| Message ID | 20200513103155.12336-1-imre.deak@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/dp_mst: Fix timeout handling of MST down messages | expand |
On Wed, May 13, 2020 at 01:31:55PM +0300, Imre Deak wrote: > This fixes the following use-after-free problem in case an MST down > message times out, while waiting for the response for it: > > [ 449.022841] [drm:drm_dp_mst_wait_tx_reply.isra.26] timedout msg send 0000000080ba7fa2 2 0 > [ 449.022898] ------------[ cut here ]------------ > [ 449.022903] list_add corruption. prev->next should be next (ffff88847dae32c0), but was 6b6b6b6b6b6b6b6b. (prev=ffff88847db1c140). > [ 449.022931] WARNING: CPU: 2 PID: 22 at lib/list_debug.c:28 __list_add_valid+0x4d/0x70 > [ 449.022935] Modules linked in: asix usbnet mii snd_hda_codec_hdmi mei_hdcp i915 x86_pkg_temp_thermal coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hwdep e1000e snd_hda_core ptp snd_pcm pps_core mei_me mei intel_lpss_pci prime_numbers > [ 449.022966] CPU: 2 PID: 22 Comm: kworker/2:0 Not tainted 5.7.0-rc3-CI-Patchwork_17536+ #1 > [ 449.022970] Hardware name: Intel Corporation Tiger Lake Client Platform/TigerLake U DDR4 SODIMM RVP, BIOS TGLSFWI1.R00.2457.A16.1912270059 12/27/2019 > [ 449.022976] Workqueue: events_long drm_dp_mst_link_probe_work > [ 449.022982] RIP: 0010:__list_add_valid+0x4d/0x70 > [ 449.022987] Code: c3 48 89 d1 48 c7 c7 f0 e7 32 82 48 89 c2 e8 3a 49 b7 ff 0f 0b 31 c0 c3 48 89 c1 4c 89 c6 48 c7 c7 40 e8 32 82 e8 23 49 b7 ff <0f> 0b 31 c0 c3 48 89 f2 4c 89 c1 48 89 fe 48 c7 c7 90 e8 32 82 e8 > [ 449.022991] RSP: 0018:ffffc900001abcb0 EFLAGS: 00010286 > [ 449.022995] RAX: 0000000000000000 RBX: ffff88847dae2d58 RCX: 0000000000000001 > [ 449.022999] RDX: 0000000080000001 RSI: ffff88849d914978 RDI: 00000000ffffffff > [ 449.023002] RBP: ffff88847dae32c0 R08: ffff88849d914978 R09: 0000000000000000 > [ 449.023006] R10: ffffc900001abcb8 R11: 0000000000000000 R12: ffff888490d98400 > [ 449.023009] R13: ffff88847dae3230 R14: ffff88847db1c140 R15: ffff888490d98540 > [ 449.023013] FS: 0000000000000000(0000) GS:ffff88849ff00000(0000) knlGS:0000000000000000 > [ 449.023017] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 449.023021] CR2: 00007fb96fafdc63 CR3: 0000000005610004 CR4: 0000000000760ee0 > [ 449.023025] PKRU: 55555554 > [ 449.023028] Call Trace: > [ 449.023034] drm_dp_queue_down_tx+0x59/0x110 > [ 449.023041] ? rcu_read_lock_sched_held+0x4d/0x80 > [ 449.023050] ? kmem_cache_alloc_trace+0x2a6/0x2d0 > [ 449.023060] drm_dp_send_link_address+0x74/0x870 > [ 449.023065] ? __slab_free+0x3e1/0x5c0 > [ 449.023071] ? lockdep_hardirqs_on+0xe0/0x1c0 > [ 449.023078] ? lockdep_hardirqs_on+0xe0/0x1c0 > [ 449.023097] drm_dp_check_and_send_link_address+0x9a/0xc0 > [ 449.023106] drm_dp_mst_link_probe_work+0x9e/0x160 > [ 449.023117] process_one_work+0x268/0x600 > [ 449.023124] ? __schedule+0x307/0x8d0 > [ 449.023139] worker_thread+0x37/0x380 > [ 449.023149] ? process_one_work+0x600/0x600 > [ 449.023153] kthread+0x140/0x160 > [ 449.023159] ? kthread_park+0x80/0x80 > [ 449.023169] ret_from_fork+0x24/0x50 > > Fixes: d308a881a591 ("drm/dp_mst: Kill the second sideband tx slot, save the world") > Cc: Lyude Paul <lyude@redhat.com> > Cc: Sean Paul <sean@poorly.run> > Cc: Wayne Lin <Wayne.Lin@amd.com> > Cc: <stable@vger.kernel.org> # v3.17+ > Signed-off-by: Imre Deak <imre.deak@intel.com> > --- > drivers/gpu/drm/drm_dp_mst_topology.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c > index 2d4132e0a98f..70455e304a26 100644 > --- a/drivers/gpu/drm/drm_dp_mst_topology.c > +++ b/drivers/gpu/drm/drm_dp_mst_topology.c > @@ -1197,7 +1197,8 @@ static int drm_dp_mst_wait_tx_reply(struct drm_dp_mst_branch *mstb, > > /* remove from q */ > if (txmsg->state == DRM_DP_SIDEBAND_TX_QUEUED || > - txmsg->state == DRM_DP_SIDEBAND_TX_START_SEND) > + txmsg->state == DRM_DP_SIDEBAND_TX_START_SEND || > + txmsg->state == DRM_DP_SIDEBAND_TX_SENT) > list_del(&txmsg->next); Looks correct. Pondering list_del_init() all over so we wouldn't even need the state check... Also the 'return 1' in process_single_tx_qlock() seems to be a zombie of some sort. Should probably be nuked to not confused the next person to read the code. Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> > } > out: > -- > 2.23.1 > > _______________________________________________ > Intel-gfx mailing list > Intel-gfx@lists.freedesktop.org > https://lists.freedesktop.org/mailman/listinfo/intel-gfx
On Wed, May 13, 2020 at 03:48:58PM +0300, Ville Syrjälä wrote: > On Wed, May 13, 2020 at 01:31:55PM +0300, Imre Deak wrote: > > This fixes the following use-after-free problem in case an MST down > > message times out, while waiting for the response for it: > > > > [ 449.022841] [drm:drm_dp_mst_wait_tx_reply.isra.26] timedout msg send 0000000080ba7fa2 2 0 > > [ 449.022898] ------------[ cut here ]------------ > > [ 449.022903] list_add corruption. prev->next should be next (ffff88847dae32c0), but was 6b6b6b6b6b6b6b6b. (prev=ffff88847db1c140). > > [ 449.022931] WARNING: CPU: 2 PID: 22 at lib/list_debug.c:28 __list_add_valid+0x4d/0x70 > > [ 449.022935] Modules linked in: asix usbnet mii snd_hda_codec_hdmi mei_hdcp i915 x86_pkg_temp_thermal coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hwdep e1000e snd_hda_core ptp snd_pcm pps_core mei_me mei intel_lpss_pci prime_numbers > > [ 449.022966] CPU: 2 PID: 22 Comm: kworker/2:0 Not tainted 5.7.0-rc3-CI-Patchwork_17536+ #1 > > [ 449.022970] Hardware name: Intel Corporation Tiger Lake Client Platform/TigerLake U DDR4 SODIMM RVP, BIOS TGLSFWI1.R00.2457.A16.1912270059 12/27/2019 > > [ 449.022976] Workqueue: events_long drm_dp_mst_link_probe_work > > [ 449.022982] RIP: 0010:__list_add_valid+0x4d/0x70 > > [ 449.022987] Code: c3 48 89 d1 48 c7 c7 f0 e7 32 82 48 89 c2 e8 3a 49 b7 ff 0f 0b 31 c0 c3 48 89 c1 4c 89 c6 48 c7 c7 40 e8 32 82 e8 23 49 b7 ff <0f> 0b 31 c0 c3 48 89 f2 4c 89 c1 48 89 fe 48 c7 c7 90 e8 32 82 e8 > > [ 449.022991] RSP: 0018:ffffc900001abcb0 EFLAGS: 00010286 > > [ 449.022995] RAX: 0000000000000000 RBX: ffff88847dae2d58 RCX: 0000000000000001 > > [ 449.022999] RDX: 0000000080000001 RSI: ffff88849d914978 RDI: 00000000ffffffff > > [ 449.023002] RBP: ffff88847dae32c0 R08: ffff88849d914978 R09: 0000000000000000 > > [ 449.023006] R10: ffffc900001abcb8 R11: 0000000000000000 R12: ffff888490d98400 > > [ 449.023009] R13: ffff88847dae3230 R14: ffff88847db1c140 R15: ffff888490d98540 > > [ 449.023013] FS: 0000000000000000(0000) GS:ffff88849ff00000(0000) knlGS:0000000000000000 > > [ 449.023017] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > > [ 449.023021] CR2: 00007fb96fafdc63 CR3: 0000000005610004 CR4: 0000000000760ee0 > > [ 449.023025] PKRU: 55555554 > > [ 449.023028] Call Trace: > > [ 449.023034] drm_dp_queue_down_tx+0x59/0x110 > > [ 449.023041] ? rcu_read_lock_sched_held+0x4d/0x80 > > [ 449.023050] ? kmem_cache_alloc_trace+0x2a6/0x2d0 > > [ 449.023060] drm_dp_send_link_address+0x74/0x870 > > [ 449.023065] ? __slab_free+0x3e1/0x5c0 > > [ 449.023071] ? lockdep_hardirqs_on+0xe0/0x1c0 > > [ 449.023078] ? lockdep_hardirqs_on+0xe0/0x1c0 > > [ 449.023097] drm_dp_check_and_send_link_address+0x9a/0xc0 > > [ 449.023106] drm_dp_mst_link_probe_work+0x9e/0x160 > > [ 449.023117] process_one_work+0x268/0x600 > > [ 449.023124] ? __schedule+0x307/0x8d0 > > [ 449.023139] worker_thread+0x37/0x380 > > [ 449.023149] ? process_one_work+0x600/0x600 > > [ 449.023153] kthread+0x140/0x160 > > [ 449.023159] ? kthread_park+0x80/0x80 > > [ 449.023169] ret_from_fork+0x24/0x50 > > > > Fixes: d308a881a591 ("drm/dp_mst: Kill the second sideband tx slot, save the world") > > Cc: Lyude Paul <lyude@redhat.com> > > Cc: Sean Paul <sean@poorly.run> > > Cc: Wayne Lin <Wayne.Lin@amd.com> > > Cc: <stable@vger.kernel.org> # v3.17+ > > Signed-off-by: Imre Deak <imre.deak@intel.com> > > --- > > drivers/gpu/drm/drm_dp_mst_topology.c | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c > > index 2d4132e0a98f..70455e304a26 100644 > > --- a/drivers/gpu/drm/drm_dp_mst_topology.c > > +++ b/drivers/gpu/drm/drm_dp_mst_topology.c > > @@ -1197,7 +1197,8 @@ static int drm_dp_mst_wait_tx_reply(struct drm_dp_mst_branch *mstb, > > > > /* remove from q */ > > if (txmsg->state == DRM_DP_SIDEBAND_TX_QUEUED || > > - txmsg->state == DRM_DP_SIDEBAND_TX_START_SEND) > > + txmsg->state == DRM_DP_SIDEBAND_TX_START_SEND || > > + txmsg->state == DRM_DP_SIDEBAND_TX_SENT) > > list_del(&txmsg->next); > > Looks correct. Pondering list_del_init() all over so we > wouldn't even need the state check... Good idea, that would work. > Also the 'return 1' in process_single_tx_qlock() seems > to be a zombie of some sort. Should probably be nuked to not > confused the next person to read the code. Yes, looks like a left-over by the fixed commit. > Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> > > > } > > out: > > -- > > 2.23.1 > > > > _______________________________________________ > > Intel-gfx mailing list > > Intel-gfx@lists.freedesktop.org > > https://lists.freedesktop.org/mailman/listinfo/intel-gfx > > -- > Ville Syrjälä > Intel
On Wed, May 13, 2020 at 02:40:29PM +0000, Patchwork wrote: > == Series Details == > > Series: drm/dp_mst: Fix timeout handling of MST down messages > URL : https://patchwork.freedesktop.org/series/77216/ > State : success Patch pushed to drm-misc-next, thanks for the review. > > == Summary == > > CI Bug Log - changes from CI_DRM_8472_full -> Patchwork_17643_full > ==================================================== > > Summary > ------- > > **SUCCESS** > > No regressions found. > > > > New tests > --------- > > New tests have been introduced between CI_DRM_8472_full and Patchwork_17643_full: > > ### New IGT tests (123) ### > > * igt@kms_cursor_crc@pipe-a-cursor-128x128-offscreen: > - Statuses : 7 pass(s) > - Exec time: [2.97, 4.97] s > > * igt@kms_cursor_crc@pipe-a-cursor-128x128-onscreen: > - Statuses : 8 pass(s) > - Exec time: [1.73, 2.92] s > > * igt@kms_cursor_crc@pipe-a-cursor-128x128-random: > - Statuses : 8 pass(s) > - Exec time: [2.74, 4.76] s > > * igt@kms_cursor_crc@pipe-a-cursor-128x128-rapid-movement: > - Statuses : 8 pass(s) > - Exec time: [0.19, 1.11] s > > * igt@kms_cursor_crc@pipe-a-cursor-128x128-sliding: > - Statuses : 8 pass(s) > - Exec time: [2.59, 4.28] s > > * igt@kms_cursor_crc@pipe-a-cursor-128x42-offscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 4.96] s > > * igt@kms_cursor_crc@pipe-a-cursor-128x42-onscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 2.89] s > > * igt@kms_cursor_crc@pipe-a-cursor-128x42-random: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 4.46] s > > * igt@kms_cursor_crc@pipe-a-cursor-128x42-sliding: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 4.28] s > > * igt@kms_cursor_crc@pipe-a-cursor-256x256-offscreen: > - Statuses : 8 pass(s) > - Exec time: [2.97, 4.94] s > > * igt@kms_cursor_crc@pipe-a-cursor-256x256-onscreen: > - Statuses : 8 pass(s) > - Exec time: [1.73, 2.90] s > > * igt@kms_cursor_crc@pipe-a-cursor-256x256-random: > - Statuses : 1 fail(s) 7 pass(s) > - Exec time: [0.44, 4.41] s > > * igt@kms_cursor_crc@pipe-a-cursor-256x256-rapid-movement: > - Statuses : 7 pass(s) > - Exec time: [0.29, 1.14] s > > * igt@kms_cursor_crc@pipe-a-cursor-256x256-sliding: > - Statuses : 8 pass(s) > - Exec time: [2.61, 4.30] s > > * igt@kms_cursor_crc@pipe-a-cursor-256x85-offscreen: > - Statuses : 1 fail(s) 6 pass(s) 1 skip(s) > - Exec time: [0.0, 4.97] s > > * igt@kms_cursor_crc@pipe-a-cursor-256x85-onscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 2.87] s > > * igt@kms_cursor_crc@pipe-a-cursor-256x85-random: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 4.43] s > > * igt@kms_cursor_crc@pipe-a-cursor-256x85-sliding: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 4.26] s > > * igt@kms_cursor_crc@pipe-a-cursor-512x170-offscreen: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-a-cursor-512x170-onscreen: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-a-cursor-512x170-random: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-a-cursor-512x170-sliding: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-a-cursor-512x512-offscreen: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-a-cursor-512x512-onscreen: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-a-cursor-512x512-random: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-a-cursor-512x512-rapid-movement: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-a-cursor-512x512-sliding: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-a-cursor-64x21-offscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 4.96] s > > * igt@kms_cursor_crc@pipe-a-cursor-64x21-onscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 2.89] s > > * igt@kms_cursor_crc@pipe-a-cursor-64x21-random: > - Statuses : 1 fail(s) 6 pass(s) 1 skip(s) > - Exec time: [0.0, 4.45] s > > * igt@kms_cursor_crc@pipe-a-cursor-64x21-sliding: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 4.74] s > > * igt@kms_cursor_crc@pipe-a-cursor-64x64-offscreen: > - Statuses : 8 pass(s) > - Exec time: [2.95, 4.96] s > > * igt@kms_cursor_crc@pipe-a-cursor-64x64-onscreen: > - Statuses : 8 pass(s) > - Exec time: [1.76, 3.29] s > > * igt@kms_cursor_crc@pipe-a-cursor-64x64-random: > - Statuses : 8 pass(s) > - Exec time: [2.69, 4.51] s > > * igt@kms_cursor_crc@pipe-a-cursor-64x64-rapid-movement: > - Statuses : 8 pass(s) > - Exec time: [0.18, 1.13] s > > * igt@kms_cursor_crc@pipe-a-cursor-64x64-sliding: > - Statuses : 8 pass(s) > - Exec time: [2.64, 4.67] s > > * igt@kms_cursor_crc@pipe-a-cursor-alpha-opaque: > - Statuses : 8 pass(s) > - Exec time: [0.26, 1.11] s > > * igt@kms_cursor_crc@pipe-a-cursor-alpha-transparent: > - Statuses : 8 pass(s) > - Exec time: [0.27, 1.08] s > > * igt@kms_cursor_crc@pipe-a-cursor-dpms: > - Statuses : 8 pass(s) > - Exec time: [0.83, 4.46] s > > * igt@kms_cursor_crc@pipe-a-cursor-size-change: > - Statuses : 8 pass(s) > - Exec time: [0.49, 1.89] s > > * igt@kms_cursor_crc@pipe-a-cursor-suspend: > - Statuses : 8 pass(s) > - Exec time: [2.05, 5.28] s > > * igt@kms_cursor_crc@pipe-b-cursor-128x128-offscreen: > - Statuses : 8 pass(s) > - Exec time: [4.10, 5.89] s > > * igt@kms_cursor_crc@pipe-b-cursor-128x128-onscreen: > - Statuses : 8 pass(s) > - Exec time: [2.26, 4.06] s > > * igt@kms_cursor_crc@pipe-b-cursor-128x128-random: > - Statuses : 8 pass(s) > - Exec time: [3.71, 5.48] s > > * igt@kms_cursor_crc@pipe-b-cursor-128x128-rapid-movement: > - Statuses : 8 pass(s) > - Exec time: [0.28, 2.23] s > > * igt@kms_cursor_crc@pipe-b-cursor-128x128-sliding: > - Statuses : 8 pass(s) > - Exec time: [3.60, 5.36] s > > * igt@kms_cursor_crc@pipe-b-cursor-128x42-offscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.89] s > > * igt@kms_cursor_crc@pipe-b-cursor-128x42-onscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 4.03] s > > * igt@kms_cursor_crc@pipe-b-cursor-128x42-random: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.92] s > > * igt@kms_cursor_crc@pipe-b-cursor-128x42-sliding: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.36] s > > * igt@kms_cursor_crc@pipe-b-cursor-256x256-offscreen: > - Statuses : 8 pass(s) > - Exec time: [4.09, 5.89] s > > * igt@kms_cursor_crc@pipe-b-cursor-256x256-onscreen: > - Statuses : 8 pass(s) > - Exec time: [2.25, 3.97] s > > * igt@kms_cursor_crc@pipe-b-cursor-256x256-random: > - Statuses : 8 pass(s) > - Exec time: [3.73, 5.49] s > > * igt@kms_cursor_crc@pipe-b-cursor-256x256-rapid-movement: > - Statuses : 8 pass(s) > - Exec time: [0.26, 2.23] s > > * igt@kms_cursor_crc@pipe-b-cursor-256x256-sliding: > - Statuses : 8 pass(s) > - Exec time: [3.59, 5.36] s > > * igt@kms_cursor_crc@pipe-b-cursor-256x85-offscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.88] s > > * igt@kms_cursor_crc@pipe-b-cursor-256x85-onscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 4.45] s > > * igt@kms_cursor_crc@pipe-b-cursor-256x85-random: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.50] s > > * igt@kms_cursor_crc@pipe-b-cursor-256x85-sliding: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.36] s > > * igt@kms_cursor_crc@pipe-b-cursor-512x170-offscreen: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-b-cursor-512x170-onscreen: > - Statuses : 7 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-b-cursor-512x170-random: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-b-cursor-512x170-sliding: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-b-cursor-512x512-offscreen: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-b-cursor-512x512-onscreen: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-b-cursor-512x512-random: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-b-cursor-512x512-rapid-movement: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-b-cursor-512x512-sliding: > - Statuses : 7 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-b-cursor-64x21-offscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.90] s > > * igt@kms_cursor_crc@pipe-b-cursor-64x21-onscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 4.02] s > > * igt@kms_cursor_crc@pipe-b-cursor-64x21-random: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.49] s > > * igt@kms_cursor_crc@pipe-b-cursor-64x21-sliding: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.33] s > > * igt@kms_cursor_crc@pipe-b-cursor-64x64-offscreen: > - Statuses : 8 pass(s) > - Exec time: [4.08, 6.38] s > > * igt@kms_cursor_crc@pipe-b-cursor-64x64-onscreen: > - Statuses : 8 pass(s) > - Exec time: [2.30, 4.51] s > > * igt@kms_cursor_crc@pipe-b-cursor-64x64-random: > - Statuses : 8 pass(s) > - Exec time: [3.72, 5.50] s > > * igt@kms_cursor_crc@pipe-b-cursor-64x64-rapid-movement: > - Statuses : 8 pass(s) > - Exec time: [0.26, 2.27] s > > * igt@kms_cursor_crc@pipe-b-cursor-64x64-sliding: > - Statuses : 8 pass(s) > - Exec time: [3.59, 5.35] s > > * igt@kms_cursor_crc@pipe-b-cursor-alpha-opaque: > - Statuses : 8 pass(s) > - Exec time: [0.37, 2.21] s > > * igt@kms_cursor_crc@pipe-b-cursor-alpha-transparent: > - Statuses : 8 pass(s) > - Exec time: [0.42, 2.20] s > > * igt@kms_cursor_crc@pipe-b-cursor-dpms: > - Statuses : 8 pass(s) > - Exec time: [0.78, 5.30] s > > * igt@kms_cursor_crc@pipe-b-cursor-size-change: > - Statuses : 8 pass(s) > - Exec time: [0.52, 2.35] s > > * igt@kms_cursor_crc@pipe-b-cursor-suspend: > - Statuses : 8 pass(s) > - Exec time: [1.86, 6.19] s > > * igt@kms_cursor_crc@pipe-c-cursor-128x128-offscreen: > - Statuses : 1 fail(s) 6 pass(s) 1 skip(s) > - Exec time: [0.0, 5.41] s > > * igt@kms_cursor_crc@pipe-c-cursor-128x128-onscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 4.44] s > > * igt@kms_cursor_crc@pipe-c-cursor-128x128-random: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.95] s > > * igt@kms_cursor_crc@pipe-c-cursor-128x128-rapid-movement: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 2.23] s > > * igt@kms_cursor_crc@pipe-c-cursor-128x128-sliding: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.32] s > > * igt@kms_cursor_crc@pipe-c-cursor-128x42-offscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.88] s > > * igt@kms_cursor_crc@pipe-c-cursor-128x42-onscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 3.98] s > > * igt@kms_cursor_crc@pipe-c-cursor-128x42-random: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.46] s > > * igt@kms_cursor_crc@pipe-c-cursor-128x42-sliding: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.75] s > > * igt@kms_cursor_crc@pipe-c-cursor-256x256-offscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.88] s > > * igt@kms_cursor_crc@pipe-c-cursor-256x256-onscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 4.01] s > > * igt@kms_cursor_crc@pipe-c-cursor-256x256-random: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.46] s > > * igt@kms_cursor_crc@pipe-c-cursor-256x256-rapid-movement: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 2.24] s > > * igt@kms_cursor_crc@pipe-c-cursor-256x256-sliding: > - Statuses : 6 pass(s) 1 skip(s) > - Exec time: [0.0, 6.68] s > > * igt@kms_cursor_crc@pipe-c-cursor-256x85-offscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 6.67] s > > * igt@kms_cursor_crc@pipe-c-cursor-256x85-onscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 3.98] s > > * igt@kms_cursor_crc@pipe-c-cursor-256x85-random: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.42] s > > * igt@kms_cursor_crc@pipe-c-cursor-256x85-sliding: > - Statuses : 1 fail(s) 6 pass(s) 1 skip(s) > - Exec time: [0.0, 4.86] s > > * igt@kms_cursor_crc@pipe-c-cursor-512x170-offscreen: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-c-cursor-512x170-onscreen: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-c-cursor-512x170-random: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-c-cursor-512x170-sliding: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-c-cursor-512x512-offscreen: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-c-cursor-512x512-onscreen: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-c-cursor-512x512-random: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-c-cursor-512x512-rapid-movement: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-c-cursor-512x512-sliding: > - Statuses : 8 skip(s) > - Exec time: [0.0] s > > * igt@kms_cursor_crc@pipe-c-cursor-64x21-offscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.92] s > > * igt@kms_cursor_crc@pipe-c-cursor-64x21-onscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 3.97] s > > * igt@kms_cursor_crc@pipe-c-cursor-64x21-random: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.49] s > > * igt@kms_cursor_crc@pipe-c-cursor-64x21-sliding: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.35] s > > * igt@kms_cursor_crc@pipe-c-cursor-64x64-offscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.87] s > > * igt@kms_cursor_crc@pipe-c-cursor-64x64-onscreen: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 3.97] s > > * igt@kms_cursor_crc@pipe-c-cursor-64x64-random: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.48] s > > * igt@kms_cursor_crc@pipe-c-cursor-64x64-rapid-movement: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 2.27] s > > * igt@kms_cursor_crc@pipe-c-cursor-64x64-sliding: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 5.80] s > > * igt@kms_cursor_crc@pipe-c-cursor-alpha-opaque: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 2.64] s > > * igt@kms_cursor_crc@pipe-c-cursor-alpha-transparent: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 2.21] s > > * igt@kms_cursor_crc@pipe-c-cursor-dpms: > - Statuses : 6 pass(s) 1 skip(s) > - Exec time: [0.0, 5.33] s > > * igt@kms_cursor_crc@pipe-c-cursor-size-change: > - Statuses : 7 pass(s) 1 skip(s) > - Exec time: [0.0, 2.33] s > > * igt@kms_cursor_crc@pipe-c-cursor-suspend: > - Statuses : 1 incomplete(s) 6 pass(s) 1 skip(s) > - Exec time: [0.0, 6.39] s > > > > Known issues > ------------ > > Here are the changes found in Patchwork_17643_full that come from known issues: > > ### IGT changes ### > > #### Issues hit #### > > * igt@gem_workarounds@suspend-resume-fd: > - shard-apl: [PASS][1] -> [DMESG-WARN][2] ([i915#180]) > [1]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_8472/shard-apl1/igt@gem_workarounds@suspend-resume-fd.html > [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_17643/shard-apl4/igt@gem_workarounds@suspend-resume-fd.html > > * igt@kms_cursor_crc@pipe-c-cursor-256x85-sliding (NEW): > - shard-skl: [PASS][3] -> [FAIL][4] ([i915#54]) > [3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_8472/shard-skl2/igt@kms_cursor_crc@pipe-c-cursor-256x85-sliding.html > [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_17643/shard-skl3/igt@kms_cursor_crc@pipe-c-cursor-256x85-sliding.html > > * igt@kms_cursor_legacy@short-flip-before-cursor-toggle: > - shard-snb: [PASS][5] -> [SKIP][6] ([fdo#109271]) +1 similar issue > [5]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_8472/shard-snb4/igt@kms_cursor_legacy@short-flip-before-cursor-toggle.html > [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_17643/shard-snb4/igt@kms_cursor_legacy@short-flip-before-cursor-toggle.html > > * igt@kms_plane_alpha_blend@pipe-a-coverage-7efc: > - shard-skl: [PASS][7] -> [FAIL][8] ([fdo#108145] / [i915#265]) +1 similar issue > [7]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_8472/shard-skl3/igt@kms_plane_alpha_blend@pipe-a-coverage-7efc.html > [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_17643/shard-skl7/igt@kms_plane_alpha_blend@pipe-a-coverage-7efc.html > > * igt@kms_psr@psr2_cursor_mmap_cpu: > - shard-iclb: [PASS][9] -> [SKIP][10] ([fdo#109441]) +3 similar issues > [9]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_8472/shard-iclb2/igt@kms_psr@psr2_cursor_mmap_cpu.html > [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_17643/shard-iclb1/igt@kms_psr@psr2_cursor_mmap_cpu.html > > > #### Possible fixes #### > > * igt@gem_eio@in-flight-suspend: > - shard-skl: [INCOMPLETE][11] ([i915#69]) -> [PASS][12] > [11]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_8472/shard-skl4/igt@gem_eio@in-flight-suspend.html > [12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_17643/shard-skl2/igt@gem_eio@in-flight-suspend.html > > * igt@gem_softpin@noreloc-s3: > - shard-kbl: [DMESG-WARN][13] ([i915#180]) -> [PASS][14] > [13]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_8472/shard-kbl4/igt@gem_softpin@noreloc-s3.html > [14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_17643/shard-kbl3/igt@gem_softpin@noreloc-s3.html > > * igt@gen9_exec_parse@allowed-all: > - shard-apl: [DMESG-WARN][15] ([i915#1436] / [i915#716]) -> [PASS][16] > [15]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_8472/shard-apl4/igt@gen9_exec_parse@allowed-all.html > [16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_17643/shard-apl3/igt@gen9_exec_parse@allowed-all.html > > * igt@i915_selftest@live@execlists: > - shard-skl: [INCOMPLETE][17] ([i915#1874]) -> [PASS][18] > [17]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_8472/shard-skl6/igt@i915_selftest@live@execlists.html > [18]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_17643/shard-skl7/igt@i915_selftest@live@execlists.html > > * {igt@kms_flip@flip-vs-suspend-interruptible@c-dp1}: > - shard-apl: [DMESG-WARN][19] ([i915#180]) -> [PASS][20] +2 similar issues > [19]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_8472/shard-apl8/igt@kms_flip@flip-vs-suspend-interruptible@c-dp1.html > [20]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_17643/shard-apl7/igt@kms_flip@flip-vs-suspend-interruptible@c-dp1.html > > * igt@kms_psr@psr2_primary_blt: > - shard-iclb: [SKIP][21] ([fdo#109441]) -> [PASS][22] > [21]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_8472/shard-iclb8/igt@kms_psr@psr2_primary_blt.html > [22]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_17643/shard-iclb2/igt@kms_psr@psr2_primary_blt.html > > > #### Warnings #### > > * igt@kms_content_protection@lic: > - shard-apl: [FAIL][23] ([fdo#110321]) -> [TIMEOUT][24] ([i915#1319]) +1 similar issue > [23]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_8472/shard-apl8/igt@kms_content_protection@lic.html > [24]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_17643/shard-apl7/igt@kms_content_protection@lic.html > > > {name}: This element is suppressed. This means it is ignored when computing > the status of the difference (SUCCESS, WARNING, or FAILURE). > > [fdo#108145]: https://bugs.freedesktop.org/show_bug.cgi?id=108145 > [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 > [fdo#109441]: https://bugs.freedesktop.org/show_bug.cgi?id=109441 > [fdo#110321]: https://bugs.freedesktop.org/show_bug.cgi?id=110321 > [i915#1319]: https://gitlab.freedesktop.org/drm/intel/issues/1319 > [i915#1436]: https://gitlab.freedesktop.org/drm/intel/issues/1436 > [i915#180]: https://gitlab.freedesktop.org/drm/intel/issues/180 > [i915#1874]: https://gitlab.freedesktop.org/drm/intel/issues/1874 > [i915#265]: https://gitlab.freedesktop.org/drm/intel/issues/265 > [i915#54]: https://gitlab.freedesktop.org/drm/intel/issues/54 > [i915#69]: https://gitlab.freedesktop.org/drm/intel/issues/69 > [i915#716]: https://gitlab.freedesktop.org/drm/intel/issues/716 > > > Participating hosts (11 -> 11) > ------------------------------ > > No changes in participating hosts > > > Build changes > ------------- > > * CI: CI-20190529 -> None > * Linux: CI_DRM_8472 -> Patchwork_17643 > > CI-20190529: 20190529 > CI_DRM_8472: 57acc5ba2cfb81691917a3da729573a99c893e5a @ git://anongit.freedesktop.org/gfx-ci/linux > IGT_5651: e54e2642f1967ca3c488db32264607df670d1dfb @ git://anongit.freedesktop.org/xorg/app/intel-gpu-tools > Patchwork_17643: 211186b681ff1bc9c2f4f70d495e1072ae5ee0b4 @ git://anongit.freedesktop.org/gfx-ci/linux > piglit_4509: fdc5a4ca11124ab8413c7988896eec4c97336694 @ git://anongit.freedesktop.org/piglit > > == Logs == > > For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_17643/index.html
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c index 2d4132e0a98f..70455e304a26 100644 --- a/drivers/gpu/drm/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/drm_dp_mst_topology.c @@ -1197,7 +1197,8 @@ static int drm_dp_mst_wait_tx_reply(struct drm_dp_mst_branch *mstb, /* remove from q */ if (txmsg->state == DRM_DP_SIDEBAND_TX_QUEUED || - txmsg->state == DRM_DP_SIDEBAND_TX_START_SEND) + txmsg->state == DRM_DP_SIDEBAND_TX_START_SEND || + txmsg->state == DRM_DP_SIDEBAND_TX_SENT) list_del(&txmsg->next); } out:
This fixes the following use-after-free problem in case an MST down message times out, while waiting for the response for it: [ 449.022841] [drm:drm_dp_mst_wait_tx_reply.isra.26] timedout msg send 0000000080ba7fa2 2 0 [ 449.022898] ------------[ cut here ]------------ [ 449.022903] list_add corruption. prev->next should be next (ffff88847dae32c0), but was 6b6b6b6b6b6b6b6b. (prev=ffff88847db1c140). [ 449.022931] WARNING: CPU: 2 PID: 22 at lib/list_debug.c:28 __list_add_valid+0x4d/0x70 [ 449.022935] Modules linked in: asix usbnet mii snd_hda_codec_hdmi mei_hdcp i915 x86_pkg_temp_thermal coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hwdep e1000e snd_hda_core ptp snd_pcm pps_core mei_me mei intel_lpss_pci prime_numbers [ 449.022966] CPU: 2 PID: 22 Comm: kworker/2:0 Not tainted 5.7.0-rc3-CI-Patchwork_17536+ #1 [ 449.022970] Hardware name: Intel Corporation Tiger Lake Client Platform/TigerLake U DDR4 SODIMM RVP, BIOS TGLSFWI1.R00.2457.A16.1912270059 12/27/2019 [ 449.022976] Workqueue: events_long drm_dp_mst_link_probe_work [ 449.022982] RIP: 0010:__list_add_valid+0x4d/0x70 [ 449.022987] Code: c3 48 89 d1 48 c7 c7 f0 e7 32 82 48 89 c2 e8 3a 49 b7 ff 0f 0b 31 c0 c3 48 89 c1 4c 89 c6 48 c7 c7 40 e8 32 82 e8 23 49 b7 ff <0f> 0b 31 c0 c3 48 89 f2 4c 89 c1 48 89 fe 48 c7 c7 90 e8 32 82 e8 [ 449.022991] RSP: 0018:ffffc900001abcb0 EFLAGS: 00010286 [ 449.022995] RAX: 0000000000000000 RBX: ffff88847dae2d58 RCX: 0000000000000001 [ 449.022999] RDX: 0000000080000001 RSI: ffff88849d914978 RDI: 00000000ffffffff [ 449.023002] RBP: ffff88847dae32c0 R08: ffff88849d914978 R09: 0000000000000000 [ 449.023006] R10: ffffc900001abcb8 R11: 0000000000000000 R12: ffff888490d98400 [ 449.023009] R13: ffff88847dae3230 R14: ffff88847db1c140 R15: ffff888490d98540 [ 449.023013] FS: 0000000000000000(0000) GS:ffff88849ff00000(0000) knlGS:0000000000000000 [ 449.023017] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 449.023021] CR2: 00007fb96fafdc63 CR3: 0000000005610004 CR4: 0000000000760ee0 [ 449.023025] PKRU: 55555554 [ 449.023028] Call Trace: [ 449.023034] drm_dp_queue_down_tx+0x59/0x110 [ 449.023041] ? rcu_read_lock_sched_held+0x4d/0x80 [ 449.023050] ? kmem_cache_alloc_trace+0x2a6/0x2d0 [ 449.023060] drm_dp_send_link_address+0x74/0x870 [ 449.023065] ? __slab_free+0x3e1/0x5c0 [ 449.023071] ? lockdep_hardirqs_on+0xe0/0x1c0 [ 449.023078] ? lockdep_hardirqs_on+0xe0/0x1c0 [ 449.023097] drm_dp_check_and_send_link_address+0x9a/0xc0 [ 449.023106] drm_dp_mst_link_probe_work+0x9e/0x160 [ 449.023117] process_one_work+0x268/0x600 [ 449.023124] ? __schedule+0x307/0x8d0 [ 449.023139] worker_thread+0x37/0x380 [ 449.023149] ? process_one_work+0x600/0x600 [ 449.023153] kthread+0x140/0x160 [ 449.023159] ? kthread_park+0x80/0x80 [ 449.023169] ret_from_fork+0x24/0x50 Fixes: d308a881a591 ("drm/dp_mst: Kill the second sideband tx slot, save the world") Cc: Lyude Paul <lyude@redhat.com> Cc: Sean Paul <sean@poorly.run> Cc: Wayne Lin <Wayne.Lin@amd.com> Cc: <stable@vger.kernel.org> # v3.17+ Signed-off-by: Imre Deak <imre.deak@intel.com> --- drivers/gpu/drm/drm_dp_mst_topology.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)