mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2025-03-11 05:09:30 +07:00
2abaad4eb5
The hwsp_cacheline pointer from i915_request is very, very flimsy. The i915_request.timeline (and the hwsp_cacheline) are lost upon retiring (after an RCU grace). Therefore we need to confirm that once we have the right pointer for the cacheline, it is not in the process of being retired and disposed of before we attempt to acquire a reference to the cacheline. <3>[ 547.208237] BUG: KASAN: use-after-free in active_debug_hint+0x6a/0x70 [i915] <3>[ 547.208366] Read of size 8 at addr ffff88822a0d2710 by task gem_exec_parall/2536 <4>[ 547.208547] CPU: 3 PID: 2536 Comm: gem_exec_parall Tainted: G U 5.7.0-rc2-ged7a286b5d02d-kasan_117+ #1 <4>[ 547.208556] Hardware name: Dell Inc. XPS 13 9350/, BIOS 1.4.12 11/30/2016 <4>[ 547.208564] Call Trace: <4>[ 547.208579] dump_stack+0x96/0xdb <4>[ 547.208707] ? active_debug_hint+0x6a/0x70 [i915] <4>[ 547.208719] print_address_description.constprop.6+0x16/0x310 <4>[ 547.208841] ? active_debug_hint+0x6a/0x70 [i915] <4>[ 547.208963] ? active_debug_hint+0x6a/0x70 [i915] <4>[ 547.208975] __kasan_report+0x137/0x190 <4>[ 547.209106] ? active_debug_hint+0x6a/0x70 [i915] <4>[ 547.209127] kasan_report+0x32/0x50 <4>[ 547.209257] ? i915_gemfs_fini+0x40/0x40 [i915] <4>[ 547.209376] active_debug_hint+0x6a/0x70 [i915] <4>[ 547.209389] debug_print_object+0xa7/0x220 <4>[ 547.209405] ? lockdep_hardirqs_on+0x348/0x5f0 <4>[ 547.209426] debug_object_assert_init+0x297/0x430 <4>[ 547.209449] ? debug_object_free+0x360/0x360 <4>[ 547.209472] ? lock_acquire+0x1ac/0x8a0 <4>[ 547.209592] ? intel_timeline_read_hwsp+0x4f/0x840 [i915] <4>[ 547.209737] ? i915_active_acquire_if_busy+0x66/0x120 [i915] <4>[ 547.209861] i915_active_acquire_if_busy+0x66/0x120 [i915] <4>[ 547.209990] ? __live_alloc.isra.15+0xc0/0xc0 [i915] <4>[ 547.210005] ? rcu_read_lock_sched_held+0xd0/0xd0 <4>[ 547.210017] ? print_usage_bug+0x580/0x580 <4>[ 547.210153] intel_timeline_read_hwsp+0xbc/0x840 [i915] <4>[ 547.210284] __emit_semaphore_wait+0xd5/0x480 [i915] <4>[ 547.210415] ? i915_fence_get_timeline_name+0x110/0x110 [i915] <4>[ 547.210428] ? lockdep_hardirqs_on+0x348/0x5f0 <4>[ 547.210442] ? _raw_spin_unlock_irq+0x2a/0x40 <4>[ 547.210567] ? __await_execution.constprop.51+0x2e0/0x570 [i915] <4>[ 547.210706] i915_request_await_dma_fence+0x8f7/0xc70 [i915] Fixes: |
||
|---|---|---|
| .. | ||
| selftests | ||
| uc | ||
| debugfs_engines.c | ||
| debugfs_engines.h | ||
| debugfs_gt_pm.c | ||
| debugfs_gt_pm.h | ||
| debugfs_gt.c | ||
| debugfs_gt.h | ||
| gen6_ppgtt.c | ||
| gen6_ppgtt.h | ||
| gen6_renderstate.c | ||
| gen7_renderclear.c | ||
| gen7_renderclear.h | ||
| gen7_renderstate.c | ||
| gen8_ppgtt.c | ||
| gen8_ppgtt.h | ||
| gen8_renderstate.c | ||
| gen9_renderstate.c | ||
| hsw_clear_kernel.c | ||
| intel_breadcrumbs.c | ||
| intel_context_param.c | ||
| intel_context_param.h | ||
| intel_context_sseu.c | ||
| intel_context_types.h | ||
| intel_context.c | ||
| intel_context.h | ||
| intel_engine_cs.c | ||
| intel_engine_heartbeat.c | ||
| intel_engine_heartbeat.h | ||
| intel_engine_pm.c | ||
| intel_engine_pm.h | ||
| intel_engine_pool_types.h | ||
| intel_engine_pool.c | ||
| intel_engine_pool.h | ||
| intel_engine_types.h | ||
| intel_engine_user.c | ||
| intel_engine_user.h | ||
| intel_engine.h | ||
| intel_ggtt.c | ||
| intel_gpu_commands.h | ||
| intel_gt_irq.c | ||
| intel_gt_irq.h | ||
| intel_gt_pm_irq.c | ||
| intel_gt_pm_irq.h | ||
| intel_gt_pm.c | ||
| intel_gt_pm.h | ||
| intel_gt_requests.c | ||
| intel_gt_requests.h | ||
| intel_gt_types.h | ||
| intel_gt.c | ||
| intel_gt.h | ||
| intel_gtt.c | ||
| intel_gtt.h | ||
| intel_llc_types.h | ||
| intel_llc.c | ||
| intel_llc.h | ||
| intel_lrc_reg.h | ||
| intel_lrc.c | ||
| intel_lrc.h | ||
| intel_mocs.c | ||
| intel_mocs.h | ||
| intel_ppgtt.c | ||
| intel_rc6_types.h | ||
| intel_rc6.c | ||
| intel_rc6.h | ||
| intel_renderstate.c | ||
| intel_renderstate.h | ||
| intel_reset_types.h | ||
| intel_reset.c | ||
| intel_reset.h | ||
| intel_ring_submission.c | ||
| intel_ring_types.h | ||
| intel_ring.c | ||
| intel_ring.h | ||
| intel_rps_types.h | ||
| intel_rps.c | ||
| intel_rps.h | ||
| intel_sseu.c | ||
| intel_sseu.h | ||
| intel_timeline_types.h | ||
| intel_timeline.c | ||
| intel_timeline.h | ||
| intel_workarounds_types.h | ||
| intel_workarounds.c | ||
| intel_workarounds.h | ||
| ivb_clear_kernel.c | ||
| mock_engine.c | ||
| mock_engine.h | ||
| selftest_context.c | ||
| selftest_engine_cs.c | ||
| selftest_engine_heartbeat.c | ||
| selftest_engine_pm.c | ||
| selftest_engine.c | ||
| selftest_engine.h | ||
| selftest_gt_pm.c | ||
| selftest_hangcheck.c | ||
| selftest_llc.c | ||
| selftest_llc.h | ||
| selftest_lrc.c | ||
| selftest_mocs.c | ||
| selftest_rc6.c | ||
| selftest_rc6.h | ||
| selftest_reset.c | ||
| selftest_ring_submission.c | ||
| selftest_timeline.c | ||
| selftest_workarounds.c | ||
| sysfs_engines.c | ||
| sysfs_engines.h | ||