From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id ABB5AC433EF for ; Mon, 20 Jun 2022 12:29:35 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 2685B10E1DA; Mon, 20 Jun 2022 12:29:34 +0000 (UTC) Received: from mga06.intel.com (mga06b.intel.com [134.134.136.31]) by gabe.freedesktop.org (Postfix) with ESMTPS id C544910E12E; Mon, 20 Jun 2022 12:29:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1655728172; x=1687264172; h=message-id:date:mime-version:subject:to:cc:references: from:in-reply-to:content-transfer-encoding; bh=HxnFIZ1qhK1EQpSYlB6DHWoJIa81C0a9zYF6I+iK9kk=; b=ObX+CmuHK6VCCIM2920cBDiGME6TXx2D4XeZBOKSmNiiTWMp/Llu33kv prVVbAUPJsfWoHL5698Rk2KLZ833ALVc0xyc9tgJ0pZPM2O7URPOAi2xG qp5apMIN3i07FgyPTeksx0aiOz5zVDDpaQ0cidQoRyxVyyxt6xHiCLalq PORKueo1oJq/mxf5g7segSU0ocuGBoUDx9zUM7bVSjDQQ/AfKCL4GUhLw Sqi2kK9AizbuNcbW+RiZEEcBjnD81hynLDVYRm6mYDNZpKC3pin1jAT1E Qeh3QUlwxz3EUvnEt+s/rNgtY4YcEVcig29WPJsnGKoxvNfQuflR33ZF1 w==; X-IronPort-AV: E=McAfee;i="6400,9594,10380"; a="341564627" X-IronPort-AV: E=Sophos;i="5.92,306,1650956400"; d="scan'208";a="341564627" Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by orsmga104.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 20 Jun 2022 05:29:32 -0700 X-IronPort-AV: E=Sophos;i="5.92,306,1650956400"; d="scan'208";a="729365541" Received: from ahashmi-mobl.ger.corp.intel.com (HELO [10.249.254.225]) ([10.249.254.225]) by fmsmga001-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 20 Jun 2022 05:29:30 -0700 Message-ID: Date: Mon, 20 Jun 2022 14:29:27 +0200 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Thunderbird/91.9.0 Content-Language: en-US To: Andi Shyti References: <20220512094045.792373-1-thomas.hellstrom@linux.intel.com> From: =?UTF-8?Q?Thomas_Hellstr=c3=b6m?= In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Subject: Re: [Intel-gfx] [PATCH] drm/i915: Fix vm use-after-free in vma destruction X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: intel-gfx@lists.freedesktop.org, Matthew Auld , dri-devel@lists.freedesktop.org Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" Hi, Andi On 5/19/22 23:46, Andi Shyti wrote: > Hi Thomas, > > On Thu, May 12, 2022 at 11:40:45AM +0200, Thomas Hellström wrote: >> In vma destruction, the following race may occur: >> >> Thread 1: Thread 2: >> i915_vma_destroy(); >> >> ... >> list_del_init(vma->vm_link); >> ... >> mutex_unlock(vma->vm->mutex); >> __i915_vm_release(); >> release_references(); >> >> And in release_reference() we dereference vma->vm to get to the >> vm gt pointer, leadin go a use-after free. > leading to Thanks, will fix. > > [...] > >> -static void release_references(struct i915_vma *vma, bool vm_ddestroy) >> +static void release_references(struct i915_vma *vma, struct intel_gt *gt, >> + bool vm_ddestroy) >> { >> struct drm_i915_gem_object *obj = vma->obj; >> - struct intel_gt *gt = vma->vm->gt; >> >> GEM_BUG_ON(i915_vma_is_active(vma)); > but then we have > > if (vm_ddestroy) > i915_vm_resv_put(vma->vm); > > were we reference to a freed vm, right? Do we need to check it > here, as well? No, it's not needed, since if vm_ddestroy is true, we keep the vm alive using the vm resv_ref until i915_vm_resv_put(). This is for the rare occasions where, during vm destruction, we fail to grab an object reference and therefore vma destruction is left for the object destructor. In those cases the vma needs to keep the vm in memory for it to be able to grab the vm mutex. /Thomas > > Andi