From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 430BCC3DA4A for ; Tue, 20 Aug 2024 19:56:16 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id F15C210E097; Tue, 20 Aug 2024 19:56:15 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=intel.com header.i=@intel.com header.b="N24d5QC9"; dkim-atps=neutral Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.8]) by gabe.freedesktop.org (Postfix) with ESMTPS id E8E5410E097 for ; Tue, 20 Aug 2024 19:56:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1724183775; x=1755719775; h=date:message-id:from:to:cc:subject:in-reply-to: references:mime-version; bh=+Kt8f7fDF2su3H2RMAU5Nfwj25/CHtoYwFDzAKTJZp8=; b=N24d5QC9vjE5a8U111y1ShUCiouuXCtGk7b2Y9aH4CBoWrOP0AE8Y727 rly0KF0P3XGWqbHjNrikHLQfvKJJM4xFYBtigEMPIeWvWw8fafBOVeGms v8/RJ+vBsq+l4aGS9fR3TC1ZJfYN+9rnTZIsc81KArSR09SBj9AI+05sz q8O1ud7CLtoe7oebs/UdI2TdW40/pWKArfmZoKJ0PbM24U8jNtFip/BTV pK+rzEPmKbPH5wuCKBc/IZBBkB23RvcjwNLB7pcP1GnEGZ5gyrmXVaRXX drerZqWA2MKC1TMZmFixX7GyDaaOTtcS5TzZ5uhwtqvmw46FYBREA7u5E g==; X-CSE-ConnectionGUID: wcVWDmJ5QnWvRm1gsirtEQ== X-CSE-MsgGUID: lAhQ0PbyS4ygEthT6bUfLw== X-IronPort-AV: E=McAfee;i="6700,10204,11170"; a="40023568" X-IronPort-AV: E=Sophos;i="6.10,162,1719903600"; d="scan'208";a="40023568" Received: from fmviesa003.fm.intel.com ([10.60.135.143]) by fmvoesa102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 20 Aug 2024 12:56:14 -0700 X-CSE-ConnectionGUID: C2oyagPxSByjw9E2+c0F6g== X-CSE-MsgGUID: i+u05dWbRqi6rSHNQ4y19A== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.10,162,1719903600"; d="scan'208";a="65040404" Received: from jorgera1-mobl.amr.corp.intel.com (HELO adixit-arch.intel.com) ([10.124.118.77]) by fmviesa003-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 20 Aug 2024 12:56:14 -0700 Date: Tue, 20 Aug 2024 12:54:27 -0700 Message-ID: <878qwr7yx8.wl-ashutosh.dixit@intel.com> From: "Dixit, Ashutosh" To: Matthew Brost Cc: intel-xe@lists.freedesktop.org Subject: Re: [PATCH] drm/xe: Drop HW fence pointer to HW fence ctx In-Reply-To: <20240815193522.16008-1-matthew.brost@intel.com> References: <20240815193522.16008-1-matthew.brost@intel.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI-EPG/1.14.7 (Harue) FLIM-LB/1.14.9 (=?ISO-8859-4?Q?Goj=F2?=) APEL-LB/10.8 EasyPG/1.0.0 Emacs/29.4 (x86_64-pc-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII X-BeenThere: intel-xe@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel Xe graphics driver List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-xe-bounces@lists.freedesktop.org Sender: "Intel-xe" On Thu, 15 Aug 2024 12:35:22 -0700, Matthew Brost wrote: > Just a couple of nits below. Otherwise this is: Reviewed-by: Ashutosh Dixit > The HW fence ctx objects are not ref counted rather tied to the life of > an LRC object. HW fences reference the HW fence ctx, HW fences can > outlive LRCs thus resulting in UAF. Drop the HW fence pointer to HW > fence ctx rather just store was is needed directly in HW fence. s/was/what/ > > Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") > Signed-off-by: Matthew Brost > --- > drivers/gpu/drm/xe/xe_hw_fence.c | 9 +++++---- > drivers/gpu/drm/xe/xe_hw_fence_types.h | 7 +++++-- > drivers/gpu/drm/xe/xe_trace.h | 2 +- > 3 files changed, 11 insertions(+), 7 deletions(-) > > diff --git a/drivers/gpu/drm/xe/xe_hw_fence.c b/drivers/gpu/drm/xe/xe_hw_fence.c > index 45a9789cf501..25c20eac9e3a 100644 > --- a/drivers/gpu/drm/xe/xe_hw_fence.c > +++ b/drivers/gpu/drm/xe/xe_hw_fence.c > @@ -148,20 +148,20 @@ static const char *xe_hw_fence_get_driver_name(struct dma_fence *dma_fence) > { > struct xe_hw_fence *fence = to_xe_hw_fence(dma_fence); > > - return dev_name(gt_to_xe(fence->ctx->gt)->drm.dev); > + return dev_name(fence->xe->drm.dev); > } > > static const char *xe_hw_fence_get_timeline_name(struct dma_fence *dma_fence) > { > struct xe_hw_fence *fence = to_xe_hw_fence(dma_fence); > > - return fence->ctx->name; > + return fence->name; > } > > static bool xe_hw_fence_signaled(struct dma_fence *dma_fence) > { > struct xe_hw_fence *fence = to_xe_hw_fence(dma_fence); > - struct xe_device *xe = gt_to_xe(fence->ctx->gt); > + struct xe_device *xe = fence->xe; > u32 seqno = xe_map_rd(xe, &fence->seqno_map, 0, u32); > > return dma_fence->error || > @@ -253,7 +253,8 @@ void xe_hw_fence_init(struct dma_fence *fence, struct xe_hw_fence_ctx *ctx, > struct xe_hw_fence *hw_fence = > container_of(fence, typeof(*hw_fence), dma); > > - hw_fence->ctx = ctx; > + hw_fence->xe = gt_to_xe(ctx->gt); > + sprintf(hw_fence->name, "%s", ctx->name); snprintf? Limit to hw_fence->name size. > hw_fence->seqno_map = seqno_map; > INIT_LIST_HEAD(&hw_fence->irq_link); > > diff --git a/drivers/gpu/drm/xe/xe_hw_fence_types.h b/drivers/gpu/drm/xe/xe_hw_fence_types.h > index b33c4956e8ea..364a61f4bfda 100644 > --- a/drivers/gpu/drm/xe/xe_hw_fence_types.h > +++ b/drivers/gpu/drm/xe/xe_hw_fence_types.h > @@ -12,6 +12,7 @@ > #include > #include > > +struct xe_device; > struct xe_gt; > > /** > @@ -61,8 +62,10 @@ struct xe_hw_fence_ctx { > struct xe_hw_fence { > /** @dma: base dma fence for hardware fence context */ > struct dma_fence dma; > - /** @ctx: hardware fence context */ > - struct xe_hw_fence_ctx *ctx; > + /** @xe: Xe device for hw fence driver name */ > + struct xe_device *xe; > + /** @name: name of hardware fence context */ > + char name[MAX_FENCE_NAME_LEN]; > /** @seqno_map: I/O map for seqno */ > struct iosys_map seqno_map; > /** @irq_link: Link in struct xe_hw_fence_irq.pending */ > diff --git a/drivers/gpu/drm/xe/xe_trace.h b/drivers/gpu/drm/xe/xe_trace.h > index 1abdb30cb7ad..8573d7a87d84 100644 > --- a/drivers/gpu/drm/xe/xe_trace.h > +++ b/drivers/gpu/drm/xe/xe_trace.h > @@ -309,7 +309,7 @@ DECLARE_EVENT_CLASS(xe_hw_fence, > TP_ARGS(fence), > > TP_STRUCT__entry( > - __string(dev, __dev_name_gt(fence->ctx->gt)) > + __string(dev, __dev_name_xe(fence->xe)) > __field(u64, ctx) > __field(u32, seqno) > __field(struct xe_hw_fence *, fence) > -- > 2.34.1 >