From patchwork Tue Feb 14 09:18:44 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Nicolai_H=C3=A4hnle?= X-Patchwork-Id: 9571495 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id AD6716045F for ; Tue, 14 Feb 2017 09:19:20 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A192427D45 for ; Tue, 14 Feb 2017 09:19:20 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 969FE28178; Tue, 14 Feb 2017 09:19:20 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 5F3DE27D45 for ; Tue, 14 Feb 2017 09:19:20 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id C33DC6E632; Tue, 14 Feb 2017 09:19:17 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-wr0-x244.google.com (mail-wr0-x244.google.com [IPv6:2a00:1450:400c:c0c::244]) by gabe.freedesktop.org (Postfix) with ESMTPS id 671D36E17C; Tue, 14 Feb 2017 09:19:14 +0000 (UTC) Received: by mail-wr0-x244.google.com with SMTP id k90so26711330wrc.3; Tue, 14 Feb 2017 01:19:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=8pfKwEm0IlKjfjA0/Zy4zmshMpDfJ9bt39it07HDFhg=; b=P2w1PhYvxcorOdaY0q8IYoxuykzaMSHjsz+TDErOk64U4sP7liK06wVRFsiynsVHBX DgzYaMnV35G//XMudrUQq1cCmjnEbxKH6YFhoUndKOm2vusUkFLVA6tO+f/mrWTYVzSP bMCOsMeWU7VO0pq4tcITwvkkKzpZ73Ki/Kj+OUU2447k1Bi/fPcgYjntbutkRm4NX3Ov m1V92IWKC4BO6DHM1t13A1+joAsbenZgcz3lQUty/YLlbMKpPTsiWLfzq6Lj+gPcSWPo zmUHUC1XYkrDZ5uiAtSBeN58Gvyub4yg2ZMFYWlOTcTZFL/QGe55wqxBMVc/fRoqXurw U3EQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=8pfKwEm0IlKjfjA0/Zy4zmshMpDfJ9bt39it07HDFhg=; b=bFohljhd9yjPzX6BW2JCvDBlHUqJoWNhRpKqm8OXYmzVYipSzq22y9YPKa4+XoOHSu 4ODt/Vyst0NixD5RxtRJbsye8whYXAkB0rx6pVgs/cdCoi7bY/xkrDRg6lon/YI7J+x/ p/4lp69bI8urlBq18/5HMoxJlBrOoJGgVJgYlSEJtwR07Ct9ArDr2L+tMaElk8CGagRP AwRbIp3pjkSYBaZ9GCtNKcoDNtXFJhf3P1c2orJsWF33OFUTfOzAw49YZDQnfUk80WHC lmMyvuSomAMl3WFpT1jg9jYbeBdJ3+vpIZvptOv8G1jUwdiqOYc13BlMruP/LLEda1TU lQLQ== X-Gm-Message-State: AMke39nAH7pjcSrj5ylFezYiNdiWsFKuYWKGI5O7XTduPOCnnQhiv/fQeR2rMO+cZv98xw== X-Received: by 10.223.161.74 with SMTP id r10mr24066415wrr.16.1487063953024; Tue, 14 Feb 2017 01:19:13 -0800 (PST) Received: from capella.localdomain (x5ce2e06e.dyn.telefonica.de. [92.226.224.110]) by smtp.gmail.com with ESMTPSA id x39sm17211935wrb.3.2017.02.14.01.19.11 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 14 Feb 2017 01:19:12 -0800 (PST) From: =?UTF-8?q?Nicolai=20H=C3=A4hnle?= To: amd-gfx@lists.freedesktop.org Subject: [PATCH 1/2] drm/ttm: never add BO that failed to validate to the LRU list Date: Tue, 14 Feb 2017 10:18:44 +0100 Message-Id: <20170214091845.1225-2-nhaehnle@gmail.com> X-Mailer: git-send-email 2.9.3 In-Reply-To: <20170214091845.1225-1-nhaehnle@gmail.com> References: <20170214091845.1225-1-nhaehnle@gmail.com> MIME-Version: 1.0 Cc: =?UTF-8?q?Nicolai=20H=C3=A4hnle?= , dri-devel@lists.freedesktop.org X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP From: Nicolai Hähnle Fixes a potential race condition in amdgpu that looks as follows: Task 1: attempt ttm_bo_init, but ttm_bo_validate fails Task 1: add BO to global list anyway Task 2: grabs hold of the BO, waits on its reservation lock Task 1: releases its reference of the BO; never gives up the reservation lock The patch "drm/amdgpu: fix a potential deadlock in amdgpu_bo_create_restricted()" attempts to fix that by releasing the reservation lock in amdgpu code; unfortunately, it introduces a use-after-free when this race _doesn't_ happen. This patch should fix the race properly by never adding the BO to the global list in the first place. Cc: Samuel Pitoiset Cc: zhoucm1 Signed-off-by: Nicolai Hähnle --- drivers/gpu/drm/ttm/ttm_bo.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c index 239a957..76bee42 100644 --- a/drivers/gpu/drm/ttm/ttm_bo.c +++ b/drivers/gpu/drm/ttm/ttm_bo.c @@ -1215,18 +1215,20 @@ int ttm_bo_init(struct ttm_bo_device *bdev, if (likely(!ret)) ret = ttm_bo_validate(bo, placement, interruptible, false); - if (!resv) { + if (!resv) ttm_bo_unreserve(bo); - } else if (!(bo->mem.placement & TTM_PL_FLAG_NO_EVICT)) { + if (unlikely(ret)) { + ttm_bo_unref(&bo); + return ret; + } + + if (resv && !(bo->mem.placement & TTM_PL_FLAG_NO_EVICT)) { spin_lock(&bo->glob->lru_lock); ttm_bo_add_to_lru(bo); spin_unlock(&bo->glob->lru_lock); } - if (unlikely(ret)) - ttm_bo_unref(&bo); - return ret; } EXPORT_SYMBOL(ttm_bo_init);