From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.2 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BFBC1C43469 for ; Mon, 21 Sep 2020 16:54:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 83763206DC for ; Mon, 21 Sep 2020 16:54:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1600707289; bh=0J7lRRNkF0UwJRCCL6+ZqqjAfYmEsTy4Coh9mg2akVs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=mPFma5C7aVRvE1TACHoq7dNAARXxHCcK+8bgK3NM9j0qAy8oMUqpUZ8Yj+4OtnfMW bAtaKEwE+/M7Z6DTl8Lt2K1puIRin3ImEWDf0KUA/cGDWxacVmgpxKoNDEbIVe0ctJ wGxGujsRFmSmnEgZnvg+l03Tlw+5oCYPuvVMCYdA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727887AbgIUQqG (ORCPT ); Mon, 21 Sep 2020 12:46:06 -0400 Received: from mail.kernel.org ([198.145.29.99]:52156 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728429AbgIUQqE (ORCPT ); Mon, 21 Sep 2020 12:46:04 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id EFFAD20874; Mon, 21 Sep 2020 16:46:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1600706763; bh=0J7lRRNkF0UwJRCCL6+ZqqjAfYmEsTy4Coh9mg2akVs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MJfoz3EjvZBT10VWOe1W+1Cn+Bgkn6S4SdcpYSps2YkiIx4DFHr3xbi4pp8Rsgaw9 8xjsxmYdfq0tzNRqCS1sP1qJDDWg7znQv7emZRcZZq+ohvD455zwwBE8FJodN6Baki RiQMwVnlzhVaB2JxLAaPpEk+HM1o9E/g36aMq1rU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, CQ Tang , Chris Wilson , Tvrtko Ursulin , Mika Kuoppala , Rodrigo Vivi , Joonas Lahtinen , Jani Nikula Subject: [PATCH 5.8 084/118] drm/i915/gem: Delay tracking the GEM context until it is registered Date: Mon, 21 Sep 2020 18:28:16 +0200 Message-Id: <20200921162040.244816521@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20200921162036.324813383@linuxfoundation.org> References: <20200921162036.324813383@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Chris Wilson commit e7d95527f27a6d9edcffbd74eee38e5cb6b91785 upstream. Avoid exposing a partially constructed context by deferring the list_add() from the initial construction to the end of registration. Otherwise, if we peek into the list of contexts from inside debugfs, we may see the partially constructed context and chase down some dangling incomplete pointers. Reported-by: CQ Tang Fixes: 3aa9945a528e ("drm/i915: Separate GEM context construction and registration to userspace") Signed-off-by: Chris Wilson Cc: Tvrtko Ursulin Cc: CQ Tang Cc: # v5.2+ Reviewed-by: Mika Kuoppala Link: https://patchwork.freedesktop.org/patch/msgid/20200730092856.23615-1-chris@chris-wilson.co.uk Signed-off-by: Rodrigo Vivi Signed-off-by: Joonas Lahtinen (cherry picked from commit eb4dedae920a07c485328af3da2202ec5184fb17) Signed-off-by: Jani Nikula Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/i915/gem/i915_gem_context.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) --- a/drivers/gpu/drm/i915/gem/i915_gem_context.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c @@ -720,6 +720,7 @@ __create_context(struct drm_i915_private ctx->i915 = i915; ctx->sched.priority = I915_USER_PRIORITY(I915_PRIORITY_NORMAL); mutex_init(&ctx->mutex); + INIT_LIST_HEAD(&ctx->link); spin_lock_init(&ctx->stale.lock); INIT_LIST_HEAD(&ctx->stale.engines); @@ -746,10 +747,6 @@ __create_context(struct drm_i915_private for (i = 0; i < ARRAY_SIZE(ctx->hang_timestamp); i++) ctx->hang_timestamp[i] = jiffies - CONTEXT_FAST_HANG_JIFFIES; - spin_lock(&i915->gem.contexts.lock); - list_add_tail(&ctx->link, &i915->gem.contexts.list); - spin_unlock(&i915->gem.contexts.lock); - return ctx; err_free: @@ -937,6 +934,7 @@ static int gem_context_register(struct i struct drm_i915_file_private *fpriv, u32 *id) { + struct drm_i915_private *i915 = ctx->i915; struct i915_address_space *vm; int ret; @@ -955,8 +953,16 @@ static int gem_context_register(struct i /* And finally expose ourselves to userspace via the idr */ ret = xa_alloc(&fpriv->context_xa, id, ctx, xa_limit_32b, GFP_KERNEL); if (ret) - put_pid(fetch_and_zero(&ctx->pid)); + goto err_pid; + + spin_lock(&i915->gem.contexts.lock); + list_add_tail(&ctx->link, &i915->gem.contexts.list); + spin_unlock(&i915->gem.contexts.lock); + + return 0; +err_pid: + put_pid(fetch_and_zero(&ctx->pid)); return ret; }