From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.3 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,USER_AGENT_MUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8D3EC43387 for ; Mon, 7 Jan 2019 10:30:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9EFBC20859 for ; Mon, 7 Jan 2019 10:30:13 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=ffwll.ch header.i=@ffwll.ch header.b="kBnA9EzC" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726601AbfAGKaN (ORCPT ); Mon, 7 Jan 2019 05:30:13 -0500 Received: from mail-ed1-f67.google.com ([209.85.208.67]:42980 "EHLO mail-ed1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726572AbfAGKaM (ORCPT ); Mon, 7 Jan 2019 05:30:12 -0500 Received: by mail-ed1-f67.google.com with SMTP id y20so349803edw.9 for ; Mon, 07 Jan 2019 02:30:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=OjWuY2DVasPye/H0xKMQx03d+SHmmbWLfJERH+Mt3Ck=; b=kBnA9EzChwb3Y8H7k9ulMueM/CwwZmcBYWhvo3cP+i+vYKkDeaBmFLyyUVIfDKCu5a QiovcWg0+IlggsWdsRk4HRUcvIujvPq/1eVLxhiiDgo2QMMjNDLNUSgvn/xAAL8G+L8O VWvzaWiUUGJH5KtM/LFZsSkholMfWiWsTPaPI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:from:to:cc:subject:message-id :references:mime-version:content-disposition:in-reply-to:user-agent; bh=OjWuY2DVasPye/H0xKMQx03d+SHmmbWLfJERH+Mt3Ck=; b=Fg4nXWdilyWThlLdOxpjgV6V7DsO/3fq04SS0OAsC3OegJX+kEBu56X4jl1Bj8aYTB eCyTPz/5vch16OGEUqtdvm46BW86oQ6zFk7z2fsYTOMt65JpZwKamxVP7bg+KG27gmFO /smRMa3OOZBC/x31XRz2O0ENFelf7yMR87NDWenLvD4xBPzkRRZjcLqlwNpXKkJEAJJC Sa1fGvD732Xgd/Fe7lVeHSO1i/MkfcDyVc44SapCdJr5tIhO85ps46/kzqvkQlsD0yg4 qu8xUzV8NVReI6anC6lWviJRvK8WunMtIHiH3ycCd1doYYyDci4Ap6Lmw+QAA5qkX11y ZxZg== X-Gm-Message-State: AA+aEWaTTd9hhlkbAnCqLOCEitCstw8cym0UImojxe9h3B70OUf3zVis Jve1VDmgJ/ivHTam+2YEW+zpQw== X-Google-Smtp-Source: AFSGD/WJWT+VkEu1BQSjdeJSq0eO5VMnRF9ye3mY0zZX0/Pnl1MtnSrI2T44IxYUZrmAATrndACbsw== X-Received: by 2002:a17:906:cd2:: with SMTP id l18-v6mr45573069ejh.97.1546857010847; Mon, 07 Jan 2019 02:30:10 -0800 (PST) Received: from phenom.ffwll.local ([2a02:168:569e:0:3106:d637:d723:e855]) by smtp.gmail.com with ESMTPSA id g13-v6sm18294241ejr.1.2019.01.07.02.30.09 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Mon, 07 Jan 2019 02:30:09 -0800 (PST) Date: Mon, 7 Jan 2019 11:30:07 +0100 From: Daniel Vetter To: Chris Wilson Cc: Maarten Lankhorst , dri-devel@lists.freedesktop.org, intel-gfx@lists.freedesktop.org, syzbot+6ea337c427f5083ebdf2@syzkaller.appspotmail.com, Daniel Vetter , Sean Paul , David Airlie , stable@vger.kernel.org Subject: Re: [PATCH] drm: Reorder set_property_atomic to avoid returning with an active ww_ctx Message-ID: <20190107103007.GE21184@phenom.ffwll.local> References: <20181230122842.21917-1-chris@chris-wilson.co.uk> <154651061429.27300.443406492276076372@skylake-alporthouse-com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <154651061429.27300.443406492276076372@skylake-alporthouse-com> X-Operating-System: Linux phenom 4.18.0-2-amd64 User-Agent: Mutt/1.10.1 (2018-07-13) Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org On Thu, Jan 03, 2019 at 10:16:54AM +0000, Chris Wilson wrote: > Quoting Maarten Lankhorst (2019-01-03 09:03:27) > > Op 30-12-2018 om 13:28 schreef Chris Wilson: > > > Delay the drm_modeset_acquire_init() until after we check for an > > > allocation failure so that we can return immediately upon error without > > > having to unwind. > > > > > > WARNING: lock held when returning to user space! > > > 4.20.0+ #174 Not tainted > > > ------------------------------------------------ > > > syz-executor556/8153 is leaving the kernel with locks still held! > > > 1 lock held by syz-executor556/8153: > > > #0: 000000005100c85c (crtc_ww_class_acquire){+.+.}, at: > > > set_property_atomic+0xb3/0x330 drivers/gpu/drm/drm_mode_object.c:462 > > > > > > Reported-by: syzbot+6ea337c427f5083ebdf2@syzkaller.appspotmail.com > > > Fixes: 144a7999d633 ("drm: Handle properties in the core for atomic drivers") > > > Signed-off-by: Chris Wilson > > > Cc: Daniel Vetter > > > Cc: Maarten Lankhorst > > > Cc: Sean Paul > > > Cc: David Airlie > > > Cc: # v4.14+ > > > --- > > > drivers/gpu/drm/drm_mode_object.c | 5 +++-- > > > 1 file changed, 3 insertions(+), 2 deletions(-) > > > > > > diff --git a/drivers/gpu/drm/drm_mode_object.c b/drivers/gpu/drm/drm_mode_object.c > > > index bb1dd46496cd..a9005c1c2384 100644 > > > --- a/drivers/gpu/drm/drm_mode_object.c > > > +++ b/drivers/gpu/drm/drm_mode_object.c > > > @@ -459,12 +459,13 @@ static int set_property_atomic(struct drm_mode_object *obj, > > > struct drm_modeset_acquire_ctx ctx; > > > int ret; > > > > > > - drm_modeset_acquire_init(&ctx, 0); > > > - > > > state = drm_atomic_state_alloc(dev); > > > if (!state) > > > return -ENOMEM; > > > + > > > + drm_modeset_acquire_init(&ctx, 0); > > > state->acquire_ctx = &ctx; > > > + > > > retry: > > > if (prop == state->dev->mode_config.dpms_property) { > > > if (obj->type != DRM_MODE_OBJECT_CONNECTOR) { > > > > Woops only now see you did the same.. :) > > I'm impressed that syszbot managed to hit it! Afaict, it is only a > debugging faux pas with no real user impact, so perhaps the stable is > overkill. Yeah, "small allocs can't fail" will make sure this isn't a real world bug. syzbot uses fault injection stuff to hit these (at least that's what it did in one of the destilled minimal reproduction cases in some other very similar report). > > Reviewed-by: Maarten Lankhorst > > Ta, pushed to drm-misc-next So agreed -next makes sense, no fixes (but I'm sure the autoselect will pick it up anyway, but that one can't be helped). -Daniel -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch