From patchwork Tue Jun 6 20:27:55 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Nirmoy Das X-Patchwork-Id: 13269745 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 99592C7EE45 for ; Tue, 6 Jun 2023 20:28:19 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id BBF7610E3B4; Tue, 6 Jun 2023 20:28:18 +0000 (UTC) Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by gabe.freedesktop.org (Postfix) with ESMTPS id 83A1610E00D; Tue, 6 Jun 2023 20:28:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1686083296; x=1717619296; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=s+K+vxUE+t/ISNlBl0LenW79AMapYZsPQdTU2l40Vzk=; b=nFk+wApo5EnoRdlHmlfUWY2+ZU5uU2G0gdiKIIqJ5Lb10St6kC1HtaWW GzHXZuGzcw6tEocWa/mP97d896LiKlFA3FW+Br/mjjUtaA27EnhNdPBDG lLHo+9k531vTMrXVs0jTud4iS7W6R1b/Eohd42M+CEkSbnalpdIXySyaD LT2wd97S7k95oo2uZC/vqXHZ+yLpbf/jLOP4PUGfNSitOn+4WADQndOli GDziNWzewxrAiVtqf1rTQT/saEzM6rkkHZMgYvulhJIiRjAGYekXHwvld d3blf88oPyX3Keo0CHhzvLjYp4bUYD/M1IaJPNv8pYKQ47pGh3RQLLfNR w==; X-IronPort-AV: E=McAfee;i="6600,9927,10733"; a="356803662" X-IronPort-AV: E=Sophos;i="6.00,221,1681196400"; d="scan'208";a="356803662" Received: from orsmga006.jf.intel.com ([10.7.209.51]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Jun 2023 13:28:04 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10733"; a="686667627" X-IronPort-AV: E=Sophos;i="6.00,221,1681196400"; d="scan'208";a="686667627" Received: from nirmoyda-desk.igk.intel.com ([10.102.138.190]) by orsmga006-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Jun 2023 13:28:01 -0700 From: Nirmoy Das To: intel-gfx@lists.freedesktop.org Subject: [PATCH v2] drm/i915: Fix a VMA UAF for multi-gt platform Date: Tue, 6 Jun 2023 22:27:55 +0200 Message-Id: <20230606202755.8719-1-nirmoy.das@intel.com> X-Mailer: git-send-email 2.39.0 MIME-Version: 1.0 Organization: Intel Deutschland GmbH, Registered Address: Am Campeon 10, 85579 Neubiberg, Germany, Commercial Register: Amtsgericht Muenchen HRB 186928 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Tvrtko Ursulin , Andrzej Hajda , =?utf-8?q?Thomas_Hellstr=C3=B6m?= , dri-devel@lists.freedesktop.org, Chris Wilson , Andi Shyti , Rodrigo Vivi , Sushma Venkatesh Reddy , Nirmoy Das Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Ensure correct handling of closed VMAs on multi-gt platforms to prevent Use-After-Free. Currently, when GT0 goes idle, closed VMAs that are exclusively added to GT0's closed_vma link (gt->closed_vma) and subsequently freed by i915_vma_parked(), which assumes the entire GPU is idle. However, on platforms with multiple GTs, such as MTL, GT1 may remain active while GT0 is idle. This causes GT0 to mistakenly consider the closed VMAs in its closed_vma list as unnecessary, potentially leading to Use-After-Free issues if a job for GT1 attempts to access a freed VMA. Although we do take a wakeref for GT0 but it happens later, after evaluating VMAs. To mitigate this, it is necessary to hold a GT0 wakeref early. v2: Use gt id to detect multi-tile(Andi) Fix the incorrect error path. Cc: Joonas Lahtinen Cc: Rodrigo Vivi Cc: Tvrtko Ursulin Cc: Thomas Hellström Cc: Chris Wilson Cc: Andi Shyti Cc: Andrzej Hajda Cc: Sushma Venkatesh Reddy Tested-by: Andi Shyti Signed-off-by: Nirmoy Das Reviewed-by: Andi Shyti Reviewed-by: Andrzej Hajda --- drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c index 3aeede6aee4d..c2a67435acfa 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c @@ -2683,6 +2683,7 @@ static int eb_select_engine(struct i915_execbuffer *eb) { struct intel_context *ce, *child; + struct intel_gt *gt; unsigned int idx; int err; @@ -2706,10 +2707,16 @@ eb_select_engine(struct i915_execbuffer *eb) } } eb->num_batches = ce->parallel.number_children + 1; + gt = ce->engine->gt; for_each_child(ce, child) intel_context_get(child); intel_gt_pm_get(ce->engine->gt); + /* Keep GT0 active on MTL so that i915_vma_parked() doesn't + * free VMAs while execbuf ioctl is validating VMAs. + */ + if (gt->info.id) + intel_gt_pm_get(to_gt(gt->i915)); if (!test_bit(CONTEXT_ALLOC_BIT, &ce->flags)) { err = intel_context_alloc_state(ce); @@ -2748,6 +2755,9 @@ eb_select_engine(struct i915_execbuffer *eb) return err; err: + if (gt->info.id) + intel_gt_pm_put(to_gt(gt->i915)); + intel_gt_pm_put(ce->engine->gt); for_each_child(ce, child) intel_context_put(child); @@ -2761,6 +2771,8 @@ eb_put_engine(struct i915_execbuffer *eb) struct intel_context *child; i915_vm_put(eb->context->vm); + if (eb->gt->info.id) + intel_gt_pm_put(to_gt(eb->gt->i915)); intel_gt_pm_put(eb->gt); for_each_child(eb->context, child) intel_context_put(child);