Chris Wilson 2abaad4eb5 drm/i915/gt: Check cacheline is valid before acquiring ... The hwsp_cacheline pointer from i915_request is very, very flimsy. The i915_request.timeline (and the hwsp_cacheline) are lost upon retiring (after an RCU grace). Therefore we need to confirm that once we have the right pointer for the cacheline, it is not in the process of being retired and disposed of before we attempt to acquire a reference to the cacheline. <3>[ 547.208237] BUG: KASAN: use-after-free in active_debug_hint+0x6a/0x70 [i915] <3>[ 547.208366] Read of size 8 at addr ffff88822a0d2710 by task gem_exec_parall/2536 <4>[ 547.208547] CPU: 3 PID: 2536 Comm: gem_exec_parall Tainted: G U 5.7.0-rc2-ged7a286b5d02d-kasan_117+ #1 <4>[ 547.208556] Hardware name: Dell Inc. XPS 13 9350/, BIOS 1.4.12 11/30/2016 <4>[ 547.208564] Call Trace: <4>[ 547.208579] dump_stack+0x96/0xdb <4>[ 547.208707] ? active_debug_hint+0x6a/0x70 [i915] <4>[ 547.208719] print_address_description.constprop.6+0x16/0x310 <4>[ 547.208841] ? active_debug_hint+0x6a/0x70 [i915] <4>[ 547.208963] ? active_debug_hint+0x6a/0x70 [i915] <4>[ 547.208975] __kasan_report+0x137/0x190 <4>[ 547.209106] ? active_debug_hint+0x6a/0x70 [i915] <4>[ 547.209127] kasan_report+0x32/0x50 <4>[ 547.209257] ? i915_gemfs_fini+0x40/0x40 [i915] <4>[ 547.209376] active_debug_hint+0x6a/0x70 [i915] <4>[ 547.209389] debug_print_object+0xa7/0x220 <4>[ 547.209405] ? lockdep_hardirqs_on+0x348/0x5f0 <4>[ 547.209426] debug_object_assert_init+0x297/0x430 <4>[ 547.209449] ? debug_object_free+0x360/0x360 <4>[ 547.209472] ? lock_acquire+0x1ac/0x8a0 <4>[ 547.209592] ? intel_timeline_read_hwsp+0x4f/0x840 [i915] <4>[ 547.209737] ? i915_active_acquire_if_busy+0x66/0x120 [i915] <4>[ 547.209861] i915_active_acquire_if_busy+0x66/0x120 [i915] <4>[ 547.209990] ? __live_alloc.isra.15+0xc0/0xc0 [i915] <4>[ 547.210005] ? rcu_read_lock_sched_held+0xd0/0xd0 <4>[ 547.210017] ? print_usage_bug+0x580/0x580 <4>[ 547.210153] intel_timeline_read_hwsp+0xbc/0x840 [i915] <4>[ 547.210284] __emit_semaphore_wait+0xd5/0x480 [i915] <4>[ 547.210415] ? i915_fence_get_timeline_name+0x110/0x110 [i915] <4>[ 547.210428] ? lockdep_hardirqs_on+0x348/0x5f0 <4>[ 547.210442] ? _raw_spin_unlock_irq+0x2a/0x40 <4>[ 547.210567] ? __await_execution.constprop.51+0x2e0/0x570 [i915] <4>[ 547.210706] i915_request_await_dma_fence+0x8f7/0xc70 [i915] Fixes: 85bedbf191 ("drm/i915/gt: Eliminate the trylock for reading a timeline's hwsp") Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: <stable@vger.kernel.org> # v5.6+ Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20200427093038.29219-1-chris@chris-wilson.co.uk (cherry picked from commit 2759e39535) Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>		2020-04-27 09:47:40 -07:00
..
accessibility
acpi	More ACPI updates for 5.7-rc1	2020-04-10 09:52:15 -07:00
amba	Revert "amba: Initialize dma_parms for amba devices"	2020-04-01 08:03:28 +02:00
android
ata	ahci: Add Intel Comet Lake PCH RAID PCI ID	2020-04-09 09:31:38 -06:00
atm	.gitignore: add SPDX License Identifier	2020-03-25 11:50:48 +01:00
auxdisplay
base	mm/memory_hotplug: allow to specify a default online_type	2020-04-07 10:43:41 -07:00
bcma
block	xen: branch for v5.7-rc1b	2020-04-10 17:20:06 -07:00
bluetooth
bus	ARM: driver updates	2020-04-03 15:05:35 -07:00
cdrom
char	Merge branch 'akpm' (patches from Andrew)	2020-04-10 17:57:48 -07:00
clk	There's not much to see in the core framework this time around. Instead the	2020-04-05 10:43:32 -07:00
clocksource	clocksource/drivers/timer-vf-pit: Add missing parenthesis	2020-04-05 09:24:58 +02:00
connector
counter
cpufreq	Additional power management updates for 5.7-rc1	2020-04-06 10:14:39 -07:00
cpuidle	Merge branch 'pm-cpuidle'	2020-04-10 11:32:22 +02:00
crypto	Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6	2020-04-08 21:35:29 -07:00
dax	dax: Move mandatory ->zero_page_range() check in alloc_dax()	2020-04-02 19:15:03 -07:00
dca
devfreq	PM / devfreq: Fix handling dev_pm_qos_remove_request result	2020-03-25 08:35:03 +09:00
dio
dma	drivers/dma/tegra20-apb-dma.c: fix platform_get_irq.cocci warnings	2020-04-10 15:36:22 -07:00
dma-buf	A bunch of fixes to avoid null pointer dereference in fbcon, fix a return	2020-04-08 09:14:34 +10:00
edac	Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2020-03-30 16:40:08 -07:00
eisa	.gitignore: add SPDX License Identifier	2020-03-25 11:50:48 +01:00
extcon	Char/Misc driver patches for 5.7-rc1	2020-04-03 13:22:40 -07:00
firewire
firmware	sound fixes for 5.7-rc1	2020-04-10 12:27:06 -07:00
fpga
fsi
gnss
gpio	This is the bulk of GPIO development for the v5.7 kernel cycle.	2020-04-04 10:27:00 -07:00
gpu	drm/i915/gt: Check cacheline is valid before acquiring	2020-04-27 09:47:40 -07:00
greybus
hid	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid	2020-04-01 15:18:42 -07:00
hsi
hv	hv_balloon: don't check for memhp_auto_online manually	2020-04-07 10:43:40 -07:00
hwmon	change email address for Pali Rohár	2020-04-10 15:36:22 -07:00
hwspinlock	hwspinlock: hwspinlock_internal.h: Replace zero-length array with flexible-array member	2020-03-25 22:30:46 -07:00
hwtracing
i2c	Merge branch 'i2c/for-5.7' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux	2020-04-02 15:54:13 -07:00
i3c	i3c: convert to use i2c_new_client_device()	2020-03-29 10:35:50 +02:00
ide	drivers/ide: Fix build regression.	2020-04-04 18:07:59 -07:00
idle	Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2020-03-30 16:40:08 -07:00
iio	chrome platform changes for 5.7	2020-04-08 21:25:49 -07:00
infiniband	RDMA 5.7 pull request	2020-04-01 18:18:18 -07:00
input	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input	2020-04-07 20:20:12 -07:00
interconnect
iommu	Merge branches 'iommu/fixes', 'arm/qcom', 'arm/omap', 'arm/smmu', 'x86/amd', 'x86/vt-d', 'virtio' and 'core' into next	2020-03-27 11:33:27 +01:00
ipack
irqchip	Two reverts addressing regressions of the Xilinx interrupt controller	2020-04-05 11:57:12 -07:00
isdn
leds	leds: core: Fix warning message when init_data	2020-04-06 23:12:08 +02:00
lightnvm	for-5.7/drivers-2020-03-29	2020-03-30 11:43:51 -07:00
macintosh	Char/Misc driver patches for 5.7-rc1	2020-04-03 13:22:40 -07:00
mailbox
mcb
md	libnvdimm for 5.7	2020-04-08 21:03:40 -07:00
media	Power management updates for 5.7-rc1	2020-03-30 15:05:01 -07:00
memory	ARM: driver updates	2020-04-03 15:05:35 -07:00
memstick
message	scsi: message: fusion: Replace zero-length array with flexible-array member	2020-03-26 22:40:47 -04:00
mfd	mfd: intel-lpss: Fix Intel Elkhart Lake LPSS I2C input clock	2020-03-30 07:35:28 +01:00
misc	virtio: fixes, vdpa	2020-04-08 10:51:53 -07:00
mmc	MMC core:	2020-03-31 16:13:09 -07:00
most
mtd	This pull request contains fixes for UBI and UBIFS:	2020-04-07 12:40:56 -07:00
mux
net	virtio: fixes, vdpa	2020-04-08 10:51:53 -07:00
nfc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-03-25 18:58:11 -07:00
ntb	pci-v5.7-changes	2020-04-03 14:25:02 -07:00
nubus
nvdimm	libnvdimm for 5.7	2020-04-08 21:03:40 -07:00
nvme	block-5.7-2020-04-10	2020-04-10 10:06:54 -07:00
nvmem	nvmem: core: remove nvmem_sysfs_get_groups()	2020-03-25 19:23:49 +01:00
of	Devicetree updates for v5.7:	2020-04-02 17:32:52 -07:00
opp
oprofile
parisc	parisc: Replace setup_irq() by request_irq()	2020-04-05 22:05:23 +02:00
parport
pci	IOMMU Updates for Linux v5.7	2020-04-08 11:00:00 -07:00
pcmcia	pcmcia: remove some unused space characters	2020-03-31 18:48:22 +02:00
perf	arm64 updates for 5.7:	2020-03-31 10:05:01 -07:00
phy	pci-v5.7-changes	2020-04-03 14:25:02 -07:00
pinctrl	This is the bulk of GPIO development for the v5.7 kernel cycle.	2020-04-04 10:27:00 -07:00
platform	change email address for Pali Rohár	2020-04-10 15:36:22 -07:00
pnp
power	change email address for Pali Rohár	2020-04-10 15:36:22 -07:00
powercap	Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2020-03-30 16:40:08 -07:00
pps
ps3	powerpc/ps3: Remove an unneeded NULL check	2020-04-03 00:09:59 +11:00
ptp	ptp: Avoid deadlocks in the programmable pin code.	2020-03-30 11:16:38 -07:00
pwm	pwm: pca9685: Fix PWM/GPIO inter-operation	2020-04-03 21:41:42 +02:00
rapidio
ras
regulator	spi/regulator: Updates for v5.7	2020-03-30 14:58:26 -07:00
remoteproc	remoteproc/omap: Fix set_load call in omap_rproc_request_timer	2020-04-03 10:47:21 -07:00
reset
rpmsg
rtc	- New Drivers	2020-04-07 19:48:52 -07:00
s390	SCSI misc on 20200410	2020-04-10 12:21:11 -07:00
sbus
scsi	SCSI misc on 20200410	2020-04-10 12:21:11 -07:00
sfi
sh
siox
slimbus
soc	RISC-V Patches for the 5.7 Merge Window, Part 1	2020-04-09 10:51:30 -07:00
soundwire	Char/Misc driver patches for 5.7-rc1	2020-04-03 13:22:40 -07:00
spi	sound updates for 5.7-rc1	2020-04-02 15:50:04 -07:00
spmi
ssb
staging	mm/vma: introduce VM_ACCESS_FLAGS	2020-04-10 15:36:21 -07:00
target	SCSI misc on 20200410	2020-04-10 12:21:11 -07:00
tc
tee	ARM: driver updates	2020-04-03 15:05:35 -07:00
thermal	- Convert tsens configuration DT binding to yaml (Rajeshwari)	2020-04-07 20:00:16 -07:00
thunderbolt
tty	powerpc updates for 5.7	2020-04-05 11:12:59 -07:00
uio
usb	SCSI misc on 20200402	2020-04-02 17:03:53 -07:00
vdpa	vdpa: move to drivers/vdpa	2020-04-02 10:41:40 -04:00
vfio	vfio: Ignore -ENODEV when getting MSI cookie	2020-04-01 13:51:51 -06:00
vhost	vhost: introduce vDPA-based backend	2020-04-02 10:41:40 -04:00
video	drm fixes for 5.7-rc1	2020-04-07 20:24:34 -07:00
virt
virtio	virtio: fixes, vdpa	2020-04-08 10:51:53 -07:00
visorbus
vlynq
vme
w1
watchdog	watchdog: Add K3 RTI watchdog support	2020-04-01 11:35:23 +02:00
xen	xen: branch for v5.7-rc1b	2020-04-10 17:20:06 -07:00
zorro	SPDX patches for 5.7-rc1.	2020-04-03 13:12:26 -07:00
Kconfig	virtio: fixes, vdpa	2020-04-08 10:51:53 -07:00
Makefile	virtio: fixes, vdpa	2020-04-08 10:51:53 -07:00