From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF7CAC43387 for ; Thu, 3 Jan 2019 09:03:31 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B35C320815 for ; Thu, 3 Jan 2019 09:03:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727693AbfACJDb (ORCPT ); Thu, 3 Jan 2019 04:03:31 -0500 Received: from mga07.intel.com ([134.134.136.100]:39095 "EHLO mga07.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726214AbfACJDa (ORCPT ); Thu, 3 Jan 2019 04:03:30 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by orsmga105.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 03 Jan 2019 01:03:30 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.56,434,1539673200"; d="scan'208";a="113829326" Received: from kpriedit-mobl.ger.corp.intel.com (HELO [10.252.54.192]) ([10.252.54.192]) by fmsmga008.fm.intel.com with ESMTP; 03 Jan 2019 01:03:27 -0800 Subject: Re: [PATCH] drm: Reorder set_property_atomic to avoid returning with an active ww_ctx To: Chris Wilson , dri-devel@lists.freedesktop.org Cc: intel-gfx@lists.freedesktop.org, syzbot+6ea337c427f5083ebdf2@syzkaller.appspotmail.com, Daniel Vetter , Sean Paul , David Airlie , stable@vger.kernel.org References: <20181230122842.21917-1-chris@chris-wilson.co.uk> From: Maarten Lankhorst Message-ID: Date: Thu, 3 Jan 2019 10:03:27 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.3.1 MIME-Version: 1.0 In-Reply-To: <20181230122842.21917-1-chris@chris-wilson.co.uk> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Content-Language: en-US Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org Op 30-12-2018 om 13:28 schreef Chris Wilson: > Delay the drm_modeset_acquire_init() until after we check for an > allocation failure so that we can return immediately upon error without > having to unwind. > > WARNING: lock held when returning to user space! > 4.20.0+ #174 Not tainted > ------------------------------------------------ > syz-executor556/8153 is leaving the kernel with locks still held! > 1 lock held by syz-executor556/8153: > #0: 000000005100c85c (crtc_ww_class_acquire){+.+.}, at: > set_property_atomic+0xb3/0x330 drivers/gpu/drm/drm_mode_object.c:462 > > Reported-by: syzbot+6ea337c427f5083ebdf2@syzkaller.appspotmail.com > Fixes: 144a7999d633 ("drm: Handle properties in the core for atomic drivers") > Signed-off-by: Chris Wilson > Cc: Daniel Vetter > Cc: Maarten Lankhorst > Cc: Sean Paul > Cc: David Airlie > Cc: # v4.14+ > --- > drivers/gpu/drm/drm_mode_object.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/gpu/drm/drm_mode_object.c b/drivers/gpu/drm/drm_mode_object.c > index bb1dd46496cd..a9005c1c2384 100644 > --- a/drivers/gpu/drm/drm_mode_object.c > +++ b/drivers/gpu/drm/drm_mode_object.c > @@ -459,12 +459,13 @@ static int set_property_atomic(struct drm_mode_object *obj, > struct drm_modeset_acquire_ctx ctx; > int ret; > > - drm_modeset_acquire_init(&ctx, 0); > - > state = drm_atomic_state_alloc(dev); > if (!state) > return -ENOMEM; > + > + drm_modeset_acquire_init(&ctx, 0); > state->acquire_ctx = &ctx; > + > retry: > if (prop == state->dev->mode_config.dpms_property) { > if (obj->type != DRM_MODE_OBJECT_CONNECTOR) { Woops only now see you did the same.. :) Reviewed-by: Maarten Lankhorst