1. 26 Apr, 2019 10 commits
  2. 25 Apr, 2019 2 commits
  3. 24 Apr, 2019 8 commits
  4. 23 Apr, 2019 3 commits
  5. 20 Apr, 2019 6 commits
  6. 19 Apr, 2019 6 commits
  7. 18 Apr, 2019 2 commits
  8. 17 Apr, 2019 3 commits
    • Chris Wilson's avatar
      drm/i915: Avoid use-after-free in reporting create.size · 99534023
      Chris Wilson authored
      We have to avoid chasing after a userspace race!
      
      <3>[  473.114328] BUG: KASAN: use-after-free in i915_gem_create+0x1d2/0x1f0 [i915]
      <3>[  473.114389] Read of size 8 at addr ffff88815bf1d840 by task gem_flink_race/1541
      
      <4>[  473.114464] CPU: 1 PID: 1541 Comm: gem_flink_race Tainted: G     U            5.1.0-rc4-g7d07e025e786-kasan_88+ #1
      <4>[  473.114469] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./J4205-ITX, BIOS P1.10 09/29/2016
      <4>[  473.114474] Call Trace:
      <4>[  473.114488]  dump_stack+0x7c/0xbb
      <4>[  473.114612]  ? i915_gem_create+0x1d2/0x1f0 [i915]
      <4>[  473.114621]  print_address_description+0x65/0x270
      <4>[  473.114728]  ? i915_gem_create+0x1d2/0x1f0 [i915]
      <4>[  473.114839]  ? i915_gem_create+0x1d2/0x1f0 [i915]
      <4>[  473.114848]  kasan_report+0x149/0x18d
      <4>[  473.114962]  ? i915_gem_create+0x1d2/0x1f0 [i915]
      <4>[  473.115069]  i915_gem_create+0x1d2/0x1f0 [i915]
      <4>[  473.115176]  ? i915_gem_object_create.part.28+0x4b0/0x4b0 [i915]
      <4>[  473.115289]  ? i915_gem_dumb_create+0x1a0/0x1a0 [i915]
      <4>[  473.115297]  drm_ioctl_kernel+0x192/0x260
      <4>[  473.115306]  ? drm_ioctl_permit+0x280/0x280
      <4>[  473.115326]  drm_ioctl+0x67c/0x960
      <4>[  473.115438]  ? i915_gem_dumb_create+0x1a0/0x1a0 [i915]
      <4>[  473.115448]  ? drm_getstats+0x20/0x20
      <4>[  473.115459]  ? __lock_acquire+0xa66/0x3fe0
      <4>[  473.115474]  ? _raw_spin_unlock_irqrestore+0x39/0x60
      <4>[  473.115485]  ? debug_object_active_state+0x2ea/0x4e0
      <4>[  473.115496]  ? debug_show_all_locks+0x2d0/0x2d0
      <4>[  473.115513]  do_vfs_ioctl+0x18d/0xfa0
      <4>[  473.115522]  ? check_flags.part.27+0x440/0x440
      <4>[  473.115532]  ? ioctl_preallocate+0x1a0/0x1a0
      <4>[  473.115547]  ? __fget+0x2ac/0x410
      <4>[  473.115561]  ? __ia32_sys_dup3+0xb0/0xb0
      <4>[  473.115569]  ? rwlock_bug.part.0+0x90/0x90
      <4>[  473.115590]  ksys_ioctl+0x35/0x70
      <4>[  473.115597]  ? lockdep_hardirqs_off+0x1cb/0x2b0
      <4>[  473.115608]  __x64_sys_ioctl+0x6a/0xb0
      <4>[  473.115614]  ? lockdep_hardirqs_on+0x342/0x590
      <4>[  473.115623]  do_syscall_64+0x97/0x400
      <4>[  473.115633]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      <4>[  473.115641] RIP: 0033:0x7fce590d55d7
      <4>[  473.115649] Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 f7 d8 64 89 01 48
      <4>[  473.115655] RSP: 002b:00007fce4d525ba8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
      <4>[  473.115662] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fce590d55d7
      <4>[  473.115667] RDX: 00007fce4d525c10 RSI: 00000000c010645b RDI: 0000000000000007
      <4>[  473.115672] RBP: 00007fce4d525c10 R08: 00007fce4d526700 R09: 00007fce4d526700
      <4>[  473.115677] R10: 0000000000000054 R11: 0000000000000246 R12: 00000000c010645b
      <4>[  473.115682] R13: 0000000000000007 R14: 0000000000000000 R15: 00007ffe0e4a7450
      
      <3>[  473.115731] Allocated by task 1541:
      <4>[  473.115766]  kmem_cache_alloc+0xce/0x290
      <4>[  473.115895]  i915_gem_object_create.part.28+0x1c/0x4b0 [i915]
      <4>[  473.116000]  i915_gem_create+0xe3/0x1f0 [i915]
      <4>[  473.116008]  drm_ioctl_kernel+0x192/0x260
      <4>[  473.116013]  drm_ioctl+0x67c/0x960
      <4>[  473.116020]  do_vfs_ioctl+0x18d/0xfa0
      <4>[  473.116026]  ksys_ioctl+0x35/0x70
      <4>[  473.116032]  __x64_sys_ioctl+0x6a/0xb0
      <4>[  473.116038]  do_syscall_64+0x97/0x400
      <4>[  473.116044]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      <3>[  473.116071] Freed by task 1542:
      <4>[  473.116101]  kmem_cache_free+0xb7/0x2f0
      <4>[  473.116205]  __i915_gem_free_objects+0x7d4/0xe10 [i915]
      <4>[  473.116311]  i915_gem_create_ioctl+0xaa/0xd0 [i915]
      <4>[  473.116318]  drm_ioctl_kernel+0x192/0x260
      <4>[  473.116323]  drm_ioctl+0x67c/0x960
      <4>[  473.116330]  do_vfs_ioctl+0x18d/0xfa0
      <4>[  473.116335]  ksys_ioctl+0x35/0x70
      <4>[  473.116341]  __x64_sys_ioctl+0x6a/0xb0
      <4>[  473.116347]  do_syscall_64+0x97/0x400
      <4>[  473.116354]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      Testcase: igt/gem_flink_race/flink_close
      Fixes: e163484a ("drm/i915: Update size upon return from GEM_CREATE")
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Michał Winiarski <michal.winiarski@intel.com>
      Reviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190417132507.27133-1-chris@chris-wilson.co.uk
      99534023
    • Chris Wilson's avatar
      drm/i915: Make workaround verification *optional* · 769f0dab
      Chris Wilson authored
      Sometimes the HW doesn't even play fair, and completely forgets about
      register writes. Skip verifying known troublemakers.
      
      References: https://bugs.freedesktop.org/show_bug.cgi?id=108954Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Reviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190417075657.19456-4-chris@chris-wilson.co.uk
      769f0dab
    • Chris Wilson's avatar
      drm/i915: Verify the engine workarounds stick on application · 254e1186
      Chris Wilson authored
      Read the engine workarounds back using the GPU after loading the initial
      context state to verify that we are setting them correctly, and bail if
      it fails.
      
      v2: Break out the verification into its own loop
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Reviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190417075657.19456-3-chris@chris-wilson.co.uk
      254e1186