem/i915_gem_internal.c
> @@ -36,11 +36,15 @@ static int i915_gem_object_get_pages_internal(struct drm_i915_gem_object *obj)
> struct sg_table *st;
> struct scatterlist *sg;
> unsigned int sg_page_sizes;
> - unsigned int npages;
> + unsigned int npages; /* restricted by sg_alloc_table */
> int max_order = MAX_ORDER;
> unsigned int max_segment;
> gfp_t gfp;
>
> + if (overflows_type(obj->base.size >> PAGE_SHIFT, npages))
> + return -E2BIG;
> +
> + npages = obj->base.size >> PAGE_SHIFT;
> max_segment = i915_sg_segment_size(i915->drm.dev) >> PAGE_SHIFT;
> max_order = min(max_order, get_order(max_segment));
>
> @@ -56,7 +60,6 @@ static int i915_gem_object_get_pages_internal(struct drm_i915_gem_object *obj)
> if (!st)
> return -ENOMEM;
>
> - npages = obj->base.size / PAGE_SIZE;
> if (sg_alloc_table(st, npages, GFP_KERNEL)) {
> kfree(st);
> return -ENOMEM;
> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object.h b/drivers/gpu/drm/i915/gem/i915_gem_object.h
> index 55817d287676..8cd8d2041c5a 100644
> --- a/drivers/gpu/drm/i915/gem/i915_gem_object.h
> +++ b/drivers/gpu/drm/i915/gem/i915_gem_object.h
> @@ -26,9 +26,6 @@ enum intel_region_id;
> * this and catch if we ever need to fix it. In the meantime, if you do
> * spot such a local variable, please consider fixing!
> *
> - * Aside from our own locals (for which we have no excuse!):
> - * - sg_table embeds unsigned int for nents
> - *
> * We can check for invalidly typed locals with typecheck(), see for example
> * i915_gem_object_get_sg().
> */
> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_phys.c b/drivers/gpu/drm/i915/gem/i915_gem_phys.c
> index 0d0e46dae559..88ba7266a3a5 100644
> --- a/drivers/gpu/drm/i915/gem/i915_gem_phys.c
> +++ b/drivers/gpu/drm/i915/gem/i915_gem_phys.c
> @@ -28,6 +28,10 @@ static int i915_gem_object_get_pages_phys(struct drm_i915_gem_object *obj)
> void *dst;
> int i;
>
> + /* Contiguous chunk, with a single scatterlist element */
> + if (overflows_type(obj->base.size, sg->length))
> + return -E2BIG;
> +
> if (GEM_WARN_ON(i915_gem_object_needs_bit17_swizzle(obj)))
> return -EINVAL;
>
> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
> index 11125c32dd35..fdd9d151ac1f 100644
> --- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
> +++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
> @@ -60,7 +60,7 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st,
> struct address_space *mapping,
> unsigned int max_segment)
> {
> - const unsigned long page_count = size / PAGE_SIZE;
> + unsigned int page_count; /* restricted by sg_alloc_table */
> unsigned long i;
> struct scatterlist *sg;
> struct page *page;
> @@ -68,6 +68,10 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st,
> gfp_t noreclaim;
> int ret;
>
> + if (overflows_type(size / PAGE_SIZE, page_count))
> + return -E2BIG;
> +
> + page_count = size / PAGE_SIZE;
> /*
> * If there's no chance of allocating enough pages for the whole
> * object, bail early.
> @@ -193,7 +197,6 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj)
> struct drm_i915_private *i915 = to_i915(obj->base.dev);
> struct intel_memory_region *mem = obj->mm.region;
> struct address_space *mapping = obj->base.filp->f_mapping;
> - const unsigned long page_count = obj->base.size / PAGE_SIZE;
> unsigned int max_segment = i915_sg_segment_size(i915->drm.dev);
> struct sg_table *st;
> struct sgt_iter sgt_iter;
> @@ -236,7 +239,7 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj)
> } else {
> dev_warn(i915->drm.dev,
> "Failed to DMA remap %lu pages\n",
> - page_count);
> + obj->base.size >> PAGE_SHIFT);
> goto err_pages;
> }
> }
> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
> index 721b716942bb..2cd7a17c720d 100644
> --- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
> +++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
> @@ -829,6 +829,10 @@ static int i915_ttm_get_pages(struct drm_i915_gem_object *obj)
> struct ttm_place requested, busy[I915_TTM_MAX_PLACEMENTS];
> struct ttm_placement placement;
>
> + /* restricted by sg_alloc_table */
> + if (overflows_type(obj->base.size >> PAGE_SHIFT, unsigned int))
> + return -E2BIG;
> +
> GEM_BUG_ON(obj->mm.n_placements > I915_TTM_MAX_PLACEMENTS);
>
> /* Move to the requested placement. */
> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
> index 1b1a22716722..893c03f4a794 100644
> --- a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
> +++ b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
> @@ -128,13 +128,17 @@ static void i915_gem_object_userptr_drop_ref(struct drm_i915_gem_object *obj)
>
> static int i915_gem_userptr_get_pages(struct drm_i915_gem_object *obj)
> {
> - const unsigned long num_pages = obj->base.size >> PAGE_SHIFT;
> unsigned int max_segment = i915_sg_segment_size(obj->base.dev->dev);
> struct sg_table *st;
> unsigned int sg_page_sizes;
> struct page **pvec;
> + unsigned int num_pages; /* limited by sg_alloc_table_from_pages_segment */
> int ret;
>
> + if (overflows_type(obj->base.size >> PAGE_SHIFT, num_pages))
> + return -E2BIG;
> +
> + num_pages = obj->base.size >> PAGE_SHIFT;
> st = kmalloc(sizeof(*st), GFP_KERNEL);
> if (!st)
> return -ENOMEM;
> diff --git a/drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c b/drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c
> index f963b8e1e37b..bb1e8f1657a6 100644
> --- a/drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c
> +++ b/drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c
> @@ -29,11 +29,15 @@ static int huge_get_pages(struct drm_i915_gem_object *obj)
> {
> #define GFP (GFP_KERNEL | __GFP_NOWARN | __GFP_RETRY_MAYFAIL)
> const unsigned long nreal = obj->scratch / PAGE_SIZE;
> - const unsigned long npages = obj->base.size / PAGE_SIZE;
> + unsigned int npages; /* restricted by sg_alloc_table */
> struct scatterlist *sg, *src, *end;
> struct sg_table *pages;
> unsigned long n;
>
> + if (overflows_type(obj->base.size / PAGE_SIZE, npages))
> + return -E2BIG;
> +
> + npages = obj->base.size / PAGE_SIZE;
> pages = kmalloc(sizeof(*pages), GFP);
> if (!pages)
> return -ENOMEM;
> diff --git a/drivers/gpu/drm/i915/gem/selftests/huge_pages.c b/drivers/gpu/drm/i915/gem/selftests/huge_pages.c
> index 0cb99e75b0bc..1120a7960d47 100644
> --- a/drivers/gpu/drm/i915/gem/selftests/huge_pages.c
> +++ b/drivers/gpu/drm/i915/gem/selftests/huge_pages.c
> @@ -84,6 +84,10 @@ static int get_huge_pages(struct drm_i915_gem_object *obj)
> unsigned int sg_page_sizes;
> u64 rem;
>
> + /* restricted by sg_alloc_table */
> + if (overflows_type(obj->base.size >> PAGE_SHIFT, unsigned int))
> + return -E2BIG;
> +
> st = kmalloc(sizeof(*st), GFP);
> if (!st)
> return -ENOMEM;
> @@ -213,6 +217,10 @@ static int fake_get_huge_pages(struct drm_i915_gem_object *obj)
> unsigned int sg_page_sizes;
> u64 rem;
>
> + /* restricted by sg_alloc_table */
> + if (overflows_type(obj->base.size >> PAGE_SHIFT, unsigned int))
> + return -E2BIG;
> +
> st = kmalloc(sizeof(*st), GFP);
> if (!st)
> return -ENOMEM;
> diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c
> index 01e54b45c5c1..e61cf3beeeba 100644
> --- a/drivers/gpu/drm/i915/gvt/dmabuf.c
> +++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
> @@ -42,8 +42,7 @@
>
> #define GEN8_DECODE_PTE(pte) (pte & GENMASK_ULL(63, 12))
>
> -static int vgpu_gem_get_pages(
> - struct drm_i915_gem_object *obj)
> +static int vgpu_gem_get_pages(struct drm_i915_gem_object *obj)
> {
> struct drm_i915_private *dev_priv = to_i915(obj->base.dev);
> struct intel_vgpu *vgpu;
> @@ -52,8 +51,12 @@ static int vgpu_gem_get_pages(
> int i, j, ret;
> gen8_pte_t __iomem *gtt_entries;
> struct intel_vgpu_fb_info *fb_info;
> - u32 page_num;
> + unsigned int page_num; /* limited by sg_alloc_table */
>
> + if (overflows_type(obj->base.size >> PAGE_SHIFT, page_num))
> + return -E2BIG;
> +
> + page_num = obj->base.size >> PAGE_SHIFT;
> fb_info = (struct intel_vgpu_fb_info *)obj->gvt_info;
> if (drm_WARN_ON(&dev_priv->drm, !fb_info))
> return -ENODEV;
> @@ -66,7 +69,6 @@ static int vgpu_gem_get_pages(
> if (unlikely(!st))
> return -ENOMEM;
>
> - page_num = obj->base.size >> PAGE_SHIFT;
> ret = sg_alloc_table(st, page_num, GFP_KERNEL);
> if (ret) {
> kfree(st);
> diff --git a/drivers/gpu/drm/i915/i915_scatterlist.c b/drivers/gpu/drm/i915/i915_scatterlist.c
> index 114e5e39aa72..c9dc3a917d66 100644
> --- a/drivers/gpu/drm/i915/i915_scatterlist.c
> +++ b/drivers/gpu/drm/i915/i915_scatterlist.c
> @@ -96,6 +96,9 @@ struct i915_refct_sgt *i915_rsgt_from_mm_node(const struct drm_mm_node *node,
>
> i915_refct_sgt_init(rsgt, node->size << PAGE_SHIFT);
> st = &rsgt->table;
> + /* restricted by sg_alloc_table */
> + WARN_ON(overflows_type(DIV_ROUND_UP_ULL(node->size, segment_pages),
> + unsigned int));
> if (sg_alloc_table(st, DIV_ROUND_UP_ULL(node->size, segment_pages),
> GFP_KERNEL)) {
> i915_refct_sgt_put(rsgt);
> @@ -177,6 +180,8 @@ struct i915_refct_sgt *i915_rsgt_from_buddy_resource(struct ttm_resource *res,
>
> i915_refct_sgt_init(rsgt, size);
> st = &rsgt->table;
> + /* restricted by sg_alloc_table */
> + WARN_ON(overflows_type(PFN_UP(res->size), unsigned int));
> if (sg_alloc_table(st, PFN_UP(res->size), GFP_KERNEL)) {
> i915_refct_sgt_put(rsgt);
> return ERR_PTR(-ENOMEM);
> diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
> index 27c733b00976..097be1e89dba 100644
> --- a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
> +++ b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
> @@ -69,6 +69,10 @@ static int fake_get_pages(struct drm_i915_gem_object *obj)
> return -ENOMEM;
>
> rem = round_up(obj->base.size, BIT(31)) >> 31;
> + /* restricted by sg_alloc_table */
> + if (overflows_type(rem, unsigned int))
> + return -E2BIG;
> +
> if (sg_alloc_table(pages, rem, GFP)) {
> kfree(pages);
> return -ENOMEM;
> diff --git a/drivers/gpu/drm/i915/selftests/scatterlist.c b/drivers/gpu/drm/i915/selftests/scatterlist.c
> index d599186d5b71..805c4bfb85fe 100644
> --- a/drivers/gpu/drm/i915/selftests/scatterlist.c
> +++ b/drivers/gpu/drm/i915/selftests/scatterlist.c
> @@ -220,6 +220,10 @@ static int alloc_table(struct pfn_table *pt,
> struct scatterlist *sg;
> unsigned long n, pfn;
>
> + /* restricted by sg_alloc_table */
> + if (overflows_type(max, unsigned int))
> + return -E2BIG;
> +
> if (sg_alloc_table(&pt->st, max,
> GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN))
> return alloc_error;
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [Intel-gfx] [PATCH v14 3/7] drm/i915: Check for integer truncation on scatterlist creation
2022-11-03 10:30 ` Gwan-gyeong Mun
@ 2022-11-03 10:51 ` Jani Nikula
0 siblings, 0 replies; 18+ messages in thread
From: Jani Nikula @ 2022-11-03 10:51 UTC (permalink / raw)
To: Gwan-gyeong Mun
Cc: thomas.hellstrom, intel-gfx, chris, matthew.auld, andrzej.hajda,
mchehab, nirmoy.das
On Thu, 03 Nov 2022, Gwan-gyeong Mun <gwan-gyeong.mun@intel.com> wrote:
> On 11/2/22 4:53 PM, Gwan-gyeong Mun wrote:
>> From: Chris Wilson <chris@chris-wilson.co.uk>
>>
>> There is an impedance mismatch between the scatterlist API using unsigned
>> int and our memory/page accounting in unsigned long. That is we may try
>> to create a scatterlist for a large object that overflows returning a
>> small table into which we try to fit very many pages. As the object size
>> is under the control of userspace, we have to be prudent and catch the
>> conversion errors.
>>
>> To catch the implicit truncation we check before calling scattterlist
>> creation Apis. we use overflows_type check and report E2BIG if the
>> overflows may raise. When caller does not return errno, use WARN_ON to
>> report a problem.
>>
>> This is already used in our create ioctls to indicate if the uABI request
>> is simply too large for the backing store. Failing that type check,
>> we have a second check at sg_alloc_table time to make sure the values
>> we are passing into the scatterlist API are not truncated.
>>
>> v2: Move added i915_utils's macro into drm_util header (Jani N)
>> v5: Fix macros to be enclosed in parentheses for complex values
>> Fix too long line warning
>> v8: Replace safe_conversion() with check_assign() (Kees)
>> v14: Remove shadowing macros of scatterlist creation api and fix to
>> explicitly overflow check where the scatterlist creation APIs are
>> called. (Jani)
>>
> Hi Jani,
>
> This version has removed shadowing macros of scatterlist creation api as
> per last comment of you.
>
> Can I please have your ack or review comment?
I don't get the parts that have WARN_ON() but no action, they just keep
going.
Other than that,
Acked-by: Jani Nikula <jani.nikula@intel.com>
>
> Br,
>
> G.G.
>
>> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
>> Cc: Brian Welty <brian.welty@intel.com>
>> Cc: Matthew Auld <matthew.auld@intel.com>
>> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
>> Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
>> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
>> Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
>> Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
>> Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org>
>> Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com>
>> ---
>> drivers/gpu/drm/i915/gem/i915_gem_internal.c | 7 +++++--
>> drivers/gpu/drm/i915/gem/i915_gem_object.h | 3 ---
>> drivers/gpu/drm/i915/gem/i915_gem_phys.c | 4 ++++
>> drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 9 ++++++---
>> drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 4 ++++
>> drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 6 +++++-
>> drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c | 6 +++++-
>> drivers/gpu/drm/i915/gem/selftests/huge_pages.c | 8 ++++++++
>> drivers/gpu/drm/i915/gvt/dmabuf.c | 10 ++++++----
>> drivers/gpu/drm/i915/i915_scatterlist.c | 5 +++++
>> drivers/gpu/drm/i915/selftests/i915_gem_gtt.c | 4 ++++
>> drivers/gpu/drm/i915/selftests/scatterlist.c | 4 ++++
>> 12 files changed, 56 insertions(+), 14 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_internal.c b/drivers/gpu/drm/i915/gem/i915_gem_internal.c
>> index 629acb403a2c..b0e6b464bf59 100644
>> --- a/drivers/gpu/drm/i915/gem/i915_gem_internal.c
>> +++ b/drivers/gpu/drm/i915/gem/i915_gem_internal.c
>> @@ -36,11 +36,15 @@ static int i915_gem_object_get_pages_internal(struct drm_i915_gem_object *obj)
>> struct sg_table *st;
>> struct scatterlist *sg;
>> unsigned int sg_page_sizes;
>> - unsigned int npages;
>> + unsigned int npages; /* restricted by sg_alloc_table */
>> int max_order = MAX_ORDER;
>> unsigned int max_segment;
>> gfp_t gfp;
>>
>> + if (overflows_type(obj->base.size >> PAGE_SHIFT, npages))
>> + return -E2BIG;
>> +
>> + npages = obj->base.size >> PAGE_SHIFT;
>> max_segment = i915_sg_segment_size(i915->drm.dev) >> PAGE_SHIFT;
>> max_order = min(max_order, get_order(max_segment));
>>
>> @@ -56,7 +60,6 @@ static int i915_gem_object_get_pages_internal(struct drm_i915_gem_object *obj)
>> if (!st)
>> return -ENOMEM;
>>
>> - npages = obj->base.size / PAGE_SIZE;
>> if (sg_alloc_table(st, npages, GFP_KERNEL)) {
>> kfree(st);
>> return -ENOMEM;
>> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object.h b/drivers/gpu/drm/i915/gem/i915_gem_object.h
>> index 55817d287676..8cd8d2041c5a 100644
>> --- a/drivers/gpu/drm/i915/gem/i915_gem_object.h
>> +++ b/drivers/gpu/drm/i915/gem/i915_gem_object.h
>> @@ -26,9 +26,6 @@ enum intel_region_id;
>> * this and catch if we ever need to fix it. In the meantime, if you do
>> * spot such a local variable, please consider fixing!
>> *
>> - * Aside from our own locals (for which we have no excuse!):
>> - * - sg_table embeds unsigned int for nents
>> - *
>> * We can check for invalidly typed locals with typecheck(), see for example
>> * i915_gem_object_get_sg().
>> */
>> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_phys.c b/drivers/gpu/drm/i915/gem/i915_gem_phys.c
>> index 0d0e46dae559..88ba7266a3a5 100644
>> --- a/drivers/gpu/drm/i915/gem/i915_gem_phys.c
>> +++ b/drivers/gpu/drm/i915/gem/i915_gem_phys.c
>> @@ -28,6 +28,10 @@ static int i915_gem_object_get_pages_phys(struct drm_i915_gem_object *obj)
>> void *dst;
>> int i;
>>
>> + /* Contiguous chunk, with a single scatterlist element */
>> + if (overflows_type(obj->base.size, sg->length))
>> + return -E2BIG;
>> +
>> if (GEM_WARN_ON(i915_gem_object_needs_bit17_swizzle(obj)))
>> return -EINVAL;
>>
>> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
>> index 11125c32dd35..fdd9d151ac1f 100644
>> --- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
>> +++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
>> @@ -60,7 +60,7 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st,
>> struct address_space *mapping,
>> unsigned int max_segment)
>> {
>> - const unsigned long page_count = size / PAGE_SIZE;
>> + unsigned int page_count; /* restricted by sg_alloc_table */
>> unsigned long i;
>> struct scatterlist *sg;
>> struct page *page;
>> @@ -68,6 +68,10 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st,
>> gfp_t noreclaim;
>> int ret;
>>
>> + if (overflows_type(size / PAGE_SIZE, page_count))
>> + return -E2BIG;
>> +
>> + page_count = size / PAGE_SIZE;
>> /*
>> * If there's no chance of allocating enough pages for the whole
>> * object, bail early.
>> @@ -193,7 +197,6 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj)
>> struct drm_i915_private *i915 = to_i915(obj->base.dev);
>> struct intel_memory_region *mem = obj->mm.region;
>> struct address_space *mapping = obj->base.filp->f_mapping;
>> - const unsigned long page_count = obj->base.size / PAGE_SIZE;
>> unsigned int max_segment = i915_sg_segment_size(i915->drm.dev);
>> struct sg_table *st;
>> struct sgt_iter sgt_iter;
>> @@ -236,7 +239,7 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj)
>> } else {
>> dev_warn(i915->drm.dev,
>> "Failed to DMA remap %lu pages\n",
>> - page_count);
>> + obj->base.size >> PAGE_SHIFT);
>> goto err_pages;
>> }
>> }
>> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
>> index 721b716942bb..2cd7a17c720d 100644
>> --- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
>> +++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
>> @@ -829,6 +829,10 @@ static int i915_ttm_get_pages(struct drm_i915_gem_object *obj)
>> struct ttm_place requested, busy[I915_TTM_MAX_PLACEMENTS];
>> struct ttm_placement placement;
>>
>> + /* restricted by sg_alloc_table */
>> + if (overflows_type(obj->base.size >> PAGE_SHIFT, unsigned int))
>> + return -E2BIG;
>> +
>> GEM_BUG_ON(obj->mm.n_placements > I915_TTM_MAX_PLACEMENTS);
>>
>> /* Move to the requested placement. */
>> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
>> index 1b1a22716722..893c03f4a794 100644
>> --- a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
>> +++ b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
>> @@ -128,13 +128,17 @@ static void i915_gem_object_userptr_drop_ref(struct drm_i915_gem_object *obj)
>>
>> static int i915_gem_userptr_get_pages(struct drm_i915_gem_object *obj)
>> {
>> - const unsigned long num_pages = obj->base.size >> PAGE_SHIFT;
>> unsigned int max_segment = i915_sg_segment_size(obj->base.dev->dev);
>> struct sg_table *st;
>> unsigned int sg_page_sizes;
>> struct page **pvec;
>> + unsigned int num_pages; /* limited by sg_alloc_table_from_pages_segment */
>> int ret;
>>
>> + if (overflows_type(obj->base.size >> PAGE_SHIFT, num_pages))
>> + return -E2BIG;
>> +
>> + num_pages = obj->base.size >> PAGE_SHIFT;
>> st = kmalloc(sizeof(*st), GFP_KERNEL);
>> if (!st)
>> return -ENOMEM;
>> diff --git a/drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c b/drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c
>> index f963b8e1e37b..bb1e8f1657a6 100644
>> --- a/drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c
>> +++ b/drivers/gpu/drm/i915/gem/selftests/huge_gem_object.c
>> @@ -29,11 +29,15 @@ static int huge_get_pages(struct drm_i915_gem_object *obj)
>> {
>> #define GFP (GFP_KERNEL | __GFP_NOWARN | __GFP_RETRY_MAYFAIL)
>> const unsigned long nreal = obj->scratch / PAGE_SIZE;
>> - const unsigned long npages = obj->base.size / PAGE_SIZE;
>> + unsigned int npages; /* restricted by sg_alloc_table */
>> struct scatterlist *sg, *src, *end;
>> struct sg_table *pages;
>> unsigned long n;
>>
>> + if (overflows_type(obj->base.size / PAGE_SIZE, npages))
>> + return -E2BIG;
>> +
>> + npages = obj->base.size / PAGE_SIZE;
>> pages = kmalloc(sizeof(*pages), GFP);
>> if (!pages)
>> return -ENOMEM;
>> diff --git a/drivers/gpu/drm/i915/gem/selftests/huge_pages.c b/drivers/gpu/drm/i915/gem/selftests/huge_pages.c
>> index 0cb99e75b0bc..1120a7960d47 100644
>> --- a/drivers/gpu/drm/i915/gem/selftests/huge_pages.c
>> +++ b/drivers/gpu/drm/i915/gem/selftests/huge_pages.c
>> @@ -84,6 +84,10 @@ static int get_huge_pages(struct drm_i915_gem_object *obj)
>> unsigned int sg_page_sizes;
>> u64 rem;
>>
>> + /* restricted by sg_alloc_table */
>> + if (overflows_type(obj->base.size >> PAGE_SHIFT, unsigned int))
>> + return -E2BIG;
>> +
>> st = kmalloc(sizeof(*st), GFP);
>> if (!st)
>> return -ENOMEM;
>> @@ -213,6 +217,10 @@ static int fake_get_huge_pages(struct drm_i915_gem_object *obj)
>> unsigned int sg_page_sizes;
>> u64 rem;
>>
>> + /* restricted by sg_alloc_table */
>> + if (overflows_type(obj->base.size >> PAGE_SHIFT, unsigned int))
>> + return -E2BIG;
>> +
>> st = kmalloc(sizeof(*st), GFP);
>> if (!st)
>> return -ENOMEM;
>> diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c
>> index 01e54b45c5c1..e61cf3beeeba 100644
>> --- a/drivers/gpu/drm/i915/gvt/dmabuf.c
>> +++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
>> @@ -42,8 +42,7 @@
>>
>> #define GEN8_DECODE_PTE(pte) (pte & GENMASK_ULL(63, 12))
>>
>> -static int vgpu_gem_get_pages(
>> - struct drm_i915_gem_object *obj)
>> +static int vgpu_gem_get_pages(struct drm_i915_gem_object *obj)
>> {
>> struct drm_i915_private *dev_priv = to_i915(obj->base.dev);
>> struct intel_vgpu *vgpu;
>> @@ -52,8 +51,12 @@ static int vgpu_gem_get_pages(
>> int i, j, ret;
>> gen8_pte_t __iomem *gtt_entries;
>> struct intel_vgpu_fb_info *fb_info;
>> - u32 page_num;
>> + unsigned int page_num; /* limited by sg_alloc_table */
>>
>> + if (overflows_type(obj->base.size >> PAGE_SHIFT, page_num))
>> + return -E2BIG;
>> +
>> + page_num = obj->base.size >> PAGE_SHIFT;
>> fb_info = (struct intel_vgpu_fb_info *)obj->gvt_info;
>> if (drm_WARN_ON(&dev_priv->drm, !fb_info))
>> return -ENODEV;
>> @@ -66,7 +69,6 @@ static int vgpu_gem_get_pages(
>> if (unlikely(!st))
>> return -ENOMEM;
>>
>> - page_num = obj->base.size >> PAGE_SHIFT;
>> ret = sg_alloc_table(st, page_num, GFP_KERNEL);
>> if (ret) {
>> kfree(st);
>> diff --git a/drivers/gpu/drm/i915/i915_scatterlist.c b/drivers/gpu/drm/i915/i915_scatterlist.c
>> index 114e5e39aa72..c9dc3a917d66 100644
>> --- a/drivers/gpu/drm/i915/i915_scatterlist.c
>> +++ b/drivers/gpu/drm/i915/i915_scatterlist.c
>> @@ -96,6 +96,9 @@ struct i915_refct_sgt *i915_rsgt_from_mm_node(const struct drm_mm_node *node,
>>
>> i915_refct_sgt_init(rsgt, node->size << PAGE_SHIFT);
>> st = &rsgt->table;
>> + /* restricted by sg_alloc_table */
>> + WARN_ON(overflows_type(DIV_ROUND_UP_ULL(node->size, segment_pages),
>> + unsigned int));
>> if (sg_alloc_table(st, DIV_ROUND_UP_ULL(node->size, segment_pages),
>> GFP_KERNEL)) {
>> i915_refct_sgt_put(rsgt);
>> @@ -177,6 +180,8 @@ struct i915_refct_sgt *i915_rsgt_from_buddy_resource(struct ttm_resource *res,
>>
>> i915_refct_sgt_init(rsgt, size);
>> st = &rsgt->table;
>> + /* restricted by sg_alloc_table */
>> + WARN_ON(overflows_type(PFN_UP(res->size), unsigned int));
>> if (sg_alloc_table(st, PFN_UP(res->size), GFP_KERNEL)) {
>> i915_refct_sgt_put(rsgt);
>> return ERR_PTR(-ENOMEM);
>> diff --git a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
>> index 27c733b00976..097be1e89dba 100644
>> --- a/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
>> +++ b/drivers/gpu/drm/i915/selftests/i915_gem_gtt.c
>> @@ -69,6 +69,10 @@ static int fake_get_pages(struct drm_i915_gem_object *obj)
>> return -ENOMEM;
>>
>> rem = round_up(obj->base.size, BIT(31)) >> 31;
>> + /* restricted by sg_alloc_table */
>> + if (overflows_type(rem, unsigned int))
>> + return -E2BIG;
>> +
>> if (sg_alloc_table(pages, rem, GFP)) {
>> kfree(pages);
>> return -ENOMEM;
>> diff --git a/drivers/gpu/drm/i915/selftests/scatterlist.c b/drivers/gpu/drm/i915/selftests/scatterlist.c
>> index d599186d5b71..805c4bfb85fe 100644
>> --- a/drivers/gpu/drm/i915/selftests/scatterlist.c
>> +++ b/drivers/gpu/drm/i915/selftests/scatterlist.c
>> @@ -220,6 +220,10 @@ static int alloc_table(struct pfn_table *pt,
>> struct scatterlist *sg;
>> unsigned long n, pfn;
>>
>> + /* restricted by sg_alloc_table */
>> + if (overflows_type(max, unsigned int))
>> + return -E2BIG;
>> +
>> if (sg_alloc_table(&pt->st, max,
>> GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN))
>> return alloc_error;
--
Jani Nikula, Intel Open Source Graphics Center
^ permalink raw reply [flat|nested] 18+ messages in thread
* [Intel-gfx] [PATCH v14 4/7] drm/i915: Check for integer truncation on the configuration of ttm place
2022-11-02 14:53 [Intel-gfx] [PATCH v14 0/7] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun
` (2 preceding siblings ...)
2022-11-02 14:53 ` [Intel-gfx] [PATCH v14 3/7] drm/i915: Check for integer truncation on scatterlist creation Gwan-gyeong Mun
@ 2022-11-02 14:53 ` Gwan-gyeong Mun
2022-11-02 14:54 ` [Intel-gfx] [PATCH v14 5/7] drm/i915: Check if the size is too big while creating shmem file Gwan-gyeong Mun
` (8 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Gwan-gyeong Mun @ 2022-11-02 14:53 UTC (permalink / raw)
To: intel-gfx
Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld,
mchehab, nirmoy.das
There is an impedance mismatch between the first/last valid page
frame number of ttm place in unsigned and our memory/page accounting in
unsigned long.
As the object size is under the control of userspace, we have to be prudent
and catch the conversion errors.
To catch the implicit truncation as we switch from unsigned long to
unsigned, we use overflows_type check and report E2BIG or overflow_type
prior to the operation.
v3: Not to change execution inside a macro. (Mauro)
Add safe_conversion_gem_bug_on() macro and remove temporal
SAFE_CONVERSION() macro.
v4: Fix unhandled GEM_BUG_ON() macro call from safe_conversion_gem_bug_on()
v6: Fix to follow general use case for GEM_BUG_ON(). (Jani)
v7: Fix to use WARN_ON() macro where GEM_BUG_ON() macro was used. (Jani)
v8: Replace safe_conversion() with check_assign() (Kees)
v14: Split one macro of assignment with checking of overflow to two steps,
first overflow check, and second assignment.
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com> (v2)
Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org> (v3)
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com> (v5)
---
drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 3 +++
drivers/gpu/drm/i915/intel_region_ttm.c | 14 ++++++++++++++
2 files changed, 17 insertions(+)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
index 2cd7a17c720d..598188f85f3c 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
@@ -140,13 +140,16 @@ i915_ttm_place_from_region(const struct intel_memory_region *mr,
if (flags & I915_BO_ALLOC_CONTIGUOUS)
place->flags |= TTM_PL_FLAG_CONTIGUOUS;
if (offset != I915_BO_INVALID_OFFSET) {
+ WARN_ON(overflows_type(offset >> PAGE_SHIFT, place->fpfn));
place->fpfn = offset >> PAGE_SHIFT;
+ WARN_ON(overflows_type(place->fpfn + (size >> PAGE_SHIFT), place->lpfn));
place->lpfn = place->fpfn + (size >> PAGE_SHIFT);
} else if (mr->io_size && mr->io_size < mr->total) {
if (flags & I915_BO_ALLOC_GPU_ONLY) {
place->flags |= TTM_PL_FLAG_TOPDOWN;
} else {
place->fpfn = 0;
+ WARN_ON(overflows_type(mr->io_size >> PAGE_SHIFT, place->lpfn));
place->lpfn = mr->io_size >> PAGE_SHIFT;
}
}
diff --git a/drivers/gpu/drm/i915/intel_region_ttm.c b/drivers/gpu/drm/i915/intel_region_ttm.c
index cf89d0c2a2d9..7f0ec35af098 100644
--- a/drivers/gpu/drm/i915/intel_region_ttm.c
+++ b/drivers/gpu/drm/i915/intel_region_ttm.c
@@ -209,13 +209,25 @@ intel_region_ttm_resource_alloc(struct intel_memory_region *mem,
if (flags & I915_BO_ALLOC_CONTIGUOUS)
place.flags |= TTM_PL_FLAG_CONTIGUOUS;
if (offset != I915_BO_INVALID_OFFSET) {
+ if (WARN_ON(overflows_type(offset >> PAGE_SHIFT, place.fpfn))) {
+ ret = -E2BIG;
+ goto out;
+ }
place.fpfn = offset >> PAGE_SHIFT;
+ if (WARN_ON(overflows_type(place.fpfn + (size >> PAGE_SHIFT), place.lpfn))) {
+ ret = -E2BIG;
+ goto out;
+ }
place.lpfn = place.fpfn + (size >> PAGE_SHIFT);
} else if (mem->io_size && mem->io_size < mem->total) {
if (flags & I915_BO_ALLOC_GPU_ONLY) {
place.flags |= TTM_PL_FLAG_TOPDOWN;
} else {
place.fpfn = 0;
+ if (WARN_ON(overflows_type(mem->io_size >> PAGE_SHIFT, place.lpfn))) {
+ ret = -E2BIG;
+ goto out;
+ }
place.lpfn = mem->io_size >> PAGE_SHIFT;
}
}
@@ -224,6 +236,8 @@ intel_region_ttm_resource_alloc(struct intel_memory_region *mem,
mock_bo.bdev = &mem->i915->bdev;
ret = man->func->alloc(man, &mock_bo, &place, &res);
+
+out:
if (ret == -ENOSPC)
ret = -ENXIO;
if (!ret)
--
2.37.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* [Intel-gfx] [PATCH v14 5/7] drm/i915: Check if the size is too big while creating shmem file
2022-11-02 14:53 [Intel-gfx] [PATCH v14 0/7] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun
` (3 preceding siblings ...)
2022-11-02 14:53 ` [Intel-gfx] [PATCH v14 4/7] drm/i915: Check for integer truncation on the configuration of ttm place Gwan-gyeong Mun
@ 2022-11-02 14:54 ` Gwan-gyeong Mun
2022-11-02 14:54 ` [Intel-gfx] [PATCH v14 6/7] drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large Gwan-gyeong Mun
` (7 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Gwan-gyeong Mun @ 2022-11-02 14:54 UTC (permalink / raw)
To: intel-gfx
Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld,
mchehab, nirmoy.das
The __shmem_file_setup() function returns -EINVAL if size is greater than
MAX_LFS_FILESIZE. To handle the same error as other code that returns
-E2BIG when the size is too large, it add a code that returns -E2BIG when
the size is larger than the size that can be handled.
v4: If BITS_PER_LONG is 32, size > MAX_LFS_FILESIZE is always false, so it
checks only when BITS_PER_LONG is 64.
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com>
---
drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
index fdd9d151ac1f..1885c81c2baa 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
@@ -541,6 +541,20 @@ static int __create_shmem(struct drm_i915_private *i915,
drm_gem_private_object_init(&i915->drm, obj, size);
+ /* XXX: The __shmem_file_setup() function returns -EINVAL if size is
+ * greater than MAX_LFS_FILESIZE.
+ * To handle the same error as other code that returns -E2BIG when
+ * the size is too large, we add a code that returns -E2BIG when the
+ * size is larger than the size that can be handled.
+ * If BITS_PER_LONG is 32, size > MAX_LFS_FILESIZE is always false,
+ * so we only needs to check when BITS_PER_LONG is 64.
+ * If BITS_PER_LONG is 32, E2BIG checks are processed when
+ * i915_gem_object_size_2big() is called before init_object() callback
+ * is called.
+ */
+ if (BITS_PER_LONG == 64 && size > MAX_LFS_FILESIZE)
+ return -E2BIG;
+
if (i915->mm.gemfs)
filp = shmem_file_setup_with_mnt(i915->mm.gemfs, "i915", size,
flags);
--
2.37.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* [Intel-gfx] [PATCH v14 6/7] drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large
2022-11-02 14:53 [Intel-gfx] [PATCH v14 0/7] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun
` (4 preceding siblings ...)
2022-11-02 14:54 ` [Intel-gfx] [PATCH v14 5/7] drm/i915: Check if the size is too big while creating shmem file Gwan-gyeong Mun
@ 2022-11-02 14:54 ` Gwan-gyeong Mun
2022-11-02 14:54 ` [Intel-gfx] [PATCH v14 7/7] drm/i915: Remove truncation warning for large objects Gwan-gyeong Mun
` (6 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Gwan-gyeong Mun @ 2022-11-02 14:54 UTC (permalink / raw)
To: intel-gfx
Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld,
mchehab, nirmoy.das
The ttm_bo_init_reserved() functions returns -ENOSPC if the size is too big
to add vma. The direct function that returns -ENOSPC is drm_mm_insert_node_in_range().
To handle the same error as other code returning -E2BIG when the size is
too large, it converts return value to -E2BIG.
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com>
---
drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
index 598188f85f3c..65952d923e9f 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
@@ -1305,6 +1305,17 @@ int __i915_gem_ttm_object_init(struct intel_memory_region *mem,
ret = ttm_bo_init_reserved(&i915->bdev, i915_gem_to_ttm(obj), bo_type,
&i915_sys_placement, page_size >> PAGE_SHIFT,
&ctx, NULL, NULL, i915_ttm_bo_destroy);
+
+ /*
+ * XXX: The ttm_bo_init_reserved() functions returns -ENOSPC if the size
+ * is too big to add vma. The direct function that returns -ENOSPC is
+ * drm_mm_insert_node_in_range(). To handle the same error as other code
+ * that returns -E2BIG when the size is too large, it converts -ENOSPC to
+ * -E2BIG.
+ */
+ if (size >> PAGE_SHIFT > INT_MAX && ret == -ENOSPC)
+ ret = -E2BIG;
+
if (ret)
return i915_ttm_err_to_gem(ret);
--
2.37.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* [Intel-gfx] [PATCH v14 7/7] drm/i915: Remove truncation warning for large objects
2022-11-02 14:53 [Intel-gfx] [PATCH v14 0/7] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun
` (5 preceding siblings ...)
2022-11-02 14:54 ` [Intel-gfx] [PATCH v14 6/7] drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large Gwan-gyeong Mun
@ 2022-11-02 14:54 ` Gwan-gyeong Mun
2022-11-02 16:21 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Patchwork
` (5 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Gwan-gyeong Mun @ 2022-11-02 14:54 UTC (permalink / raw)
To: intel-gfx
Cc: thomas.hellstrom, andrzej.hajda, jani.nikula, chris, matthew.auld,
mchehab, nirmoy.das
From: Chris Wilson <chris@chris-wilson.co.uk>
Having addressed the issues surrounding incorrect types for local
variables and potential integer truncation in using the scatterlist API,
we have closed all the loop holes we had previously identified with
dangerously large object creation. As such, we can eliminate the warning
put in place to remind us to complete the review.
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Brian Welty <brian.welty@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Testcase: igt@gem_create@create-massive
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/4991
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com>
---
drivers/gpu/drm/i915/gem/i915_gem_object.h | 15 ---------------
1 file changed, 15 deletions(-)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object.h b/drivers/gpu/drm/i915/gem/i915_gem_object.h
index 8cd8d2041c5a..ca2e79b4ab65 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_object.h
+++ b/drivers/gpu/drm/i915/gem/i915_gem_object.h
@@ -20,25 +20,10 @@
enum intel_region_id;
-/*
- * XXX: There is a prevalence of the assumption that we fit the
- * object's page count inside a 32bit _signed_ variable. Let's document
- * this and catch if we ever need to fix it. In the meantime, if you do
- * spot such a local variable, please consider fixing!
- *
- * We can check for invalidly typed locals with typecheck(), see for example
- * i915_gem_object_get_sg().
- */
-#define GEM_CHECK_SIZE_OVERFLOW(sz) \
- GEM_WARN_ON((sz) >> PAGE_SHIFT > INT_MAX)
-
static inline bool i915_gem_object_size_2big(u64 size)
{
struct drm_i915_gem_object *obj;
- if (GEM_CHECK_SIZE_OVERFLOW(size))
- return true;
-
if (overflows_type(size, obj->base.size))
return true;
--
2.37.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation
2022-11-02 14:53 [Intel-gfx] [PATCH v14 0/7] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun
` (6 preceding siblings ...)
2022-11-02 14:54 ` [Intel-gfx] [PATCH v14 7/7] drm/i915: Remove truncation warning for large objects Gwan-gyeong Mun
@ 2022-11-02 16:21 ` Patchwork
2022-11-02 16:21 ` [Intel-gfx] ✗ Fi.CI.SPARSE: " Patchwork
` (4 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Patchwork @ 2022-11-02 16:21 UTC (permalink / raw)
To: Gwan-gyeong Mun; +Cc: intel-gfx
== Series Details ==
Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation
URL : https://patchwork.freedesktop.org/series/110413/
State : warning
== Summary ==
Error: dim checkpatch failed
2d63cbfb6b5f overflow: Introduce overflows_type() and castable_to_type()
-:27: WARNING:COMMIT_LOG_LONG_LINE: Possible unwrapped commit description (prefer a maximum 75 chars per line)
#27:
[16:03:33] Elapsed time: 24.022s total, 0.002s configuring, 22.598s building, 0.767s running
-:99: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'x' - possible side-effects?
#99: FILE: include/linux/overflow.h:131:
+#define __overflows_type_constexpr(x, T) ( \
+ is_unsigned_type(typeof(x)) ? \
+ (x) > type_max(typeof(T)) ? 1 : 0 \
+ : is_unsigned_type(typeof(T)) ? \
+ (x) < 0 || (x) > type_max(typeof(T)) ? 1 : 0 \
+ : (x) < type_min(typeof(T)) || \
+ (x) > type_max(typeof(T)) ? 1 : 0)
-:100: CHECK:SPACING: No space is necessary after a cast
#100: FILE: include/linux/overflow.h:132:
+ is_unsigned_type(typeof(x)) ? \
-:101: CHECK:SPACING: No space is necessary after a cast
#101: FILE: include/linux/overflow.h:133:
+ (x) > type_max(typeof(T)) ? 1 : 0 \
-:102: CHECK:SPACING: No space is necessary after a cast
#102: FILE: include/linux/overflow.h:134:
+ : is_unsigned_type(typeof(T)) ? \
-:103: CHECK:SPACING: No space is necessary after a cast
#103: FILE: include/linux/overflow.h:135:
+ (x) < 0 || (x) > type_max(typeof(T)) ? 1 : 0 \
-:104: CHECK:SPACING: No space is necessary after a cast
#104: FILE: include/linux/overflow.h:136:
+ : (x) < type_min(typeof(T)) || \
-:105: CHECK:SPACING: No space is necessary after a cast
#105: FILE: include/linux/overflow.h:137:
+ (x) > type_max(typeof(T)) ? 1 : 0)
-:126: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#126: FILE: include/linux/overflow.h:158:
+#define overflows_type(n, T) \
+ __builtin_choose_expr(__is_constexpr(n), \
+ __overflows_type_constexpr(n, T), \
+ __overflows_type(n, T))
-:126: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'T' - possible side-effects?
#126: FILE: include/linux/overflow.h:158:
+#define overflows_type(n, T) \
+ __builtin_choose_expr(__is_constexpr(n), \
+ __overflows_type_constexpr(n, T), \
+ __overflows_type(n, T))
-:142: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#142: FILE: include/linux/overflow.h:174:
+#define castable_to_type(n, T) \
+ __builtin_choose_expr(__is_constexpr(n), \
+ !__overflows_type_constexpr(n, T), \
+ __same_type(n, T))
-:142: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'T' - possible side-effects?
#142: FILE: include/linux/overflow.h:174:
+#define castable_to_type(n, T) \
+ __builtin_choose_expr(__is_constexpr(n), \
+ !__overflows_type_constexpr(n, T), \
+ __same_type(n, T))
-:175: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'of' - possible side-effects?
#175: FILE: lib/overflow_kunit.c:744:
+#define __TEST_OVERFLOWS_TYPE(func, arg1, arg2, of) do { \
+ bool __of = func(arg1, arg2); \
+ KUNIT_EXPECT_EQ_MSG(test, __of, of, \
+ "expected " #func "(" #arg1 ", " #arg2 " to%s overflow\n",\
+ of ? "" : " not"); \
+ count++; \
+} while (0)
-:184: CHECK:MACRO_ARG_REUSE: Macro argument reuse '__t2' - possible side-effects?
#184: FILE: lib/overflow_kunit.c:753:
+#define TEST_OVERFLOWS_TYPE(__t1, __t2, v, of) do { \
+ __t1 t1 = (v); \
+ __t2 t2; \
+ __TEST_OVERFLOWS_TYPE(__overflows_type, t1, t2, of); \
+ __TEST_OVERFLOWS_TYPE(__overflows_type, t1, __t2, of); \
+ __TEST_OVERFLOWS_TYPE(__overflows_type_constexpr, t1, t2, of); \
+ __TEST_OVERFLOWS_TYPE(__overflows_type_constexpr, t1, __t2, of);\
+} while (0)
-:184: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'of' - possible side-effects?
#184: FILE: lib/overflow_kunit.c:753:
+#define TEST_OVERFLOWS_TYPE(__t1, __t2, v, of) do { \
+ __t1 t1 = (v); \
+ __t2 t2; \
+ __TEST_OVERFLOWS_TYPE(__overflows_type, t1, t2, of); \
+ __TEST_OVERFLOWS_TYPE(__overflows_type, t1, __t2, of); \
+ __TEST_OVERFLOWS_TYPE(__overflows_type_constexpr, t1, t2, of); \
+ __TEST_OVERFLOWS_TYPE(__overflows_type_constexpr, t1, __t2, of);\
+} while (0)
-:387: CHECK:MACRO_ARG_REUSE: Macro argument reuse 't1' - possible side-effects?
#387: FILE: lib/overflow_kunit.c:956:
+#define TEST_SAME_TYPE(t1, t2, same) do { \
+ typeof(t1) __t1h = type_max(t1); \
+ typeof(t1) __t1l = type_min(t1); \
+ typeof(t2) __t2h = type_max(t2); \
+ typeof(t2) __t2l = type_min(t2); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t1, __t1h)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t1, __t1l)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t1h, t1)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t1l, t1)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t2, __t2h)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t2, __t2l)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t2h, t2)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t2l, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t2, __t1h)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t2, __t1l)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t1h, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t1l, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, __t2h)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, __t2l)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t2h, t1)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t2l, t1)); \
+} while (0)
-:387: CHECK:MACRO_ARG_REUSE: Macro argument reuse 't2' - possible side-effects?
#387: FILE: lib/overflow_kunit.c:956:
+#define TEST_SAME_TYPE(t1, t2, same) do { \
+ typeof(t1) __t1h = type_max(t1); \
+ typeof(t1) __t1l = type_min(t1); \
+ typeof(t2) __t2h = type_max(t2); \
+ typeof(t2) __t2l = type_min(t2); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t1, __t1h)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t1, __t1l)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t1h, t1)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t1l, t1)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t2, __t2h)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t2, __t2l)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t2h, t2)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t2l, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t2, __t1h)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t2, __t1l)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t1h, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t1l, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, __t2h)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, __t2l)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t2h, t1)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t2l, t1)); \
+} while (0)
-:387: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'same' - possible side-effects?
#387: FILE: lib/overflow_kunit.c:956:
+#define TEST_SAME_TYPE(t1, t2, same) do { \
+ typeof(t1) __t1h = type_max(t1); \
+ typeof(t1) __t1l = type_min(t1); \
+ typeof(t2) __t2h = type_max(t2); \
+ typeof(t2) __t2l = type_min(t2); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t1, __t1h)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t1, __t1l)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t1h, t1)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t1l, t1)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t2, __t2h)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t2, __t2l)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t2h, t2)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t2l, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t2, __t1h)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t2, __t1l)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t1h, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t1l, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, __t2h)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, __t2l)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t2h, t1)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t2l, t1)); \
+} while (0)
-:417: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'base' - possible side-effects?
#417: FILE: lib/overflow_kunit.c:986:
+#define TEST_TYPE_SETS(base, mu8, mu16, mu32, ms8, ms16, ms32, mu64, ms64) \
+do { \
+ TEST_SAME_TYPE(base, u8, mu8); \
+ TEST_SAME_TYPE(base, u16, mu16); \
+ TEST_SAME_TYPE(base, u32, mu32); \
+ TEST_SAME_TYPE(base, s8, ms8); \
+ TEST_SAME_TYPE(base, s16, ms16); \
+ TEST_SAME_TYPE(base, s32, ms32); \
+ TEST_SAME_TYPE64(base, u64, mu64); \
+ TEST_SAME_TYPE64(base, s64, ms64); \
+} while (0)
-:461: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'pass' - possible side-effects?
#461: FILE: lib/overflow_kunit.c:1030:
+#define TEST_CASTABLE_TO_TYPE(arg1, arg2, pass) do { \
+ bool __pass = castable_to_type(arg1, arg2); \
+ KUNIT_EXPECT_EQ_MSG(test, __pass, pass, \
+ "expected castable_to_type(" #arg1 ", " #arg2 ") to%s pass\n",\
+ pass ? "" : " not"); \
+ count++; \
+} while (0)
total: 0 errors, 1 warnings, 19 checks, 479 lines checked
1c86c61e0edd drm/i915/gem: Typecheck page lookups
-:35: WARNING:BAD_SIGN_OFF: Co-developed-by and Signed-off-by: name/email do not match
#35:
Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
-:55: WARNING:DEPRECATED_API: Deprecated use of 'kmap_atomic', prefer 'kmap_local_page' instead
#55: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.c:434:
+ src_map = kmap_atomic(i915_gem_object_get_page(obj, idx));
-:75: WARNING:AVOID_BUG: Do not crash the kernel unless it is absolutely unavoidable--use WARN_ON_ONCE() plus recovery code (if feasible) instead of BUG() or variants
#75: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.c:489:
+ GEM_BUG_ON(overflows_type(offset >> PAGE_SHIFT, pgoff_t));
-:149: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#149: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:413:
+#define i915_gem_object_page_iter_get_sg(obj, it, n, offset) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_page_iter_get_sg(obj, it, n, offset); \
+})
-:150: ERROR:SPACING: space prohibited before that ',' (ctx:WxW)
#150: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:414:
+ static_assert(castable_to_type(n , pgoff_t)); \
^
-:198: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#198: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:458:
+#define i915_gem_object_get_sg(obj, n, offset) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_sg(obj, n, offset); \
+})
-:199: ERROR:SPACING: space prohibited before that ',' (ctx:WxW)
#199: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:459:
+ static_assert(castable_to_type(n , pgoff_t)); \
^
-:247: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#247: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:503:
+#define i915_gem_object_get_sg_dma(obj, n, offset) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_sg_dma(obj, n, offset); \
+})
-:248: ERROR:SPACING: space prohibited before that ',' (ctx:WxW)
#248: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:504:
+ static_assert(castable_to_type(n , pgoff_t)); \
^
-:285: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#285: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:539:
+#define i915_gem_object_get_page(obj, n) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_page(obj, n); \
+})
-:286: ERROR:SPACING: space prohibited before that ',' (ctx:WxW)
#286: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:540:
+ static_assert(castable_to_type(n , pgoff_t)); \
^
-:322: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#322: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:574:
+#define i915_gem_object_get_dirty_page(obj, n) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_dirty_page(obj, n); \
+})
-:323: ERROR:SPACING: space prohibited before that ',' (ctx:WxW)
#323: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:575:
+ static_assert(castable_to_type(n , pgoff_t)); \
^
-:363: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#363: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:612:
+#define i915_gem_object_get_dma_address_len(obj, n, len) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_dma_address_len(obj, n, len); \
+})
-:364: ERROR:SPACING: space prohibited before that ',' (ctx:WxW)
#364: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:613:
+ static_assert(castable_to_type(n , pgoff_t)); \
^
-:400: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#400: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:647:
+#define i915_gem_object_get_dma_address(obj, n) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_dma_address(obj, n); \
+})
-:401: ERROR:SPACING: space prohibited before that ',' (ctx:WxW)
#401: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:648:
+ static_assert(castable_to_type(n , pgoff_t)); \
^
total: 7 errors, 3 warnings, 7 checks, 616 lines checked
05e06d247360 drm/i915: Check for integer truncation on scatterlist creation
-:39: WARNING:BAD_SIGN_OFF: Co-developed-by and Signed-off-by: name/email do not match
#39:
Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
total: 0 errors, 1 warnings, 0 checks, 205 lines checked
c44ff34bf6eb drm/i915: Check for integer truncation on the configuration of ttm place
361ed3089b5c drm/i915: Check if the size is too big while creating shmem file
062498d16fbb drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large
-:11: WARNING:COMMIT_LOG_LONG_LINE: Possible unwrapped commit description (prefer a maximum 75 chars per line)
#11:
to add vma. The direct function that returns -ENOSPC is drm_mm_insert_node_in_range().
total: 0 errors, 1 warnings, 0 checks, 17 lines checked
79d1807c80a2 drm/i915: Remove truncation warning for large objects
^ permalink raw reply [flat|nested] 18+ messages in thread* [Intel-gfx] ✗ Fi.CI.SPARSE: warning for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation
2022-11-02 14:53 [Intel-gfx] [PATCH v14 0/7] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun
` (7 preceding siblings ...)
2022-11-02 16:21 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Patchwork
@ 2022-11-02 16:21 ` Patchwork
2022-11-02 16:43 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork
` (3 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Patchwork @ 2022-11-02 16:21 UTC (permalink / raw)
To: Gwan-gyeong Mun; +Cc: intel-gfx
== Series Details ==
Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation
URL : https://patchwork.freedesktop.org/series/110413/
State : warning
== Summary ==
Error: dim sparse failed
Sparse version: v0.6.2
Fast mode used, each commit won't be checked separately.
^ permalink raw reply [flat|nested] 18+ messages in thread* [Intel-gfx] ✓ Fi.CI.BAT: success for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation
2022-11-02 14:53 [Intel-gfx] [PATCH v14 0/7] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun
` (8 preceding siblings ...)
2022-11-02 16:21 ` [Intel-gfx] ✗ Fi.CI.SPARSE: " Patchwork
@ 2022-11-02 16:43 ` Patchwork
2022-11-02 20:56 ` [Intel-gfx] ✗ Fi.CI.IGT: failure " Patchwork
` (2 subsequent siblings)
12 siblings, 0 replies; 18+ messages in thread
From: Patchwork @ 2022-11-02 16:43 UTC (permalink / raw)
To: Gwan-gyeong Mun; +Cc: intel-gfx
[-- Attachment #1: Type: text/plain, Size: 5244 bytes --]
== Series Details ==
Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation
URL : https://patchwork.freedesktop.org/series/110413/
State : success
== Summary ==
CI Bug Log - changes from CI_DRM_12332 -> Patchwork_110413v1
====================================================
Summary
-------
**SUCCESS**
No regressions found.
External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/index.html
Participating hosts (40 -> 28)
------------------------------
Additional (1): fi-tgl-dsi
Missing (13): bat-dg2-8 bat-adlm-1 fi-icl-u2 bat-dg2-9 bat-adlp-6 bat-adlp-4 fi-hsw-4770 bat-adln-1 bat-rplp-1 bat-rpls-1 bat-rpls-2 bat-dg2-11 bat-jsl-1
Known issues
------------
Here are the changes found in Patchwork_110413v1 that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@gem_exec_gttfill@basic:
- fi-pnv-d510: [PASS][1] -> [FAIL][2] ([i915#7229])
[1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/fi-pnv-d510/igt@gem_exec_gttfill@basic.html
[2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/fi-pnv-d510/igt@gem_exec_gttfill@basic.html
* igt@gem_tiled_blits@basic:
- fi-pnv-d510: [PASS][3] -> [SKIP][4] ([fdo#109271])
[3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/fi-pnv-d510/igt@gem_tiled_blits@basic.html
[4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/fi-pnv-d510/igt@gem_tiled_blits@basic.html
* igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions-varying-size:
- fi-bsw-kefka: [PASS][5] -> [FAIL][6] ([i915#6298])
[5]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions-varying-size.html
[6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/fi-bsw-kefka/igt@kms_cursor_legacy@basic-busy-flip-before-cursor@atomic-transitions-varying-size.html
#### Possible fixes ####
* igt@i915_selftest@live@gt_heartbeat:
- fi-apl-guc: [DMESG-FAIL][7] ([i915#5334]) -> [PASS][8]
[7]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/fi-apl-guc/igt@i915_selftest@live@gt_heartbeat.html
[8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/fi-apl-guc/igt@i915_selftest@live@gt_heartbeat.html
* igt@i915_selftest@live@hangcheck:
- fi-adl-ddr5: [DMESG-WARN][9] ([i915#5591]) -> [PASS][10]
[9]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/fi-adl-ddr5/igt@i915_selftest@live@hangcheck.html
[10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/fi-adl-ddr5/igt@i915_selftest@live@hangcheck.html
{name}: This element is suppressed. This means it is ignored when computing
the status of the difference (SUCCESS, WARNING, or FAILURE).
[fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271
[fdo#109284]: https://bugs.freedesktop.org/show_bug.cgi?id=109284
[fdo#109285]: https://bugs.freedesktop.org/show_bug.cgi?id=109285
[fdo#109295]: https://bugs.freedesktop.org/show_bug.cgi?id=109295
[fdo#110189]: https://bugs.freedesktop.org/show_bug.cgi?id=110189
[fdo#111827]: https://bugs.freedesktop.org/show_bug.cgi?id=111827
[i915#2190]: https://gitlab.freedesktop.org/drm/intel/issues/2190
[i915#2411]: https://gitlab.freedesktop.org/drm/intel/issues/2411
[i915#3301]: https://gitlab.freedesktop.org/drm/intel/issues/3301
[i915#3555]: https://gitlab.freedesktop.org/drm/intel/issues/3555
[i915#4103]: https://gitlab.freedesktop.org/drm/intel/issues/4103
[i915#4312]: https://gitlab.freedesktop.org/drm/intel/issues/4312
[i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613
[i915#5334]: https://gitlab.freedesktop.org/drm/intel/issues/5334
[i915#5591]: https://gitlab.freedesktop.org/drm/intel/issues/5591
[i915#6298]: https://gitlab.freedesktop.org/drm/intel/issues/6298
[i915#6856]: https://gitlab.freedesktop.org/drm/intel/issues/6856
[i915#7125]: https://gitlab.freedesktop.org/drm/intel/issues/7125
[i915#7229]: https://gitlab.freedesktop.org/drm/intel/issues/7229
Build changes
-------------
* Linux: CI_DRM_12332 -> Patchwork_110413v1
CI-20190529: 20190529
CI_DRM_12332: 601b2ef606e4b83d5518aa6a5011bb2b1c5954d9 @ git://anongit.freedesktop.org/gfx-ci/linux
IGT_7038: 5389b3f3b9b75df6bd8506e4aa3da357fd0c0ab1 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git
Patchwork_110413v1: 601b2ef606e4b83d5518aa6a5011bb2b1c5954d9 @ git://anongit.freedesktop.org/gfx-ci/linux
### Linux commits
f71c44d6a1a6 drm/i915: Remove truncation warning for large objects
641448151051 drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large
36329637fb5b drm/i915: Check if the size is too big while creating shmem file
67fe599cfb22 drm/i915: Check for integer truncation on the configuration of ttm place
f4b2efa46ed0 drm/i915: Check for integer truncation on scatterlist creation
7e6baa93be9b drm/i915/gem: Typecheck page lookups
4711dd3008b8 overflow: Introduce overflows_type() and castable_to_type()
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/index.html
[-- Attachment #2: Type: text/html, Size: 5067 bytes --]
^ permalink raw reply [flat|nested] 18+ messages in thread* [Intel-gfx] ✗ Fi.CI.IGT: failure for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation
2022-11-02 14:53 [Intel-gfx] [PATCH v14 0/7] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun
` (9 preceding siblings ...)
2022-11-02 16:43 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork
@ 2022-11-02 20:56 ` Patchwork
2022-11-03 6:46 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation (rev2) Patchwork
2022-11-03 7:07 ` [Intel-gfx] ✗ Fi.CI.BAT: failure " Patchwork
12 siblings, 0 replies; 18+ messages in thread
From: Patchwork @ 2022-11-02 20:56 UTC (permalink / raw)
To: Gwan-gyeong Mun; +Cc: intel-gfx
[-- Attachment #1: Type: text/plain, Size: 47225 bytes --]
== Series Details ==
Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation
URL : https://patchwork.freedesktop.org/series/110413/
State : failure
== Summary ==
CI Bug Log - changes from CI_DRM_12332_full -> Patchwork_110413v1_full
====================================================
Summary
-------
**FAILURE**
Serious unknown changes coming with Patchwork_110413v1_full absolutely need to be
verified manually.
If you think the reported changes have nothing to do with the changes
introduced in Patchwork_110413v1_full, please notify your bug team to allow them
to document this new failure mode, which will reduce false positives in CI.
Participating hosts (9 -> 9)
------------------------------
No changes in participating hosts
Possible new issues
-------------------
Here are the unknown changes that may have been introduced in Patchwork_110413v1_full:
### IGT changes ###
#### Possible regressions ####
* igt@sysfs_heartbeat_interval@mixed@rcs0:
- shard-skl: [PASS][1] -> [INCOMPLETE][2]
[1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl10/igt@sysfs_heartbeat_interval@mixed@rcs0.html
[2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl9/igt@sysfs_heartbeat_interval@mixed@rcs0.html
Known issues
------------
Here are the changes found in Patchwork_110413v1_full that come from known issues:
### CI changes ###
#### Issues hit ####
* boot:
- shard-snb: ([PASS][3], [PASS][4], [PASS][5], [PASS][6], [PASS][7], [PASS][8], [PASS][9], [PASS][10], [PASS][11], [PASS][12], [PASS][13], [PASS][14], [PASS][15], [PASS][16], [PASS][17], [PASS][18], [PASS][19], [PASS][20], [PASS][21], [PASS][22], [PASS][23], [PASS][24], [PASS][25], [PASS][26], [PASS][27]) -> ([PASS][28], [PASS][29], [PASS][30], [PASS][31], [PASS][32], [PASS][33], [PASS][34], [PASS][35], [PASS][36], [PASS][37], [FAIL][38], [PASS][39], [PASS][40], [PASS][41], [PASS][42], [PASS][43], [PASS][44], [PASS][45], [PASS][46], [PASS][47], [PASS][48], [PASS][49], [PASS][50], [PASS][51], [PASS][52]) ([i915#4338])
[3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb7/boot.html
[4]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb7/boot.html
[5]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb7/boot.html
[6]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb7/boot.html
[7]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb7/boot.html
[8]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb6/boot.html
[9]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb6/boot.html
[10]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb6/boot.html
[11]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb6/boot.html
[12]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb6/boot.html
[13]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb5/boot.html
[14]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb5/boot.html
[15]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb5/boot.html
[16]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb5/boot.html
[17]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb5/boot.html
[18]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb5/boot.html
[19]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb4/boot.html
[20]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb4/boot.html
[21]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb4/boot.html
[22]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb4/boot.html
[23]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb2/boot.html
[24]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb2/boot.html
[25]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb2/boot.html
[26]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb2/boot.html
[27]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb2/boot.html
[28]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb2/boot.html
[29]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb2/boot.html
[30]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb2/boot.html
[31]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb2/boot.html
[32]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb2/boot.html
[33]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb4/boot.html
[34]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb4/boot.html
[35]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb4/boot.html
[36]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb4/boot.html
[37]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb5/boot.html
[38]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb5/boot.html
[39]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb5/boot.html
[40]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb5/boot.html
[41]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb5/boot.html
[42]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb5/boot.html
[43]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb6/boot.html
[44]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb6/boot.html
[45]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb6/boot.html
[46]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb6/boot.html
[47]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb6/boot.html
[48]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb7/boot.html
[49]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb7/boot.html
[50]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb7/boot.html
[51]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb7/boot.html
[52]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb7/boot.html
### IGT changes ###
#### Issues hit ####
* igt@feature_discovery@psr2:
- shard-iclb: [PASS][53] -> [SKIP][54] ([i915#658])
[53]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-iclb2/igt@feature_discovery@psr2.html
[54]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb6/igt@feature_discovery@psr2.html
* igt@gem_ccs@block-copy-uncompressed:
- shard-iclb: NOTRUN -> [SKIP][55] ([i915#5327])
[55]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb3/igt@gem_ccs@block-copy-uncompressed.html
* igt@gem_ctx_exec@basic-nohangcheck:
- shard-tglb: [PASS][56] -> [FAIL][57] ([i915#6268])
[56]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-tglb5/igt@gem_ctx_exec@basic-nohangcheck.html
[57]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb2/igt@gem_ctx_exec@basic-nohangcheck.html
* igt@gem_ctx_isolation@preservation-s3@bcs0:
- shard-apl: [PASS][58] -> [DMESG-WARN][59] ([i915#180])
[58]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-apl7/igt@gem_ctx_isolation@preservation-s3@bcs0.html
[59]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-apl8/igt@gem_ctx_isolation@preservation-s3@bcs0.html
* igt@gem_exec_balancer@parallel-keep-in-fence:
- shard-iclb: [PASS][60] -> [SKIP][61] ([i915#4525]) +1 similar issue
[60]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-iclb2/igt@gem_exec_balancer@parallel-keep-in-fence.html
[61]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb7/igt@gem_exec_balancer@parallel-keep-in-fence.html
* igt@gem_exec_fair@basic-deadline:
- shard-glk: [PASS][62] -> [FAIL][63] ([i915#2846])
[62]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-glk8/igt@gem_exec_fair@basic-deadline.html
[63]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-glk5/igt@gem_exec_fair@basic-deadline.html
* igt@gem_exec_fair@basic-pace-share@rcs0:
- shard-glk: [PASS][64] -> [FAIL][65] ([i915#2842])
[64]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-glk7/igt@gem_exec_fair@basic-pace-share@rcs0.html
[65]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-glk1/igt@gem_exec_fair@basic-pace-share@rcs0.html
* igt@gem_lmem_swapping@basic:
- shard-skl: NOTRUN -> [SKIP][66] ([fdo#109271] / [i915#4613]) +2 similar issues
[66]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl1/igt@gem_lmem_swapping@basic.html
* igt@gem_lmem_swapping@heavy-verify-random:
- shard-apl: NOTRUN -> [SKIP][67] ([fdo#109271] / [i915#4613]) +3 similar issues
[67]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-apl6/igt@gem_lmem_swapping@heavy-verify-random.html
- shard-tglb: NOTRUN -> [SKIP][68] ([i915#4613])
[68]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb7/igt@gem_lmem_swapping@heavy-verify-random.html
- shard-glk: NOTRUN -> [SKIP][69] ([fdo#109271] / [i915#4613])
[69]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-glk1/igt@gem_lmem_swapping@heavy-verify-random.html
- shard-iclb: NOTRUN -> [SKIP][70] ([i915#4613])
[70]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@gem_lmem_swapping@heavy-verify-random.html
* igt@gem_pread@exhaustion:
- shard-apl: NOTRUN -> [INCOMPLETE][71] ([i915#7248])
[71]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-apl7/igt@gem_pread@exhaustion.html
* igt@gem_pxp@reject-modify-context-protection-on:
- shard-tglb: NOTRUN -> [SKIP][72] ([i915#4270]) +2 similar issues
[72]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb3/igt@gem_pxp@reject-modify-context-protection-on.html
* igt@gem_pxp@verify-pxp-stale-buf-execution:
- shard-iclb: NOTRUN -> [SKIP][73] ([i915#4270]) +2 similar issues
[73]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb3/igt@gem_pxp@verify-pxp-stale-buf-execution.html
* igt@gem_render_copy@yf-tiled-to-vebox-x-tiled:
- shard-iclb: NOTRUN -> [SKIP][74] ([i915#768])
[74]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@gem_render_copy@yf-tiled-to-vebox-x-tiled.html
* igt@gem_softpin@evict-single-offset:
- shard-apl: NOTRUN -> [FAIL][75] ([i915#4171])
[75]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-apl1/igt@gem_softpin@evict-single-offset.html
* igt@gem_spin_batch@spin-each:
- shard-skl: [PASS][76] -> [FAIL][77] ([i915#2898])
[76]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl1/igt@gem_spin_batch@spin-each.html
[77]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl5/igt@gem_spin_batch@spin-each.html
* igt@gem_userptr_blits@probe:
- shard-apl: NOTRUN -> [FAIL][78] ([i915#7247])
[78]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-apl6/igt@gem_userptr_blits@probe.html
- shard-tglb: NOTRUN -> [FAIL][79] ([i915#7224])
[79]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb3/igt@gem_userptr_blits@probe.html
- shard-glk: NOTRUN -> [FAIL][80] ([i915#7247])
[80]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-glk1/igt@gem_userptr_blits@probe.html
- shard-skl: NOTRUN -> [FAIL][81] ([i915#7247])
[81]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl9/igt@gem_userptr_blits@probe.html
- shard-iclb: NOTRUN -> [FAIL][82] ([i915#7247])
[82]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb3/igt@gem_userptr_blits@probe.html
* igt@gen7_exec_parse@chained-batch:
- shard-tglb: NOTRUN -> [SKIP][83] ([fdo#109289])
[83]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb7/igt@gen7_exec_parse@chained-batch.html
- shard-iclb: NOTRUN -> [SKIP][84] ([fdo#109289])
[84]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@gen7_exec_parse@chained-batch.html
* igt@gen9_exec_parse@allowed-single:
- shard-glk: [PASS][85] -> [DMESG-WARN][86] ([i915#5566] / [i915#716])
[85]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-glk3/igt@gen9_exec_parse@allowed-single.html
[86]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-glk7/igt@gen9_exec_parse@allowed-single.html
* igt@gen9_exec_parse@batch-zero-length:
- shard-tglb: NOTRUN -> [SKIP][87] ([i915#2527] / [i915#2856]) +1 similar issue
[87]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb7/igt@gen9_exec_parse@batch-zero-length.html
- shard-iclb: NOTRUN -> [SKIP][88] ([i915#2856]) +1 similar issue
[88]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@gen9_exec_parse@batch-zero-length.html
* igt@i915_pipe_stress@stress-xrgb8888-untiled:
- shard-apl: NOTRUN -> [FAIL][89] ([i915#7036])
[89]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-apl6/igt@i915_pipe_stress@stress-xrgb8888-untiled.html
* igt@i915_pm_dc@dc6-psr:
- shard-iclb: [PASS][90] -> [FAIL][91] ([i915#3989] / [i915#454])
[90]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-iclb8/igt@i915_pm_dc@dc6-psr.html
[91]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@i915_pm_dc@dc6-psr.html
* igt@i915_query@query-topology-unsupported:
- shard-tglb: NOTRUN -> [SKIP][92] ([fdo#109302])
[92]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb3/igt@i915_query@query-topology-unsupported.html
- shard-iclb: NOTRUN -> [SKIP][93] ([fdo#109302])
[93]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb3/igt@i915_query@query-topology-unsupported.html
* igt@i915_selftest@live@gt_heartbeat:
- shard-skl: [PASS][94] -> [DMESG-FAIL][95] ([i915#5334])
[94]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl7/igt@i915_selftest@live@gt_heartbeat.html
[95]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl9/igt@i915_selftest@live@gt_heartbeat.html
* igt@kms_async_flips@alternate-sync-async-flip@pipe-a-edp-1:
- shard-skl: [PASS][96] -> [FAIL][97] ([i915#2521])
[96]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl5/igt@kms_async_flips@alternate-sync-async-flip@pipe-a-edp-1.html
[97]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl4/igt@kms_async_flips@alternate-sync-async-flip@pipe-a-edp-1.html
* igt@kms_big_fb@4-tiled-32bpp-rotate-270:
- shard-iclb: NOTRUN -> [SKIP][98] ([i915#5286])
[98]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@kms_big_fb@4-tiled-32bpp-rotate-270.html
- shard-tglb: NOTRUN -> [SKIP][99] ([i915#5286])
[99]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb7/igt@kms_big_fb@4-tiled-32bpp-rotate-270.html
* igt@kms_big_fb@yf-tiled-max-hw-stride-64bpp-rotate-0-hflip:
- shard-tglb: NOTRUN -> [SKIP][100] ([fdo#111615]) +1 similar issue
[100]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb7/igt@kms_big_fb@yf-tiled-max-hw-stride-64bpp-rotate-0-hflip.html
- shard-iclb: NOTRUN -> [SKIP][101] ([fdo#110723]) +1 similar issue
[101]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@kms_big_fb@yf-tiled-max-hw-stride-64bpp-rotate-0-hflip.html
* igt@kms_ccs@pipe-a-missing-ccs-buffer-y_tiled_gen12_rc_ccs_cc:
- shard-apl: NOTRUN -> [SKIP][102] ([fdo#109271] / [i915#3886]) +7 similar issues
[102]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-apl6/igt@kms_ccs@pipe-a-missing-ccs-buffer-y_tiled_gen12_rc_ccs_cc.html
* igt@kms_ccs@pipe-b-bad-aux-stride-y_tiled_gen12_rc_ccs_cc:
- shard-snb: NOTRUN -> [SKIP][103] ([fdo#109271]) +44 similar issues
[103]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb7/igt@kms_ccs@pipe-b-bad-aux-stride-y_tiled_gen12_rc_ccs_cc.html
- shard-glk: NOTRUN -> [SKIP][104] ([fdo#109271] / [i915#3886]) +1 similar issue
[104]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-glk1/igt@kms_ccs@pipe-b-bad-aux-stride-y_tiled_gen12_rc_ccs_cc.html
- shard-iclb: NOTRUN -> [SKIP][105] ([fdo#109278] / [i915#3886]) +1 similar issue
[105]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@kms_ccs@pipe-b-bad-aux-stride-y_tiled_gen12_rc_ccs_cc.html
* igt@kms_ccs@pipe-b-crc-primary-rotation-180-4_tiled_dg2_rc_ccs:
- shard-tglb: NOTRUN -> [SKIP][106] ([i915#3689] / [i915#6095]) +1 similar issue
[106]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb3/igt@kms_ccs@pipe-b-crc-primary-rotation-180-4_tiled_dg2_rc_ccs.html
* igt@kms_ccs@pipe-c-ccs-on-another-bo-y_tiled_ccs:
- shard-apl: NOTRUN -> [SKIP][107] ([fdo#109271]) +132 similar issues
[107]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-apl6/igt@kms_ccs@pipe-c-ccs-on-another-bo-y_tiled_ccs.html
- shard-tglb: NOTRUN -> [SKIP][108] ([i915#3689]) +5 similar issues
[108]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb7/igt@kms_ccs@pipe-c-ccs-on-another-bo-y_tiled_ccs.html
* igt@kms_ccs@pipe-c-crc-sprite-planes-basic-4_tiled_dg2_rc_ccs:
- shard-glk: NOTRUN -> [SKIP][109] ([fdo#109271]) +46 similar issues
[109]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-glk1/igt@kms_ccs@pipe-c-crc-sprite-planes-basic-4_tiled_dg2_rc_ccs.html
* igt@kms_ccs@pipe-d-random-ccs-data-yf_tiled_ccs:
- shard-tglb: NOTRUN -> [SKIP][110] ([fdo#111615] / [i915#3689]) +3 similar issues
[110]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb3/igt@kms_ccs@pipe-d-random-ccs-data-yf_tiled_ccs.html
* igt@kms_chamelium@dp-crc-fast:
- shard-iclb: NOTRUN -> [SKIP][111] ([fdo#109284] / [fdo#111827]) +3 similar issues
[111]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb3/igt@kms_chamelium@dp-crc-fast.html
* igt@kms_chamelium@dp-edid-change-during-suspend:
- shard-glk: NOTRUN -> [SKIP][112] ([fdo#109271] / [fdo#111827]) +3 similar issues
[112]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-glk1/igt@kms_chamelium@dp-edid-change-during-suspend.html
- shard-skl: NOTRUN -> [SKIP][113] ([fdo#109271] / [fdo#111827]) +3 similar issues
[113]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl9/igt@kms_chamelium@dp-edid-change-during-suspend.html
* igt@kms_chamelium@dp-hpd-storm-disable:
- shard-snb: NOTRUN -> [SKIP][114] ([fdo#109271] / [fdo#111827])
[114]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb7/igt@kms_chamelium@dp-hpd-storm-disable.html
- shard-tglb: NOTRUN -> [SKIP][115] ([fdo#109284] / [fdo#111827]) +3 similar issues
[115]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb7/igt@kms_chamelium@dp-hpd-storm-disable.html
* igt@kms_chamelium@hdmi-edid-change-during-suspend:
- shard-apl: NOTRUN -> [SKIP][116] ([fdo#109271] / [fdo#111827]) +6 similar issues
[116]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-apl6/igt@kms_chamelium@hdmi-edid-change-during-suspend.html
* igt@kms_cursor_legacy@cursor-vs-flip@atomic:
- shard-skl: NOTRUN -> [INCOMPLETE][117] ([i915#6947])
[117]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl4/igt@kms_cursor_legacy@cursor-vs-flip@atomic.html
* igt@kms_cursor_legacy@cursorb-vs-flipb@atomic:
- shard-tglb: NOTRUN -> [SKIP][118] ([fdo#109274] / [fdo#111825]) +11 similar issues
[118]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb3/igt@kms_cursor_legacy@cursorb-vs-flipb@atomic.html
* igt@kms_cursor_legacy@cursorb-vs-flipb@legacy:
- shard-iclb: NOTRUN -> [SKIP][119] ([fdo#109274]) +13 similar issues
[119]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb3/igt@kms_cursor_legacy@cursorb-vs-flipb@legacy.html
* igt@kms_flip@2x-flip-vs-dpms-off-vs-modeset-interruptible:
- shard-tglb: NOTRUN -> [SKIP][120] ([fdo#109274] / [fdo#111825] / [i915#3637]) +1 similar issue
[120]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb3/igt@kms_flip@2x-flip-vs-dpms-off-vs-modeset-interruptible.html
* igt@kms_flip@2x-flip-vs-expired-vblank-interruptible@bc-hdmi-a1-hdmi-a2:
- shard-glk: [PASS][121] -> [FAIL][122] ([i915#79]) +1 similar issue
[121]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-glk6/igt@kms_flip@2x-flip-vs-expired-vblank-interruptible@bc-hdmi-a1-hdmi-a2.html
[122]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-glk8/igt@kms_flip@2x-flip-vs-expired-vblank-interruptible@bc-hdmi-a1-hdmi-a2.html
* igt@kms_flip@plain-flip-ts-check@c-edp1:
- shard-skl: [PASS][123] -> [FAIL][124] ([i915#2122]) +2 similar issues
[123]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl6/igt@kms_flip@plain-flip-ts-check@c-edp1.html
[124]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl4/igt@kms_flip@plain-flip-ts-check@c-edp1.html
* igt@kms_flip_scaled_crc@flip-32bpp-yftile-to-64bpp-yftile-downscaling@pipe-a-default-mode:
- shard-iclb: NOTRUN -> [SKIP][125] ([i915#2672]) +6 similar issues
[125]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb3/igt@kms_flip_scaled_crc@flip-32bpp-yftile-to-64bpp-yftile-downscaling@pipe-a-default-mode.html
* igt@kms_flip_scaled_crc@flip-32bpp-ytile-to-32bpp-ytilegen12rcccs-downscaling@pipe-a-default-mode:
- shard-iclb: NOTRUN -> [SKIP][126] ([i915#2672] / [i915#3555])
[126]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@kms_flip_scaled_crc@flip-32bpp-ytile-to-32bpp-ytilegen12rcccs-downscaling@pipe-a-default-mode.html
* igt@kms_flip_scaled_crc@flip-64bpp-linear-to-16bpp-linear-downscaling@pipe-a-default-mode:
- shard-iclb: NOTRUN -> [SKIP][127] ([i915#3555]) +1 similar issue
[127]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@kms_flip_scaled_crc@flip-64bpp-linear-to-16bpp-linear-downscaling@pipe-a-default-mode.html
* igt@kms_flip_scaled_crc@flip-64bpp-yftile-to-16bpp-yftile-downscaling@pipe-a-valid-mode:
- shard-tglb: NOTRUN -> [SKIP][128] ([i915#2587] / [i915#2672]) +1 similar issue
[128]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb3/igt@kms_flip_scaled_crc@flip-64bpp-yftile-to-16bpp-yftile-downscaling@pipe-a-valid-mode.html
* igt@kms_flip_scaled_crc@flip-64bpp-yftile-to-32bpp-yftile-downscaling@pipe-a-valid-mode:
- shard-iclb: NOTRUN -> [SKIP][129] ([i915#2587] / [i915#2672]) +2 similar issues
[129]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb6/igt@kms_flip_scaled_crc@flip-64bpp-yftile-to-32bpp-yftile-downscaling@pipe-a-valid-mode.html
* igt@kms_frontbuffer_tracking@fbc-2p-primscrn-spr-indfb-onoff:
- shard-iclb: NOTRUN -> [SKIP][130] ([fdo#109280]) +12 similar issues
[130]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@kms_frontbuffer_tracking@fbc-2p-primscrn-spr-indfb-onoff.html
* igt@kms_frontbuffer_tracking@fbc-2p-scndscrn-cur-indfb-draw-pwrite:
- shard-tglb: NOTRUN -> [SKIP][131] ([fdo#109280] / [fdo#111825]) +12 similar issues
[131]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb7/igt@kms_frontbuffer_tracking@fbc-2p-scndscrn-cur-indfb-draw-pwrite.html
* igt@kms_frontbuffer_tracking@fbcpsr-stridechange:
- shard-tglb: NOTRUN -> [SKIP][132] ([i915#6497]) +1 similar issue
[132]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb3/igt@kms_frontbuffer_tracking@fbcpsr-stridechange.html
* igt@kms_frontbuffer_tracking@fbcpsr-suspend:
- shard-skl: NOTRUN -> [SKIP][133] ([fdo#109271]) +85 similar issues
[133]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl1/igt@kms_frontbuffer_tracking@fbcpsr-suspend.html
* igt@kms_frontbuffer_tracking@psr-rgb101010-draw-mmap-cpu:
- shard-skl: [PASS][134] -> [DMESG-WARN][135] ([i915#1982])
[134]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl7/igt@kms_frontbuffer_tracking@psr-rgb101010-draw-mmap-cpu.html
[135]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl9/igt@kms_frontbuffer_tracking@psr-rgb101010-draw-mmap-cpu.html
* igt@kms_plane_alpha_blend@alpha-basic@pipe-a-dp-1:
- shard-apl: NOTRUN -> [FAIL][136] ([i915#4573]) +2 similar issues
[136]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-apl1/igt@kms_plane_alpha_blend@alpha-basic@pipe-a-dp-1.html
* igt@kms_psr2_sf@primary-plane-update-sf-dmg-area-big-fb:
- shard-apl: NOTRUN -> [SKIP][137] ([fdo#109271] / [i915#658])
[137]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-apl6/igt@kms_psr2_sf@primary-plane-update-sf-dmg-area-big-fb.html
- shard-tglb: NOTRUN -> [SKIP][138] ([i915#2920])
[138]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb3/igt@kms_psr2_sf@primary-plane-update-sf-dmg-area-big-fb.html
- shard-glk: NOTRUN -> [SKIP][139] ([fdo#109271] / [i915#658])
[139]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-glk1/igt@kms_psr2_sf@primary-plane-update-sf-dmg-area-big-fb.html
- shard-skl: NOTRUN -> [SKIP][140] ([fdo#109271] / [i915#658]) +1 similar issue
[140]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl9/igt@kms_psr2_sf@primary-plane-update-sf-dmg-area-big-fb.html
- shard-iclb: NOTRUN -> [SKIP][141] ([i915#658])
[141]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb3/igt@kms_psr2_sf@primary-plane-update-sf-dmg-area-big-fb.html
* igt@kms_psr@psr2_cursor_blt:
- shard-iclb: [PASS][142] -> [SKIP][143] ([fdo#109441]) +2 similar issues
[142]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-iclb2/igt@kms_psr@psr2_cursor_blt.html
[143]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb6/igt@kms_psr@psr2_cursor_blt.html
* igt@kms_psr@psr2_no_drrs:
- shard-tglb: NOTRUN -> [FAIL][144] ([i915#132] / [i915#3467])
[144]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb7/igt@kms_psr@psr2_no_drrs.html
* igt@kms_setmode@invalid-clone-single-crtc:
- shard-tglb: NOTRUN -> [SKIP][145] ([i915#3555])
[145]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb3/igt@kms_setmode@invalid-clone-single-crtc.html
* igt@kms_vblank@pipe-d-query-forked-hang:
- shard-iclb: NOTRUN -> [SKIP][146] ([fdo#109278]) +10 similar issues
[146]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@kms_vblank@pipe-d-query-forked-hang.html
* igt@kms_writeback@writeback-check-output:
- shard-iclb: NOTRUN -> [SKIP][147] ([i915#2437])
[147]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb3/igt@kms_writeback@writeback-check-output.html
- shard-apl: NOTRUN -> [SKIP][148] ([fdo#109271] / [i915#2437])
[148]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-apl6/igt@kms_writeback@writeback-check-output.html
- shard-tglb: NOTRUN -> [SKIP][149] ([i915#2437])
[149]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb3/igt@kms_writeback@writeback-check-output.html
- shard-glk: NOTRUN -> [SKIP][150] ([fdo#109271] / [i915#2437])
[150]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-glk1/igt@kms_writeback@writeback-check-output.html
* igt@kms_writeback@writeback-invalid-parameters:
- shard-skl: NOTRUN -> [SKIP][151] ([fdo#109271] / [i915#2437]) +1 similar issue
[151]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl1/igt@kms_writeback@writeback-invalid-parameters.html
* igt@perf_pmu@interrupts:
- shard-skl: [PASS][152] -> [FAIL][153] ([i915#7318])
[152]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl6/igt@perf_pmu@interrupts.html
[153]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl4/igt@perf_pmu@interrupts.html
* igt@prime_vgem@fence-flip-hang:
- shard-tglb: NOTRUN -> [SKIP][154] ([fdo#109295])
[154]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb3/igt@prime_vgem@fence-flip-hang.html
- shard-iclb: NOTRUN -> [SKIP][155] ([fdo#109295])
[155]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb3/igt@prime_vgem@fence-flip-hang.html
* igt@sysfs_clients@busy:
- shard-glk: NOTRUN -> [SKIP][156] ([fdo#109271] / [i915#2994])
[156]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-glk2/igt@sysfs_clients@busy.html
* igt@sysfs_clients@split-10:
- shard-skl: NOTRUN -> [SKIP][157] ([fdo#109271] / [i915#2994])
[157]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl5/igt@sysfs_clients@split-10.html
#### Possible fixes ####
* igt@fbdev@read:
- shard-snb: [FAIL][158] -> [PASS][159]
[158]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb7/igt@fbdev@read.html
[159]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb2/igt@fbdev@read.html
* igt@gem_create@create-massive:
- shard-apl: [DMESG-WARN][160] ([i915#4991]) -> [PASS][161] +1 similar issue
[160]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-apl1/igt@gem_create@create-massive.html
[161]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-apl6/igt@gem_create@create-massive.html
- shard-tglb: [DMESG-WARN][162] ([i915#4991]) -> [PASS][163] +1 similar issue
[162]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-tglb7/igt@gem_create@create-massive.html
[163]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb3/igt@gem_create@create-massive.html
- shard-glk: [DMESG-WARN][164] ([i915#4991]) -> [PASS][165] +1 similar issue
[164]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-glk1/igt@gem_create@create-massive.html
[165]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-glk1/igt@gem_create@create-massive.html
- shard-skl: [DMESG-WARN][166] ([i915#4991]) -> [PASS][167]
[166]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl1/igt@gem_create@create-massive.html
[167]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl9/igt@gem_create@create-massive.html
* igt@gem_exec_balancer@parallel-out-fence:
- shard-iclb: [SKIP][168] ([i915#4525]) -> [PASS][169] +1 similar issue
[168]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-iclb8/igt@gem_exec_balancer@parallel-out-fence.html
[169]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@gem_exec_balancer@parallel-out-fence.html
* igt@gem_exec_fair@basic-none-share@rcs0:
- shard-tglb: [FAIL][170] ([i915#2842]) -> [PASS][171] +1 similar issue
[170]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-tglb3/igt@gem_exec_fair@basic-none-share@rcs0.html
[171]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb1/igt@gem_exec_fair@basic-none-share@rcs0.html
* igt@gem_mmap_offset@bad-object:
- shard-skl: [DMESG-WARN][172] ([i915#1982]) -> [PASS][173] +3 similar issues
[172]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl4/igt@gem_mmap_offset@bad-object.html
[173]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl10/igt@gem_mmap_offset@bad-object.html
* igt@gem_userptr_blits@input-checking:
- shard-iclb: [DMESG-WARN][174] ([i915#4991]) -> [PASS][175] +1 similar issue
[174]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-iclb2/igt@gem_userptr_blits@input-checking.html
[175]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@gem_userptr_blits@input-checking.html
- shard-snb: [DMESG-WARN][176] ([i915#4991]) -> [PASS][177]
[176]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-snb7/igt@gem_userptr_blits@input-checking.html
[177]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-snb7/igt@gem_userptr_blits@input-checking.html
* igt@i915_pm_rc6_residency@rc6-idle@vcs0:
- shard-skl: [WARN][178] ([i915#1804]) -> [PASS][179]
[178]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl7/igt@i915_pm_rc6_residency@rc6-idle@vcs0.html
[179]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl9/igt@i915_pm_rc6_residency@rc6-idle@vcs0.html
* igt@i915_pm_rpm@basic-pci-d3-state:
- shard-iclb: [FAIL][180] -> [PASS][181]
[180]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-iclb3/igt@i915_pm_rpm@basic-pci-d3-state.html
[181]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb8/igt@i915_pm_rpm@basic-pci-d3-state.html
* igt@kms_cursor_legacy@cursor-vs-flip@toggle:
- shard-skl: [INCOMPLETE][182] -> [PASS][183]
[182]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl6/igt@kms_cursor_legacy@cursor-vs-flip@toggle.html
[183]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl4/igt@kms_cursor_legacy@cursor-vs-flip@toggle.html
* igt@kms_cursor_legacy@flip-vs-cursor@atomic-transitions-varying-size:
- shard-glk: [FAIL][184] ([i915#2346]) -> [PASS][185] +1 similar issue
[184]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-glk8/igt@kms_cursor_legacy@flip-vs-cursor@atomic-transitions-varying-size.html
[185]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-glk5/igt@kms_cursor_legacy@flip-vs-cursor@atomic-transitions-varying-size.html
* igt@kms_flip@flip-vs-absolute-wf_vblank@a-edp1:
- shard-skl: [FAIL][186] ([i915#2122]) -> [PASS][187] +2 similar issues
[186]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl5/igt@kms_flip@flip-vs-absolute-wf_vblank@a-edp1.html
[187]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl1/igt@kms_flip@flip-vs-absolute-wf_vblank@a-edp1.html
* igt@kms_plane_scaling@plane-downscale-with-pixel-format-factor-0-5@pipe-b-edp-1:
- shard-iclb: [SKIP][188] ([i915#5176]) -> [PASS][189] +2 similar issues
[188]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-iclb2/igt@kms_plane_scaling@plane-downscale-with-pixel-format-factor-0-5@pipe-b-edp-1.html
[189]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb6/igt@kms_plane_scaling@plane-downscale-with-pixel-format-factor-0-5@pipe-b-edp-1.html
* igt@kms_psr@psr2_cursor_mmap_gtt:
- shard-iclb: [SKIP][190] ([fdo#109441]) -> [PASS][191]
[190]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-iclb8/igt@kms_psr@psr2_cursor_mmap_gtt.html
[191]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@kms_psr@psr2_cursor_mmap_gtt.html
* igt@kms_vblank@pipe-b-ts-continuation-suspend:
- shard-apl: [DMESG-WARN][192] ([i915#180]) -> [PASS][193] +3 similar issues
[192]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-apl2/igt@kms_vblank@pipe-b-ts-continuation-suspend.html
[193]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-apl7/igt@kms_vblank@pipe-b-ts-continuation-suspend.html
* igt@syncobj_wait@wait-all-for-submit-snapshot:
- shard-skl: [FAIL][194] ([i915#7109]) -> [PASS][195]
[194]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl10/igt@syncobj_wait@wait-all-for-submit-snapshot.html
[195]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl10/igt@syncobj_wait@wait-all-for-submit-snapshot.html
#### Warnings ####
* igt@gem_pwrite@basic-exhaustion:
- shard-tglb: [INCOMPLETE][196] ([i915#7248]) -> [WARN][197] ([i915#2658])
[196]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-tglb5/igt@gem_pwrite@basic-exhaustion.html
[197]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-tglb2/igt@gem_pwrite@basic-exhaustion.html
- shard-glk: [WARN][198] ([i915#2658]) -> [INCOMPLETE][199] ([i915#7248])
[198]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-glk5/igt@gem_pwrite@basic-exhaustion.html
[199]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-glk2/igt@gem_pwrite@basic-exhaustion.html
- shard-skl: [TIMEOUT][200] ([i915#7248]) -> [INCOMPLETE][201] ([i915#7248])
[200]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl3/igt@gem_pwrite@basic-exhaustion.html
[201]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl1/igt@gem_pwrite@basic-exhaustion.html
* igt@i915_pm_dc@dc3co-vpb-simulation:
- shard-iclb: [SKIP][202] ([i915#588]) -> [SKIP][203] ([i915#658])
[202]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-iclb2/igt@i915_pm_dc@dc3co-vpb-simulation.html
[203]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb6/igt@i915_pm_dc@dc3co-vpb-simulation.html
* igt@i915_pm_rc6_residency@rc6-idle@bcs0:
- shard-iclb: [WARN][204] ([i915#2684]) -> [FAIL][205] ([i915#2684])
[204]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-iclb2/igt@i915_pm_rc6_residency@rc6-idle@bcs0.html
[205]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb7/igt@i915_pm_rc6_residency@rc6-idle@bcs0.html
* igt@kms_psr2_sf@overlay-plane-move-continuous-exceed-fully-sf:
- shard-iclb: [SKIP][206] ([i915#658]) -> [SKIP][207] ([i915#2920])
[206]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-iclb7/igt@kms_psr2_sf@overlay-plane-move-continuous-exceed-fully-sf.html
[207]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@kms_psr2_sf@overlay-plane-move-continuous-exceed-fully-sf.html
* igt@kms_psr2_sf@plane-move-sf-dmg-area:
- shard-iclb: [SKIP][208] ([fdo#111068] / [i915#658]) -> [SKIP][209] ([i915#2920])
[208]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-iclb7/igt@kms_psr2_sf@plane-move-sf-dmg-area.html
[209]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-iclb2/igt@kms_psr2_sf@plane-move-sf-dmg-area.html
* igt@runner@aborted:
- shard-apl: ([FAIL][210], [FAIL][211], [FAIL][212], [FAIL][213], [FAIL][214], [FAIL][215]) ([fdo#109271] / [i915#180] / [i915#3002] / [i915#4312]) -> [FAIL][216] ([i915#180] / [i915#4312])
[210]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-apl2/igt@runner@aborted.html
[211]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-apl3/igt@runner@aborted.html
[212]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-apl3/igt@runner@aborted.html
[213]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-apl8/igt@runner@aborted.html
[214]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-apl1/igt@runner@aborted.html
[215]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-apl6/igt@runner@aborted.html
[216]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-apl8/igt@runner@aborted.html
- shard-glk: ([FAIL][217], [FAIL][218]) ([i915#3002] / [i915#4312]) -> [FAIL][219] ([i915#4312])
[217]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-glk2/igt@runner@aborted.html
[218]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-glk1/igt@runner@aborted.html
[219]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-glk7/igt@runner@aborted.html
- shard-skl: ([FAIL][220], [FAIL][221], [FAIL][222], [FAIL][223]) ([i915#3002] / [i915#4312] / [i915#6949]) -> [FAIL][224] ([i915#6949])
[220]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl5/igt@runner@aborted.html
[221]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl10/igt@runner@aborted.html
[222]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl1/igt@runner@aborted.html
[223]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12332/shard-skl3/igt@runner@aborted.html
[224]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/shard-skl4/igt@runner@aborted.html
[fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271
[fdo#109274]: https://bugs.freedesktop.org/show_bug.cgi?id=109274
[fdo#109278]: https://bugs.freedesktop.org/show_bug.cgi?id=109278
[fdo#109280]: https://bugs.freedesktop.org/show_bug.cgi?id=109280
[fdo#109284]: https://bugs.freedesktop.org/show_bug.cgi?id=109284
[fdo#109289]: https://bugs.freedesktop.org/show_bug.cgi?id=109289
[fdo#109295]: https://bugs.freedesktop.org/show_bug.cgi?id=109295
[fdo#109302]: https://bugs.freedesktop.org/show_bug.cgi?id=109302
[fdo#109441]: https://bugs.freedesktop.org/show_bug.cgi?id=109441
[fdo#110723]: https://bugs.freedesktop.org/show_bug.cgi?id=110723
[fdo#111068]: https://bugs.freedesktop.org/show_bug.cgi?id=111068
[fdo#111615]: https://bugs.freedesktop.org/show_bug.cgi?id=111615
[fdo#111825]: https://bugs.freedesktop.org/show_bug.cgi?id=111825
[fdo#111827]: https://bugs.freedesktop.org/show_bug.cgi?id=111827
[i915#132]: https://gitlab.freedesktop.org/drm/intel/issues/132
[i915#180]: https://gitlab.freedesktop.org/drm/intel/issues/180
[i915#1804]: https://gitlab.freedesktop.org/drm/intel/issues/1804
[i915#1982]: https://gitlab.freedesktop.org/drm/intel/issues/1982
[i915#2122]: https://gitlab.freedesktop.org/drm/intel/issues/2122
[i915#2346]: https://gitlab.freedesktop.org/drm/intel/issues/2346
[i915#2437]: https://gitlab.freedesktop.org/drm/intel/issues/2437
[i915#2521]: https://gitlab.freedesktop.org/drm/intel/issues/2521
[i915#2527]: https://gitlab.freedesktop.org/drm/intel/issues/2527
[i915#2587]: https://gitlab.freedesktop.org/drm/intel/issues/2587
[i915#2658]: https://gitlab.freedesktop.org/drm/intel/issues/2658
[i915#2672]: https://gitlab.freedesktop.org/drm/intel/issues/2672
[i915#2684]: https://gitlab.freedesktop.org/drm/intel/issues/2684
[i915#2842]: https://gitlab.freedesktop.org/drm/intel/issues/2842
[i915#2846]: https://gitlab.freedesktop.org/drm/intel/issues/2846
[i915#2856]: https://gitlab.freedesktop.org/drm/intel/issues/2856
[i915#2898]: https://gitlab.freedesktop.org/drm/intel/issues/2898
[i915#2920]: https://gitlab.freedesktop.org/drm/intel/issues/2920
[i915#2994]: https://gitlab.freedesktop.org/drm/intel/issues/2994
[i915#3002]: https://gitlab.freedesktop.org/drm/intel/issues/3002
[i915#3467]: https://gitlab.freedesktop.org/drm/intel/issues/3467
[i915#3555]: https://gitlab.freedesktop.org/drm/intel/issues/3555
[i915#3637]: https://gitlab.freedesktop.org/drm/intel/issues/3637
[i915#3689]: https://gitlab.freedesktop.org/drm/intel/issues/3689
[i915#3886]: https://gitlab.freedesktop.org/drm/intel/issues/3886
[i915#3989]: https://gitlab.freedesktop.org/drm/intel/issues/3989
[i915#4171]: https://gitlab.freedesktop.org/drm/intel/issues/4171
[i915#4270]: https://gitlab.freedesktop.org/drm/intel/issues/4270
[i915#4312]: https://gitlab.freedesktop.org/drm/intel/issues/4312
[i915#4338]: https://gitlab.freedesktop.org/drm/intel/issues/4338
[i915#4525]: https://gitlab.freedesktop.org/drm/intel/issues/4525
[i915#454]: https://gitlab.freedesktop.org/drm/intel/issues/454
[i915#4573]: https://gitlab.freedesktop.org/drm/intel/issues/4573
[i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613
[i915#4991]: https://gitlab.freedesktop.org/drm/intel/issues/4991
[i915#5176]: https://gitlab.freedesktop.org/drm/intel/issues/5176
[i915#5286]: https://gitlab.freedesktop.org/drm/intel/issues/5286
[i915#5327]: https://gitlab.freedesktop.org/drm/intel/issues/5327
[i915#5334]: https://gitlab.freedesktop.org/drm/intel/issues/5334
[i915#5566]: https://gitlab.freedesktop.org/drm/intel/issues/5566
[i915#588]: https://gitlab.freedesktop.org/drm/intel/issues/588
[i915#6095]: https://gitlab.freedesktop.org/drm/intel/issues/6095
[i915#6268]: https://gitlab.freedesktop.org/drm/intel/issues/6268
[i915#6497]: https://gitlab.freedesktop.org/drm/intel/issues/6497
[i915#658]: https://gitlab.freedesktop.org/drm/intel/issues/658
[i915#6947]: https://gitlab.freedesktop.org/drm/intel/issues/6947
[i915#6949]: https://gitlab.freedesktop.org/drm/intel/issues/6949
[i915#7036]: https://gitlab.freedesktop.org/drm/intel/issues/7036
[i915#7109]: https://gitlab.freedesktop.org/drm/intel/issues/7109
[i915#716]: https://gitlab.freedesktop.org/drm/intel/issues/716
[i915#7224]: https://gitlab.freedesktop.org/drm/intel/issues/7224
[i915#7247]: https://gitlab.freedesktop.org/drm/intel/issues/7247
[i915#7248]: https://gitlab.freedesktop.org/drm/intel/issues/7248
[i915#7318]: https://gitlab.freedesktop.org/drm/intel/issues/7318
[i915#768]: https://gitlab.freedesktop.org/drm/intel/issues/768
[i915#79]: https://gitlab.freedesktop.org/drm/intel/issues/79
Build changes
-------------
* Linux: CI_DRM_12332 -> Patchwork_110413v1
CI-20190529: 20190529
CI_DRM_12332: 601b2ef606e4b83d5518aa6a5011bb2b1c5954d9 @ git://anongit.freedesktop.org/gfx-ci/linux
IGT_7038: 5389b3f3b9b75df6bd8506e4aa3da357fd0c0ab1 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git
Patchwork_110413v1: 601b2ef606e4b83d5518aa6a5011bb2b1c5954d9 @ git://anongit.freedesktop.org/gfx-ci/linux
piglit_4509: fdc5a4ca11124ab8413c7988896eec4c97336694 @ git://anongit.freedesktop.org/piglit
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v1/index.html
[-- Attachment #2: Type: text/html, Size: 57380 bytes --]
^ permalink raw reply [flat|nested] 18+ messages in thread* [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation (rev2)
2022-11-02 14:53 [Intel-gfx] [PATCH v14 0/7] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun
` (10 preceding siblings ...)
2022-11-02 20:56 ` [Intel-gfx] ✗ Fi.CI.IGT: failure " Patchwork
@ 2022-11-03 6:46 ` Patchwork
2022-11-03 7:07 ` [Intel-gfx] ✗ Fi.CI.BAT: failure " Patchwork
12 siblings, 0 replies; 18+ messages in thread
From: Patchwork @ 2022-11-03 6:46 UTC (permalink / raw)
To: Gwan-gyeong Mun; +Cc: intel-gfx
== Series Details ==
Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation (rev2)
URL : https://patchwork.freedesktop.org/series/110413/
State : warning
== Summary ==
Error: dim checkpatch failed
dd0ceb452378 overflow: Introduce overflows_type() and castable_to_type()
-:27: WARNING:COMMIT_LOG_LONG_LINE: Possible unwrapped commit description (prefer a maximum 75 chars per line)
#27:
[16:03:33] Elapsed time: 24.022s total, 0.002s configuring, 22.598s building, 0.767s running
-:99: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'x' - possible side-effects?
#99: FILE: include/linux/overflow.h:131:
+#define __overflows_type_constexpr(x, T) ( \
+ is_unsigned_type(typeof(x)) ? \
+ (x) > type_max(typeof(T)) ? 1 : 0 \
+ : is_unsigned_type(typeof(T)) ? \
+ (x) < 0 || (x) > type_max(typeof(T)) ? 1 : 0 \
+ : (x) < type_min(typeof(T)) || \
+ (x) > type_max(typeof(T)) ? 1 : 0)
-:100: CHECK:SPACING: No space is necessary after a cast
#100: FILE: include/linux/overflow.h:132:
+ is_unsigned_type(typeof(x)) ? \
-:101: CHECK:SPACING: No space is necessary after a cast
#101: FILE: include/linux/overflow.h:133:
+ (x) > type_max(typeof(T)) ? 1 : 0 \
-:102: CHECK:SPACING: No space is necessary after a cast
#102: FILE: include/linux/overflow.h:134:
+ : is_unsigned_type(typeof(T)) ? \
-:103: CHECK:SPACING: No space is necessary after a cast
#103: FILE: include/linux/overflow.h:135:
+ (x) < 0 || (x) > type_max(typeof(T)) ? 1 : 0 \
-:104: CHECK:SPACING: No space is necessary after a cast
#104: FILE: include/linux/overflow.h:136:
+ : (x) < type_min(typeof(T)) || \
-:105: CHECK:SPACING: No space is necessary after a cast
#105: FILE: include/linux/overflow.h:137:
+ (x) > type_max(typeof(T)) ? 1 : 0)
-:126: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#126: FILE: include/linux/overflow.h:158:
+#define overflows_type(n, T) \
+ __builtin_choose_expr(__is_constexpr(n), \
+ __overflows_type_constexpr(n, T), \
+ __overflows_type(n, T))
-:126: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'T' - possible side-effects?
#126: FILE: include/linux/overflow.h:158:
+#define overflows_type(n, T) \
+ __builtin_choose_expr(__is_constexpr(n), \
+ __overflows_type_constexpr(n, T), \
+ __overflows_type(n, T))
-:142: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#142: FILE: include/linux/overflow.h:174:
+#define castable_to_type(n, T) \
+ __builtin_choose_expr(__is_constexpr(n), \
+ !__overflows_type_constexpr(n, T), \
+ __same_type(n, T))
-:142: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'T' - possible side-effects?
#142: FILE: include/linux/overflow.h:174:
+#define castable_to_type(n, T) \
+ __builtin_choose_expr(__is_constexpr(n), \
+ !__overflows_type_constexpr(n, T), \
+ __same_type(n, T))
-:175: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'of' - possible side-effects?
#175: FILE: lib/overflow_kunit.c:744:
+#define __TEST_OVERFLOWS_TYPE(func, arg1, arg2, of) do { \
+ bool __of = func(arg1, arg2); \
+ KUNIT_EXPECT_EQ_MSG(test, __of, of, \
+ "expected " #func "(" #arg1 ", " #arg2 " to%s overflow\n",\
+ of ? "" : " not"); \
+ count++; \
+} while (0)
-:184: CHECK:MACRO_ARG_REUSE: Macro argument reuse '__t2' - possible side-effects?
#184: FILE: lib/overflow_kunit.c:753:
+#define TEST_OVERFLOWS_TYPE(__t1, __t2, v, of) do { \
+ __t1 t1 = (v); \
+ __t2 t2; \
+ __TEST_OVERFLOWS_TYPE(__overflows_type, t1, t2, of); \
+ __TEST_OVERFLOWS_TYPE(__overflows_type, t1, __t2, of); \
+ __TEST_OVERFLOWS_TYPE(__overflows_type_constexpr, t1, t2, of); \
+ __TEST_OVERFLOWS_TYPE(__overflows_type_constexpr, t1, __t2, of);\
+} while (0)
-:184: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'of' - possible side-effects?
#184: FILE: lib/overflow_kunit.c:753:
+#define TEST_OVERFLOWS_TYPE(__t1, __t2, v, of) do { \
+ __t1 t1 = (v); \
+ __t2 t2; \
+ __TEST_OVERFLOWS_TYPE(__overflows_type, t1, t2, of); \
+ __TEST_OVERFLOWS_TYPE(__overflows_type, t1, __t2, of); \
+ __TEST_OVERFLOWS_TYPE(__overflows_type_constexpr, t1, t2, of); \
+ __TEST_OVERFLOWS_TYPE(__overflows_type_constexpr, t1, __t2, of);\
+} while (0)
-:387: CHECK:MACRO_ARG_REUSE: Macro argument reuse 't1' - possible side-effects?
#387: FILE: lib/overflow_kunit.c:956:
+#define TEST_SAME_TYPE(t1, t2, same) do { \
+ typeof(t1) __t1h = type_max(t1); \
+ typeof(t1) __t1l = type_min(t1); \
+ typeof(t2) __t2h = type_max(t2); \
+ typeof(t2) __t2l = type_min(t2); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t1, __t1h)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t1, __t1l)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t1h, t1)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t1l, t1)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t2, __t2h)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t2, __t2l)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t2h, t2)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t2l, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t2, __t1h)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t2, __t1l)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t1h, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t1l, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, __t2h)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, __t2l)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t2h, t1)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t2l, t1)); \
+} while (0)
-:387: CHECK:MACRO_ARG_REUSE: Macro argument reuse 't2' - possible side-effects?
#387: FILE: lib/overflow_kunit.c:956:
+#define TEST_SAME_TYPE(t1, t2, same) do { \
+ typeof(t1) __t1h = type_max(t1); \
+ typeof(t1) __t1l = type_min(t1); \
+ typeof(t2) __t2h = type_max(t2); \
+ typeof(t2) __t2l = type_min(t2); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t1, __t1h)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t1, __t1l)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t1h, t1)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t1l, t1)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t2, __t2h)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t2, __t2l)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t2h, t2)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t2l, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t2, __t1h)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t2, __t1l)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t1h, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t1l, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, __t2h)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, __t2l)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t2h, t1)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t2l, t1)); \
+} while (0)
-:387: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'same' - possible side-effects?
#387: FILE: lib/overflow_kunit.c:956:
+#define TEST_SAME_TYPE(t1, t2, same) do { \
+ typeof(t1) __t1h = type_max(t1); \
+ typeof(t1) __t1l = type_min(t1); \
+ typeof(t2) __t2h = type_max(t2); \
+ typeof(t2) __t2l = type_min(t2); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t1, __t1h)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t1, __t1l)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t1h, t1)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t1l, t1)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t2, __t2h)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(t2, __t2l)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t2h, t2)); \
+ KUNIT_EXPECT_EQ(test, true, __same_type(__t2l, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t2, __t1h)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t2, __t1l)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t1h, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t1l, t2)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, __t2h)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(t1, __t2l)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t2h, t1)); \
+ KUNIT_EXPECT_EQ(test, same, __same_type(__t2l, t1)); \
+} while (0)
-:417: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'base' - possible side-effects?
#417: FILE: lib/overflow_kunit.c:986:
+#define TEST_TYPE_SETS(base, mu8, mu16, mu32, ms8, ms16, ms32, mu64, ms64) \
+do { \
+ TEST_SAME_TYPE(base, u8, mu8); \
+ TEST_SAME_TYPE(base, u16, mu16); \
+ TEST_SAME_TYPE(base, u32, mu32); \
+ TEST_SAME_TYPE(base, s8, ms8); \
+ TEST_SAME_TYPE(base, s16, ms16); \
+ TEST_SAME_TYPE(base, s32, ms32); \
+ TEST_SAME_TYPE64(base, u64, mu64); \
+ TEST_SAME_TYPE64(base, s64, ms64); \
+} while (0)
-:461: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'pass' - possible side-effects?
#461: FILE: lib/overflow_kunit.c:1030:
+#define TEST_CASTABLE_TO_TYPE(arg1, arg2, pass) do { \
+ bool __pass = castable_to_type(arg1, arg2); \
+ KUNIT_EXPECT_EQ_MSG(test, __pass, pass, \
+ "expected castable_to_type(" #arg1 ", " #arg2 ") to%s pass\n",\
+ pass ? "" : " not"); \
+ count++; \
+} while (0)
total: 0 errors, 1 warnings, 19 checks, 479 lines checked
b105f54348d9 drm/i915/gem: Typecheck page lookups
-:35: WARNING:BAD_SIGN_OFF: Co-developed-by and Signed-off-by: name/email do not match
#35:
Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
-:55: WARNING:DEPRECATED_API: Deprecated use of 'kmap_atomic', prefer 'kmap_local_page' instead
#55: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.c:434:
+ src_map = kmap_atomic(i915_gem_object_get_page(obj, idx));
-:75: WARNING:AVOID_BUG: Do not crash the kernel unless it is absolutely unavoidable--use WARN_ON_ONCE() plus recovery code (if feasible) instead of BUG() or variants
#75: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.c:489:
+ GEM_BUG_ON(overflows_type(offset >> PAGE_SHIFT, pgoff_t));
-:149: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#149: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:413:
+#define i915_gem_object_page_iter_get_sg(obj, it, n, offset) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_page_iter_get_sg(obj, it, n, offset); \
+})
-:150: ERROR:SPACING: space prohibited before that ',' (ctx:WxW)
#150: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:414:
+ static_assert(castable_to_type(n , pgoff_t)); \
^
-:198: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#198: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:458:
+#define i915_gem_object_get_sg(obj, n, offset) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_sg(obj, n, offset); \
+})
-:199: ERROR:SPACING: space prohibited before that ',' (ctx:WxW)
#199: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:459:
+ static_assert(castable_to_type(n , pgoff_t)); \
^
-:247: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#247: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:503:
+#define i915_gem_object_get_sg_dma(obj, n, offset) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_sg_dma(obj, n, offset); \
+})
-:248: ERROR:SPACING: space prohibited before that ',' (ctx:WxW)
#248: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:504:
+ static_assert(castable_to_type(n , pgoff_t)); \
^
-:285: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#285: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:539:
+#define i915_gem_object_get_page(obj, n) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_page(obj, n); \
+})
-:286: ERROR:SPACING: space prohibited before that ',' (ctx:WxW)
#286: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:540:
+ static_assert(castable_to_type(n , pgoff_t)); \
^
-:322: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#322: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:574:
+#define i915_gem_object_get_dirty_page(obj, n) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_dirty_page(obj, n); \
+})
-:323: ERROR:SPACING: space prohibited before that ',' (ctx:WxW)
#323: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:575:
+ static_assert(castable_to_type(n , pgoff_t)); \
^
-:363: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#363: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:612:
+#define i915_gem_object_get_dma_address_len(obj, n, len) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_dma_address_len(obj, n, len); \
+})
-:364: ERROR:SPACING: space prohibited before that ',' (ctx:WxW)
#364: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:613:
+ static_assert(castable_to_type(n , pgoff_t)); \
^
-:400: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'n' - possible side-effects?
#400: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:647:
+#define i915_gem_object_get_dma_address(obj, n) ({ \
+ static_assert(castable_to_type(n , pgoff_t)); \
+ __i915_gem_object_get_dma_address(obj, n); \
+})
-:401: ERROR:SPACING: space prohibited before that ',' (ctx:WxW)
#401: FILE: drivers/gpu/drm/i915/gem/i915_gem_object.h:648:
+ static_assert(castable_to_type(n , pgoff_t)); \
^
total: 7 errors, 3 warnings, 7 checks, 616 lines checked
876f3b6a1df1 drm/i915: Check for integer truncation on scatterlist creation
-:39: WARNING:BAD_SIGN_OFF: Co-developed-by and Signed-off-by: name/email do not match
#39:
Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@intel.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
total: 0 errors, 1 warnings, 0 checks, 205 lines checked
98f7bcc1df3e drm/i915: Check for integer truncation on the configuration of ttm place
0445afdda804 drm/i915: Check if the size is too big while creating shmem file
543f086b5093 drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large
-:11: WARNING:COMMIT_LOG_LONG_LINE: Possible unwrapped commit description (prefer a maximum 75 chars per line)
#11:
to add vma. The direct function that returns -ENOSPC is drm_mm_insert_node_in_range().
total: 0 errors, 1 warnings, 0 checks, 17 lines checked
3348b03cb2ff drm/i915: Remove truncation warning for large objects
^ permalink raw reply [flat|nested] 18+ messages in thread* [Intel-gfx] ✗ Fi.CI.BAT: failure for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation (rev2)
2022-11-02 14:53 [Intel-gfx] [PATCH v14 0/7] Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation Gwan-gyeong Mun
` (11 preceding siblings ...)
2022-11-03 6:46 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation (rev2) Patchwork
@ 2022-11-03 7:07 ` Patchwork
2022-11-03 10:22 ` Gwan-gyeong Mun
12 siblings, 1 reply; 18+ messages in thread
From: Patchwork @ 2022-11-03 7:07 UTC (permalink / raw)
To: Gwan-gyeong Mun; +Cc: intel-gfx
[-- Attachment #1: Type: text/plain, Size: 6602 bytes --]
== Series Details ==
Series: Fixes integer overflow or integer truncation issues in page lookups, ttm place configuration and scatterlist creation (rev2)
URL : https://patchwork.freedesktop.org/series/110413/
State : failure
== Summary ==
CI Bug Log - changes from CI_DRM_12333 -> Patchwork_110413v2
====================================================
Summary
-------
**FAILURE**
Serious unknown changes coming with Patchwork_110413v2 absolutely need to be
verified manually.
If you think the reported changes have nothing to do with the changes
introduced in Patchwork_110413v2, please notify your bug team to allow them
to document this new failure mode, which will reduce false positives in CI.
External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v2/index.html
Participating hosts (38 -> 27)
------------------------------
Missing (11): fi-tgl-dsi bat-dg2-8 bat-dg2-9 bat-adlp-6 bat-adlp-4 bat-adln-1 bat-rplp-1 bat-rpls-1 bat-rpls-2 bat-dg2-11 bat-jsl-1
Possible new issues
-------------------
Here are the unknown changes that may have been introduced in Patchwork_110413v2:
### IGT changes ###
#### Possible regressions ####
* igt@i915_selftest@live@hangcheck:
- fi-rkl-guc: [PASS][1] -> [INCOMPLETE][2]
[1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12333/fi-rkl-guc/igt@i915_selftest@live@hangcheck.html
[2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v2/fi-rkl-guc/igt@i915_selftest@live@hangcheck.html
Known issues
------------
Here are the changes found in Patchwork_110413v2 that come from known issues:
### IGT changes ###
#### Issues hit ####
* igt@gem_lmem_swapping@basic:
- fi-apl-guc: NOTRUN -> [SKIP][3] ([fdo#109271] / [i915#4613]) +3 similar issues
[3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v2/fi-apl-guc/igt@gem_lmem_swapping@basic.html
* igt@i915_selftest@live@hangcheck:
- fi-hsw-g3258: [PASS][4] -> [INCOMPLETE][5] ([i915#3303] / [i915#4785])
[4]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12333/fi-hsw-g3258/igt@i915_selftest@live@hangcheck.html
[5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v2/fi-hsw-g3258/igt@i915_selftest@live@hangcheck.html
* igt@i915_suspend@basic-s3-without-i915:
- fi-bdw-5557u: [PASS][6] -> [INCOMPLETE][7] ([i915#146])
[6]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12333/fi-bdw-5557u/igt@i915_suspend@basic-s3-without-i915.html
[7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v2/fi-bdw-5557u/igt@i915_suspend@basic-s3-without-i915.html
* igt@kms_chamelium@hdmi-crc-fast:
- fi-apl-guc: NOTRUN -> [SKIP][8] ([fdo#109271] / [fdo#111827]) +8 similar issues
[8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v2/fi-apl-guc/igt@kms_chamelium@hdmi-crc-fast.html
* igt@kms_force_connector_basic@force-connector-state:
- fi-apl-guc: NOTRUN -> [SKIP][9] ([fdo#109271]) +11 similar issues
[9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v2/fi-apl-guc/igt@kms_force_connector_basic@force-connector-state.html
* igt@runner@aborted:
- fi-hsw-g3258: NOTRUN -> [FAIL][10] ([fdo#109271] / [i915#4312] / [i915#4991])
[10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v2/fi-hsw-g3258/igt@runner@aborted.html
#### Possible fixes ####
* igt@gem_ctx_create@basic-files:
- {fi-tgl-mst}: [DMESG-WARN][11] ([i915#6434]) -> [PASS][12]
[11]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12333/fi-tgl-mst/igt@gem_ctx_create@basic-files.html
[12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v2/fi-tgl-mst/igt@gem_ctx_create@basic-files.html
* igt@gem_exec_gttfill@basic:
- fi-pnv-d510: [FAIL][13] ([i915#7229]) -> [PASS][14]
[13]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12333/fi-pnv-d510/igt@gem_exec_gttfill@basic.html
[14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v2/fi-pnv-d510/igt@gem_exec_gttfill@basic.html
* igt@gem_render_tiled_blits@basic:
- fi-apl-guc: [INCOMPLETE][15] -> [PASS][16]
[15]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12333/fi-apl-guc/igt@gem_render_tiled_blits@basic.html
[16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v2/fi-apl-guc/igt@gem_render_tiled_blits@basic.html
* igt@gem_tiled_blits@basic:
- fi-pnv-d510: [SKIP][17] ([fdo#109271]) -> [PASS][18] +1 similar issue
[17]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_12333/fi-pnv-d510/igt@gem_tiled_blits@basic.html
[18]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v2/fi-pnv-d510/igt@gem_tiled_blits@basic.html
{name}: This element is suppressed. This means it is ignored when computing
the status of the difference (SUCCESS, WARNING, or FAILURE).
[fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271
[fdo#111827]: https://bugs.freedesktop.org/show_bug.cgi?id=111827
[i915#146]: https://gitlab.freedesktop.org/drm/intel/issues/146
[i915#3303]: https://gitlab.freedesktop.org/drm/intel/issues/3303
[i915#4312]: https://gitlab.freedesktop.org/drm/intel/issues/4312
[i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613
[i915#4785]: https://gitlab.freedesktop.org/drm/intel/issues/4785
[i915#4991]: https://gitlab.freedesktop.org/drm/intel/issues/4991
[i915#6434]: https://gitlab.freedesktop.org/drm/intel/issues/6434
[i915#7229]: https://gitlab.freedesktop.org/drm/intel/issues/7229
Build changes
-------------
* Linux: CI_DRM_12333 -> Patchwork_110413v2
CI-20190529: 20190529
CI_DRM_12333: e7d1d39c197e7f06cf4d1ee19cfd467d6b68e10e @ git://anongit.freedesktop.org/gfx-ci/linux
IGT_7038: 5389b3f3b9b75df6bd8506e4aa3da357fd0c0ab1 @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git
Patchwork_110413v2: e7d1d39c197e7f06cf4d1ee19cfd467d6b68e10e @ git://anongit.freedesktop.org/gfx-ci/linux
### Linux commits
c92843681a18 drm/i915: Remove truncation warning for large objects
ab7b18a9855f drm/i915: Use error code as -E2BIG when the size of gem ttm object is too large
4389e2689bd6 drm/i915: Check if the size is too big while creating shmem file
084bc23a10c9 drm/i915: Check for integer truncation on the configuration of ttm place
fbf0071038b2 drm/i915: Check for integer truncation on scatterlist creation
fbae424b451f drm/i915/gem: Typecheck page lookups
86dffbe22669 overflow: Introduce overflows_type() and castable_to_type()
== Logs ==
For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_110413v2/index.html
[-- Attachment #2: Type: text/html, Size: 7793 bytes --]
^ permalink raw reply [flat|nested] 18+ messages in thread