1. 26 Apr, 2019 11 commits
  2. 25 Apr, 2019 2 commits
  3. 24 Apr, 2019 8 commits
  4. 23 Apr, 2019 3 commits
  5. 20 Apr, 2019 6 commits
  6. 19 Apr, 2019 6 commits
  7. 18 Apr, 2019 2 commits
  8. 17 Apr, 2019 2 commits
    • Chris Wilson's avatar
      drm/i915: Avoid use-after-free in reporting create.size · 99534023
      Chris Wilson authored
      We have to avoid chasing after a userspace race!
      
      <3>[  473.114328] BUG: KASAN: use-after-free in i915_gem_create+0x1d2/0x1f0 [i915]
      <3>[  473.114389] Read of size 8 at addr ffff88815bf1d840 by task gem_flink_race/1541
      
      <4>[  473.114464] CPU: 1 PID: 1541 Comm: gem_flink_race Tainted: G     U            5.1.0-rc4-g7d07e025e786-kasan_88+ #1
      <4>[  473.114469] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./J4205-ITX, BIOS P1.10 09/29/2016
      <4>[  473.114474] Call Trace:
      <4>[  473.114488]  dump_stack+0x7c/0xbb
      <4>[  473.114612]  ? i915_gem_create+0x1d2/0x1f0 [i915]
      <4>[  473.114621]  print_address_description+0x65/0x270
      <4>[  473.114728]  ? i915_gem_create+0x1d2/0x1f0 [i915]
      <4>[  473.114839]  ? i915_gem_create+0x1d2/0x1f0 [i915]
      <4>[  473.114848]  kasan_report+0x149/0x18d
      <4>[  473.114962]  ? i915_gem_create+0x1d2/0x1f0 [i915]
      <4>[  473.115069]  i915_gem_create+0x1d2/0x1f0 [i915]
      <4>[  473.115176]  ? i915_gem_object_create.part.28+0x4b0/0x4b0 [i915]
      <4>[  473.115289]  ? i915_gem_dumb_create+0x1a0/0x1a0 [i915]
      <4>[  473.115297]  drm_ioctl_kernel+0x192/0x260
      <4>[  473.115306]  ? drm_ioctl_permit+0x280/0x280
      <4>[  473.115326]  drm_ioctl+0x67c/0x960
      <4>[  473.115438]  ? i915_gem_dumb_create+0x1a0/0x1a0 [i915]
      <4>[  473.115448]  ? drm_getstats+0x20/0x20
      <4>[  473.115459]  ? __lock_acquire+0xa66/0x3fe0
      <4>[  473.115474]  ? _raw_spin_unlock_irqrestore+0x39/0x60
      <4>[  473.115485]  ? debug_object_active_state+0x2ea/0x4e0
      <4>[  473.115496]  ? debug_show_all_locks+0x2d0/0x2d0
      <4>[  473.115513]  do_vfs_ioctl+0x18d/0xfa0
      <4>[  473.115522]  ? check_flags.part.27+0x440/0x440
      <4>[  473.115532]  ? ioctl_preallocate+0x1a0/0x1a0
      <4>[  473.115547]  ? __fget+0x2ac/0x410
      <4>[  473.115561]  ? __ia32_sys_dup3+0xb0/0xb0
      <4>[  473.115569]  ? rwlock_bug.part.0+0x90/0x90
      <4>[  473.115590]  ksys_ioctl+0x35/0x70
      <4>[  473.115597]  ? lockdep_hardirqs_off+0x1cb/0x2b0
      <4>[  473.115608]  __x64_sys_ioctl+0x6a/0xb0
      <4>[  473.115614]  ? lockdep_hardirqs_on+0x342/0x590
      <4>[  473.115623]  do_syscall_64+0x97/0x400
      <4>[  473.115633]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      <4>[  473.115641] RIP: 0033:0x7fce590d55d7
      <4>[  473.115649] Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 f7 d8 64 89 01 48
      <4>[  473.115655] RSP: 002b:00007fce4d525ba8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
      <4>[  473.115662] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fce590d55d7
      <4>[  473.115667] RDX: 00007fce4d525c10 RSI: 00000000c010645b RDI: 0000000000000007
      <4>[  473.115672] RBP: 00007fce4d525c10 R08: 00007fce4d526700 R09: 00007fce4d526700
      <4>[  473.115677] R10: 0000000000000054 R11: 0000000000000246 R12: 00000000c010645b
      <4>[  473.115682] R13: 0000000000000007 R14: 0000000000000000 R15: 00007ffe0e4a7450
      
      <3>[  473.115731] Allocated by task 1541:
      <4>[  473.115766]  kmem_cache_alloc+0xce/0x290
      <4>[  473.115895]  i915_gem_object_create.part.28+0x1c/0x4b0 [i915]
      <4>[  473.116000]  i915_gem_create+0xe3/0x1f0 [i915]
      <4>[  473.116008]  drm_ioctl_kernel+0x192/0x260
      <4>[  473.116013]  drm_ioctl+0x67c/0x960
      <4>[  473.116020]  do_vfs_ioctl+0x18d/0xfa0
      <4>[  473.116026]  ksys_ioctl+0x35/0x70
      <4>[  473.116032]  __x64_sys_ioctl+0x6a/0xb0
      <4>[  473.116038]  do_syscall_64+0x97/0x400
      <4>[  473.116044]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      <3>[  473.116071] Freed by task 1542:
      <4>[  473.116101]  kmem_cache_free+0xb7/0x2f0
      <4>[  473.116205]  __i915_gem_free_objects+0x7d4/0xe10 [i915]
      <4>[  473.116311]  i915_gem_create_ioctl+0xaa/0xd0 [i915]
      <4>[  473.116318]  drm_ioctl_kernel+0x192/0x260
      <4>[  473.116323]  drm_ioctl+0x67c/0x960
      <4>[  473.116330]  do_vfs_ioctl+0x18d/0xfa0
      <4>[  473.116335]  ksys_ioctl+0x35/0x70
      <4>[  473.116341]  __x64_sys_ioctl+0x6a/0xb0
      <4>[  473.116347]  do_syscall_64+0x97/0x400
      <4>[  473.116354]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
      
      Testcase: igt/gem_flink_race/flink_close
      Fixes: e163484a ("drm/i915: Update size upon return from GEM_CREATE")
      Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Michał Winiarski <michal.winiarski@intel.com>
      Reviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190417132507.27133-1-chris@chris-wilson.co.uk
      99534023
    • Chris Wilson's avatar
      drm/i915: Make workaround verification *optional* · 769f0dab
      Chris Wilson authored
      Sometimes the HW doesn't even play fair, and completely forgets about
      register writes. Skip verifying known troublemakers.
      
      References: https://bugs.freedesktop.org/show_bug.cgi?id=108954Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
      Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
      Reviewed-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20190417075657.19456-4-chris@chris-wilson.co.uk
      769f0dab