Chris Wilson
25ffaa6745
drm/i915: Pass the right flags to i915_vma_move_to_active() ...
i915_vma_move_to_active() takes the execobject flags and not a boolean!
Instead of passing EXEC_OBJECT_WRITE we passed true [i.e.
EXEC_OBJECT_NEEDS_FENCE] causing us to start tracking the
vma->last_fence access and since we forgot to clear that on unbinding,
we caused a use-after-free.
[ 321.263854] BUG: KASAN: use-after-free in i915_gem_request_retire+0x1728/0x1740 [i915]
[ 321.264001] Read of size 8 at addr ffff880100fc67d8 by task gem_exec_reloc/2868
[ 321.264181] CPU: 0 PID: 2868 Comm: gem_exec_reloc Not tainted 4.12.0-rc6-CI-Custom_2759+ #1
[ 321.264195] Hardware name: GIGABYTE GB-BXBT-1900/MZBAYAB-00, BIOS F6 02/17/2015
[ 321.264208] Call Trace:
[ 321.264234] dump_stack+0x67/0x99
[ 321.264260] print_address_description+0x77/0x290
[ 321.264437] ? i915_gem_request_retire+0x1728/0x1740 [i915]
[ 321.264459] kasan_report+0x269/0x350
[ 321.264487] __asan_report_load8_noabort+0x14/0x20
[ 321.264660] i915_gem_request_retire+0x1728/0x1740 [i915]
[ 321.264841] ? intel_ring_context_pin+0x131/0x690 [i915]
[ 321.265021] i915_gem_request_alloc+0x2c6/0x1220 [i915]
[ 321.265044] ? _raw_spin_unlock_irqrestore+0x3d/0x60
[ 321.265226] i915_gem_do_execbuffer+0xac0/0x2a20 [i915]
[ 321.265250] ? __lock_acquire+0xceb/0x5450
[ 321.265269] ? entry_SYSCALL_64_fastpath+0x1c/0xb1
[ 321.265291] ? kvmalloc_node+0x6b/0x80
[ 321.265310] ? kvmalloc_node+0x6b/0x80
[ 321.265489] ? eb_relocate_slow+0xbe0/0xbe0 [i915]
[ 321.265520] ? ___slab_alloc.constprop.28+0x2ab/0x3d0
[ 321.265549] ? debug_check_no_locks_freed+0x280/0x280
[ 321.265591] ? __might_fault+0xc6/0x1b0
[ 321.265782] i915_gem_execbuffer2+0x14a/0x3f0 [i915]
[ 321.265815] drm_ioctl+0x4ba/0xaa0
[ 321.265986] ? i915_gem_execbuffer+0xde0/0xde0 [i915]
[ 321.266017] ? drm_getunique+0x270/0x270
[ 321.266068] do_vfs_ioctl+0x17f/0xfa0
[ 321.266091] ? __fget+0x1ba/0x330
[ 321.266112] ? lock_acquire+0x390/0x390
[ 321.266133] ? ioctl_preallocate+0x1d0/0x1d0
[ 321.266164] ? __fget+0x1db/0x330
[ 321.266194] ? __fget_light+0x79/0x1f0
[ 321.266219] SyS_ioctl+0x3c/0x70
[ 321.266247] entry_SYSCALL_64_fastpath+0x1c/0xb1
[ 321.266265] RIP: 0033:0x7fcede207357
[ 321.266279] RSP: 002b:00007ffef0effe58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 321.266307] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fcede207357
[ 321.266321] RDX: 00007ffef0effef0 RSI: 0000000040406469 RDI: 0000000000000004
[ 321.266335] RBP: ffffffff812097c6 R08: 0000000000000008 R09: 0000000000000000
[ 321.266349] R10: 0000000000000008 R11: 0000000000000246 R12: ffff880116bcff98
[ 321.266363] R13: ffffffff81cb7cb3 R14: ffff880116bcff70 R15: 0000000000000000
[ 321.266385] ? __this_cpu_preempt_check+0x13/0x20
[ 321.266406] ? trace_hardirqs_off_caller+0x1d6/0x2c0
[ 321.266487] Allocated by task 2868:
[ 321.266568] save_stack_trace+0x16/0x20
[ 321.266586] kasan_kmalloc+0xee/0x180
[ 321.266602] kasan_slab_alloc+0x12/0x20
[ 321.266620] kmem_cache_alloc+0xc7/0x2e0
[ 321.266795] i915_vma_instance+0x28c/0x1540 [i915]
[ 321.266964] eb_lookup_vmas+0x5a7/0x2250 [i915]
[ 321.267130] i915_gem_do_execbuffer+0x69a/0x2a20 [i915]
[ 321.267296] i915_gem_execbuffer2+0x14a/0x3f0 [i915]
[ 321.267315] drm_ioctl+0x4ba/0xaa0
[ 321.267333] do_vfs_ioctl+0x17f/0xfa0
[ 321.267350] SyS_ioctl+0x3c/0x70
[ 321.267369] entry_SYSCALL_64_fastpath+0x1c/0xb1
[ 321.267428] Freed by task 177:
[ 321.267502] save_stack_trace+0x16/0x20
[ 321.267521] kasan_slab_free+0xad/0x180
[ 321.267539] kmem_cache_free+0xc5/0x340
[ 321.267710] i915_vma_unbind+0x666/0x10a0 [i915]
[ 321.267880] i915_vma_close+0x23a/0x2f0 [i915]
[ 321.268048] __i915_gem_free_objects+0x17d/0xc70 [i915]
[ 321.268215] __i915_gem_free_work+0x49/0x70 [i915]
[ 321.268234] process_one_work+0x66f/0x1410
[ 321.268252] worker_thread+0xe1/0xe90
[ 321.268269] kthread+0x304/0x410
[ 321.268285] ret_from_fork+0x27/0x40
[ 321.268346] The buggy address belongs to the object at ffff880100fc6640
which belongs to the cache i915_vma of size 656
[ 321.268550] The buggy address is located 408 bytes inside of
656-byte region [ffff880100fc6640, ffff880100fc68d0)
[ 321.268741] The buggy address belongs to the page:
[ 321.268837] page:ffffea000403f000 count:1 mapcount:0 mapping: (null) index:0xffff880100fc5980 compound_mapcount: 0
[ 321.269045] flags: 0x8000000000008100(slab|head)
[ 321.269147] raw: 8000000000008100 0000000000000000 ffff880100fc5980 00000001001e001d
[ 321.269312] raw: ffffea0004038e20 ffff880116b46240 ffff88011646c640 0000000000000000
[ 321.269484] page dumped because: kasan: bad access detected
[ 321.269665] Memory state around the buggy address:
[ 321.269778] ffff880100fc6680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 321.269949] ffff880100fc6700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 321.270115] >ffff880100fc6780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 321.270279] ^
[ 321.270410] ffff880100fc6800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 321.270576] ffff880100fc6880: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc
[ 321.270740] ==================================================================
[ 321.270903] Disabling lock debugging due to kernel taint
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=101511
Fixes: 7dd4f6729f92 ("drm/i915: Async GPU relocation processing")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20170620124321.1108-2-chris@chris-wilson.co.uk
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
2017-06-20 21:10:30 +01:00
2017-06-20 17:13:47 +01:00
2017-06-20 21:00:30 +01:00
2017-06-01 15:53:03 +03:00
2017-05-10 13:47:55 +03:00
2017-05-17 13:38:04 +01:00
2017-06-20 21:00:27 +01:00
2017-06-20 21:00:22 +01:00
2017-06-20 21:00:22 +01:00
2017-06-14 14:06:22 +01:00
2017-06-16 14:52:27 +01:00
2017-05-03 11:08:45 +01:00
2017-06-20 17:13:54 +01:00
2017-06-20 17:13:54 +01:00
2017-05-03 23:15:02 +01:00
2017-06-16 16:54:05 +01:00
2017-06-20 21:10:30 +01:00
2017-03-06 14:38:18 +00:00
2017-06-16 16:14:29 -07:00
2017-06-16 16:54:05 +01:00
2017-06-16 14:52:27 +01:00
2017-06-16 16:54:04 +01:00
2017-02-27 18:43:46 -08:00
2017-06-08 12:33:09 +01:00
2017-05-30 15:25:28 +10:00
2017-06-14 10:55:11 +01:00
2017-06-16 14:52:27 +01:00
2017-06-01 14:27:44 +01:00
2017-05-03 11:08:48 +01:00
2017-05-03 11:08:52 +01:00
2017-06-16 16:54:05 +01:00
2017-06-20 21:00:16 +01:00
2017-05-03 11:08:48 +01:00
2017-06-20 21:00:22 +01:00
2017-05-31 10:34:03 +03:00
2017-06-20 21:00:11 +01:00
2017-06-14 12:31:57 -07:00
2017-06-14 12:31:57 -07:00
2017-06-14 12:31:57 -07:00
2017-06-14 12:31:57 -07:00
2017-06-14 12:31:57 -07:00
2017-06-14 12:31:57 -07:00
2017-06-14 12:31:58 -07:00
2017-06-14 12:31:58 -07:00
2017-06-14 12:31:57 -07:00
2017-06-14 12:31:57 -07:00
2017-06-14 12:31:58 -07:00
2017-06-14 12:31:58 -07:00
2017-06-14 12:31:58 -07:00
2017-06-14 12:31:58 -07:00
2017-06-14 12:31:57 -07:00
2017-06-14 12:31:57 -07:00
2017-06-14 12:31:57 -07:00
2017-06-14 12:31:57 -07:00
2017-06-14 12:31:57 -07:00
2017-06-14 12:31:57 -07:00
2017-06-20 21:00:34 +01:00
2017-06-20 21:00:07 +01:00
2017-06-20 21:00:11 +01:00
2017-06-20 17:13:47 +01:00
2017-06-12 14:39:24 +03:00
2017-06-19 14:06:20 -07:00
2017-05-17 13:38:02 +01:00
2017-05-17 13:38:01 +01:00
2017-05-03 11:08:48 +01:00
2017-05-03 11:08:48 +01:00
2017-06-20 17:13:40 +01:00
2017-05-10 16:48:32 +03:00
2017-06-16 16:54:04 +01:00
2017-06-12 14:39:24 +03:00
2017-06-16 16:54:05 +01:00
2017-06-16 16:54:05 +01:00
2017-05-30 15:25:28 +10:00
2017-06-12 09:45:55 -07:00
2017-05-03 16:20:48 +03:00
2017-03-14 10:49:13 +02:00
2017-06-08 12:33:08 +01:00
2017-06-12 09:41:33 -07:00
2017-03-14 16:07:00 +02:00
2017-04-12 10:53:22 +02:00
2017-06-12 09:45:30 -07:00
2017-06-19 14:06:20 -07:00
2017-06-08 09:55:08 -07:00
2017-06-15 15:38:27 +03:00
2017-06-15 16:11:08 +03:00
2017-04-13 21:57:37 +03:00
2017-05-30 15:25:28 +10:00
2017-06-19 22:11:21 +03:00
2017-06-15 15:53:56 +03:00
2017-06-12 09:42:18 -07:00
2017-06-15 15:35:38 +03:00
2017-06-12 16:06:28 +02:00
2017-02-28 11:54:52 +02:00
2017-05-15 18:29:46 +03:00
2017-06-15 23:03:57 +03:00
2017-03-07 15:18:43 +02:00
2017-04-12 10:53:29 +02:00
2017-06-20 12:42:12 +01:00
2017-06-06 19:31:28 +03:00
2017-05-22 09:49:48 +02:00
2017-06-12 09:46:08 -07:00
2017-02-22 12:12:17 +00:00
2017-02-22 12:12:17 +00:00
2017-05-26 13:26:53 +01:00
2017-05-26 13:26:53 +01:00
2017-05-26 13:26:53 +01:00
2017-06-09 11:56:53 -07:00
2017-04-12 12:35:17 +01:00
2017-05-30 16:00:07 +03:00
2017-05-30 15:59:47 +03:00
2017-04-19 15:49:27 +03:00
2017-06-02 13:59:32 -07:00
2017-04-06 21:29:23 +02:00
2017-06-09 11:57:16 -07:00
2017-06-02 13:59:32 -07:00
2017-05-15 14:44:11 +03:00
2017-06-20 17:13:40 +01:00
2017-04-28 12:11:59 +03:00
2017-02-16 11:59:10 +02:00
2017-06-12 16:05:45 +02:00
2017-06-07 07:29:51 -07:00
2017-06-12 16:06:10 +02:00
2017-06-15 15:38:27 +03:00
2017-06-12 16:06:28 +02:00
2017-05-08 09:28:39 +02:00
2017-06-15 14:01:14 -07:00
2017-05-30 10:11:41 -07:00
2017-06-20 12:42:13 +01:00
2017-06-20 21:00:03 +01:00
2017-06-15 15:35:38 +03:00
2017-06-16 15:46:57 +03:00
2017-02-27 17:22:19 +00:00
2017-06-06 17:58:42 +03:00
2017-04-12 10:53:22 +02:00
2017-06-08 12:21:19 +03:00
2017-05-26 13:59:56 +01:00
2017-06-20 21:00:11 +01:00
2017-05-26 15:58:21 +01:00
2017-03-13 09:26:06 +01:00
2017-05-30 15:25:28 +10:00
2017-06-14 12:31:58 -07:00
25ffaa6745