| Message ID | 20231108162905.77602-2-janusz.krzysztofik@linux.intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] drm/i915/vma: Fix potential UAF on multi-tile platforms | expand |
On Wednesday, 8 November 2023 22:27:35 CET Patchwork wrote: > == Series Details == > > Series: drm/i915/vma: Fix potential UAF on multi-tile platforms (rev2) > URL : https://patchwork.freedesktop.org/series/126012/ > State : failure > > == Summary == > > CI Bug Log - changes from CI_DRM_13852 -> Patchwork_126012v2 > ==================================================== > > Summary > ------- > > **FAILURE** > > Serious unknown changes coming with Patchwork_126012v2 absolutely need to be > verified manually. > > If you think the reported changes have nothing to do with the changes > introduced in Patchwork_126012v2, please notify your bug team (lgci.bug.filing@intel.com) to allow them > to document this new failure mode, which will reduce false positives in CI. > > External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/index.html > > Participating hosts (34 -> 33) > ------------------------------ > > Additional (1): bat-mtlp-8 > Missing (2): fi-hsw-4770 bat-dg2-9 > > Possible new issues > ------------------- > > Here are the unknown changes that may have been introduced in Patchwork_126012v2: > > ### IGT changes ### > > #### Possible regressions #### > > * igt@i915_suspend@basic-s2idle-without-i915: > - bat-adlp-11: NOTRUN -> [FAIL][1] +1 other test fail > [1]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-11/igt@i915_suspend@basic-s2idle-without-i915.html Stderr looks pretty much like here: https://gitlab.freedesktop.org/drm/intel/issues/9092 > > * igt@i915_suspend@basic-s3-without-i915: > - bat-rplp-1: NOTRUN -> [INCOMPLETE][2] > [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-rplp-1/igt@i915_suspend@basic-s3-without-i915.html Kernel warning looks the same as here: https://gitlab.freedesktop.org/drm/intel/issues/9570 @BUG Filing, please update filters and re-report. Thanks, Janusz > > > Known issues > ------------ > > Here are the changes found in Patchwork_126012v2 that come from known issues: > > ### CI changes ### > > #### Possible fixes #### > > * boot: > - bat-adlp-11: [FAIL][3] ([i915#8293]) -> [PASS][4] > [3]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13852/bat-adlp-11/boot.html > [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-11/boot.html > > > > ### IGT changes ### > > #### Issues hit #### > > * igt@debugfs_test@basic-hwmon: > - bat-mtlp-8: NOTRUN -> [SKIP][5] ([i915#9318]) > [5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-mtlp-8/igt@debugfs_test@basic-hwmon.html > - bat-adlp-11: NOTRUN -> [SKIP][6] ([i915#9318]) > [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-11/igt@debugfs_test@basic-hwmon.html > > * igt@gem_lmem_swapping@basic: > - bat-adln-1: NOTRUN -> [SKIP][7] ([i915#4613]) +3 other tests skip > [7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adln-1/igt@gem_lmem_swapping@basic.html > > * igt@gem_lmem_swapping@parallel-random-engines: > - bat-rplp-1: NOTRUN -> [SKIP][8] ([i915#4613]) +3 other tests skip > [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-rplp-1/igt@gem_lmem_swapping@parallel-random-engines.html > > * igt@gem_lmem_swapping@random-engines: > - bat-adlp-6: NOTRUN -> [SKIP][9] ([i915#4613]) +3 other tests skip > [9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-6/igt@gem_lmem_swapping@random-engines.html > > * igt@gem_lmem_swapping@verify-random: > - bat-adlp-11: NOTRUN -> [SKIP][10] ([i915#4613]) +3 other tests skip > [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-11/igt@gem_lmem_swapping@verify-random.html > - bat-mtlp-8: NOTRUN -> [SKIP][11] ([i915#4613]) +3 other tests skip > [11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-mtlp-8/igt@gem_lmem_swapping@verify-random.html > > * igt@gem_mmap@basic: > - bat-mtlp-8: NOTRUN -> [SKIP][12] ([i915#4083]) > [12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-mtlp-8/igt@gem_mmap@basic.html > > * igt@gem_mmap_gtt@basic: > - bat-mtlp-8: NOTRUN -> [SKIP][13] ([i915#4077]) +3 other tests skip > [13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-mtlp-8/igt@gem_mmap_gtt@basic.html > > * igt@gem_render_tiled_blits@basic: > - bat-mtlp-8: NOTRUN -> [SKIP][14] ([i915#4079]) +1 other test skip > [14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-mtlp-8/igt@gem_render_tiled_blits@basic.html > > * igt@gem_tiled_pread_basic: > - bat-adlp-11: NOTRUN -> [SKIP][15] ([i915#3282]) > [15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-11/igt@gem_tiled_pread_basic.html > > * igt@i915_pm_rps@basic-api: > - bat-adlp-6: NOTRUN -> [SKIP][16] ([i915#6621]) > [16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-6/igt@i915_pm_rps@basic-api.html > - bat-rplp-1: NOTRUN -> [SKIP][17] ([i915#6621]) > [17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-rplp-1/igt@i915_pm_rps@basic-api.html > - bat-adlp-11: NOTRUN -> [SKIP][18] ([i915#6621]) > [18]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-11/igt@i915_pm_rps@basic-api.html > - bat-adln-1: NOTRUN -> [SKIP][19] ([i915#6621]) > [19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adln-1/igt@i915_pm_rps@basic-api.html > - bat-mtlp-8: NOTRUN -> [SKIP][20] ([i915#6621]) > [20]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-mtlp-8/igt@i915_pm_rps@basic-api.html > > * igt@i915_selftest@live@gt_pm: > - bat-adln-1: NOTRUN -> [DMESG-FAIL][21] ([i915#9507]) > [21]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adln-1/igt@i915_selftest@live@gt_pm.html > > * igt@i915_selftest@live@workarounds: > - bat-dg2-11: [PASS][22] -> [DMESG-FAIL][23] ([i915#9500]) > [22]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13852/bat-dg2-11/igt@i915_selftest@live@workarounds.html > [23]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-dg2-11/igt@i915_selftest@live@workarounds.html > > * igt@i915_suspend@basic-s3-without-i915: > - bat-mtlp-8: NOTRUN -> [SKIP][24] ([i915#6645]) > [24]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-mtlp-8/igt@i915_suspend@basic-s3-without-i915.html > > * igt@kms_addfb_basic@addfb25-y-tiled-small-legacy: > - bat-mtlp-8: NOTRUN -> [SKIP][25] ([i915#5190]) > [25]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-mtlp-8/igt@kms_addfb_basic@addfb25-y-tiled-small-legacy.html > > * igt@kms_addfb_basic@basic-y-tiled-legacy: > - bat-mtlp-8: NOTRUN -> [SKIP][26] ([i915#4212]) +8 other tests skip > [26]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-mtlp-8/igt@kms_addfb_basic@basic-y-tiled-legacy.html > > * igt@kms_cursor_legacy@basic-busy-flip-before-cursor-legacy: > - bat-adlp-11: NOTRUN -> [SKIP][27] ([i915#4103] / [i915#5608]) +1 other test skip > [27]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-11/igt@kms_cursor_legacy@basic-busy-flip-before-cursor-legacy.html > - bat-mtlp-8: NOTRUN -> [SKIP][28] ([i915#4213]) +1 other test skip > [28]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-mtlp-8/igt@kms_cursor_legacy@basic-busy-flip-before-cursor-legacy.html > > * igt@kms_dsc@dsc-basic: > - bat-adlp-11: NOTRUN -> [SKIP][29] ([i915#3555] / [i915#3840]) > [29]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-11/igt@kms_dsc@dsc-basic.html > - bat-mtlp-8: NOTRUN -> [SKIP][30] ([i915#3555] / [i915#3840] / [i915#9159]) > [30]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-mtlp-8/igt@kms_dsc@dsc-basic.html > > * igt@kms_flip@basic-flip-vs-wf_vblank@d-dp5: > - bat-adlp-11: NOTRUN -> [DMESG-WARN][31] ([i915#6868]) > [31]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-11/igt@kms_flip@basic-flip-vs-wf_vblank@d-dp5.html > > * igt@kms_flip@basic-plain-flip: > - bat-adlp-11: NOTRUN -> [SKIP][32] ([i915#3637]) > [32]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-11/igt@kms_flip@basic-plain-flip.html > > * igt@kms_force_connector_basic@force-load-detect: > - bat-mtlp-8: NOTRUN -> [SKIP][33] ([fdo#109285]) > [33]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-mtlp-8/igt@kms_force_connector_basic@force-load-detect.html > > * igt@kms_force_connector_basic@prune-stale-modes: > - bat-adlp-11: NOTRUN -> [SKIP][34] ([i915#4093]) +2 other tests skip > [34]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-11/igt@kms_force_connector_basic@prune-stale-modes.html > - bat-mtlp-8: NOTRUN -> [SKIP][35] ([i915#5274]) > [35]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-mtlp-8/igt@kms_force_connector_basic@prune-stale-modes.html > > * igt@kms_hdmi_inject@inject-audio: > - bat-adlp-11: NOTRUN -> [SKIP][36] ([i915#4369]) > [36]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-11/igt@kms_hdmi_inject@inject-audio.html > - fi-kbl-guc: [PASS][37] -> [FAIL][38] ([IGT#3]) > [37]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13852/fi-kbl-guc/igt@kms_hdmi_inject@inject-audio.html > [38]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/fi-kbl-guc/igt@kms_hdmi_inject@inject-audio.html > > * igt@kms_pipe_crc_basic@nonblocking-crc-frame-sequence: > - bat-dg2-11: NOTRUN -> [SKIP][39] ([i915#1845] / [i915#9197]) +3 other tests skip > [39]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-dg2-11/igt@kms_pipe_crc_basic@nonblocking-crc-frame-sequence.html > > * igt@kms_psr@primary_page_flip: > - bat-rplp-1: NOTRUN -> [SKIP][40] ([i915#1072]) +3 other tests skip > [40]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-rplp-1/igt@kms_psr@primary_page_flip.html > - bat-adlp-11: NOTRUN -> [SKIP][41] ([i915#1072]) +3 other tests skip > [41]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-11/igt@kms_psr@primary_page_flip.html > > * igt@kms_setmode@basic-clone-single-crtc: > - bat-adlp-6: NOTRUN -> [SKIP][42] ([i915#3555]) > [42]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-6/igt@kms_setmode@basic-clone-single-crtc.html > - bat-rplp-1: NOTRUN -> [SKIP][43] ([i915#3555]) > [43]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-rplp-1/igt@kms_setmode@basic-clone-single-crtc.html > - bat-adlp-11: NOTRUN -> [SKIP][44] ([i915#3555]) > [44]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-11/igt@kms_setmode@basic-clone-single-crtc.html > - bat-adln-1: NOTRUN -> [SKIP][45] ([i915#3555]) > [45]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adln-1/igt@kms_setmode@basic-clone-single-crtc.html > - bat-mtlp-8: NOTRUN -> [SKIP][46] ([i915#3555] / [i915#8809]) > [46]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-mtlp-8/igt@kms_setmode@basic-clone-single-crtc.html > > * igt@prime_vgem@basic-fence-mmap: > - bat-mtlp-8: NOTRUN -> [SKIP][47] ([i915#3708] / [i915#4077]) +1 other test skip > [47]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-mtlp-8/igt@prime_vgem@basic-fence-mmap.html > > * igt@prime_vgem@basic-fence-read: > - bat-adlp-11: NOTRUN -> [SKIP][48] ([fdo#109295] / [i915#3291] / [i915#3708]) +2 other tests skip > [48]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-11/igt@prime_vgem@basic-fence-read.html > - bat-mtlp-8: NOTRUN -> [SKIP][49] ([i915#3708]) +2 other tests skip > [49]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-mtlp-8/igt@prime_vgem@basic-fence-read.html > - bat-adlp-6: NOTRUN -> [SKIP][50] ([fdo#109295] / [i915#3291] / [i915#3708]) +2 other tests skip > [50]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-6/igt@prime_vgem@basic-fence-read.html > > * igt@prime_vgem@basic-read: > - bat-rplp-1: NOTRUN -> [SKIP][51] ([i915#3708]) +2 other tests skip > [51]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-rplp-1/igt@prime_vgem@basic-read.html > > * igt@prime_vgem@basic-write: > - bat-adln-1: NOTRUN -> [SKIP][52] ([fdo#109295] / [i915#3291]) +2 other tests skip > [52]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adln-1/igt@prime_vgem@basic-write.html > > > #### Possible fixes #### > > * {igt@kms_pm_backlight@basic-brightness@edp-1}: > - bat-adlp-6: [ABORT][53] ([i915#8668]) -> [PASS][54] > [53]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13852/bat-adlp-6/igt@kms_pm_backlight@basic-brightness@edp-1.html > [54]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adlp-6/igt@kms_pm_backlight@basic-brightness@edp-1.html > - bat-rplp-1: [ABORT][55] ([i915#8668]) -> [PASS][56] > [55]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13852/bat-rplp-1/igt@kms_pm_backlight@basic-brightness@edp-1.html > [56]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-rplp-1/igt@kms_pm_backlight@basic-brightness@edp-1.html > > * {igt@kms_pm_rpm@basic-pci-d3-state}: > - bat-adln-1: [ABORT][57] ([i915#8668]) -> [PASS][58] > [57]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13852/bat-adln-1/igt@kms_pm_rpm@basic-pci-d3-state.html > [58]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/bat-adln-1/igt@kms_pm_rpm@basic-pci-d3-state.html > > > {name}: This element is suppressed. This means it is ignored when computing > the status of the difference (SUCCESS, WARNING, or FAILURE). > > [IGT#3]: https://gitlab.freedesktop.org/drm/igt-gpu-tools/issues/3 > [fdo#109285]: https://bugs.freedesktop.org/show_bug.cgi?id=109285 > [fdo#109295]: https://bugs.freedesktop.org/show_bug.cgi?id=109295 > [i915#1072]: https://gitlab.freedesktop.org/drm/intel/issues/1072 > [i915#1845]: https://gitlab.freedesktop.org/drm/intel/issues/1845 > [i915#3282]: https://gitlab.freedesktop.org/drm/intel/issues/3282 > [i915#3291]: https://gitlab.freedesktop.org/drm/intel/issues/3291 > [i915#3546]: https://gitlab.freedesktop.org/drm/intel/issues/3546 > [i915#3555]: https://gitlab.freedesktop.org/drm/intel/issues/3555 > [i915#3637]: https://gitlab.freedesktop.org/drm/intel/issues/3637 > [i915#3708]: https://gitlab.freedesktop.org/drm/intel/issues/3708 > [i915#3840]: https://gitlab.freedesktop.org/drm/intel/issues/3840 > [i915#4077]: https://gitlab.freedesktop.org/drm/intel/issues/4077 > [i915#4079]: https://gitlab.freedesktop.org/drm/intel/issues/4079 > [i915#4083]: https://gitlab.freedesktop.org/drm/intel/issues/4083 > [i915#4093]: https://gitlab.freedesktop.org/drm/intel/issues/4093 > [i915#4103]: https://gitlab.freedesktop.org/drm/intel/issues/4103 > [i915#4212]: https://gitlab.freedesktop.org/drm/intel/issues/4212 > [i915#4213]: https://gitlab.freedesktop.org/drm/intel/issues/4213 > [i915#4369]: https://gitlab.freedesktop.org/drm/intel/issues/4369 > [i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613 > [i915#5190]: https://gitlab.freedesktop.org/drm/intel/issues/5190 > [i915#5274]: https://gitlab.freedesktop.org/drm/intel/issues/5274 > [i915#5608]: https://gitlab.freedesktop.org/drm/intel/issues/5608 > [i915#6621]: https://gitlab.freedesktop.org/drm/intel/issues/6621 > [i915#6645]: https://gitlab.freedesktop.org/drm/intel/issues/6645 > [i915#6868]: https://gitlab.freedesktop.org/drm/intel/issues/6868 > [i915#8293]: https://gitlab.freedesktop.org/drm/intel/issues/8293 > [i915#8668]: https://gitlab.freedesktop.org/drm/intel/issues/8668 > [i915#8809]: https://gitlab.freedesktop.org/drm/intel/issues/8809 > [i915#9159]: https://gitlab.freedesktop.org/drm/intel/issues/9159 > [i915#9197]: https://gitlab.freedesktop.org/drm/intel/issues/9197 > [i915#9318]: https://gitlab.freedesktop.org/drm/intel/issues/9318 > [i915#9500]: https://gitlab.freedesktop.org/drm/intel/issues/9500 > [i915#9507]: https://gitlab.freedesktop.org/drm/intel/issues/9507 > > > Build changes > ------------- > > * Linux: CI_DRM_13852 -> Patchwork_126012v2 > > CI-20190529: 20190529 > CI_DRM_13852: 8040e9d346531d98ca164092c860c24c1dd6e845 @ git://anongit.freedesktop.org/gfx-ci/linux > IGT_7577: 303daa66145647680d8e817ff305f7f5d83843ee @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git > Patchwork_126012v2: 8040e9d346531d98ca164092c860c24c1dd6e845 @ git://anongit.freedesktop.org/gfx-ci/linux > > > ### Linux commits > > 60f2dbf57539 drm/i915/vma: Fix potential UAF on multi-tile platforms > > == Logs == > > For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v2/index.html >
Hi Janusz, On Wed, Nov 08, 2023 at 05:29:06PM +0100, Janusz Krzysztofik wrote: > Object debugging tools were sporadically reporting illegal attempts to > free a still active i915 VMA object from when parking a GPU tile believed > to be idle. > > [161.359441] ODEBUG: free active (active state 0) object: ffff88811643b958 object type: i915_active hint: __i915_vma_active+0x0/0x50 [i915] > [161.360082] WARNING: CPU: 5 PID: 276 at lib/debugobjects.c:514 debug_print_object+0x80/0xb0 > ... > [161.360304] CPU: 5 PID: 276 Comm: kworker/5:2 Not tainted 6.5.0-rc1-CI_DRM_13375-g003f860e5577+ #1 > [161.360314] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022 > [161.360322] Workqueue: i915-unordered __intel_wakeref_put_work [i915] > [161.360592] RIP: 0010:debug_print_object+0x80/0xb0 > ... > [161.361347] debug_object_free+0xeb/0x110 > [161.361362] i915_active_fini+0x14/0x130 [i915] > [161.361866] release_references+0xfe/0x1f0 [i915] > [161.362543] i915_vma_parked+0x1db/0x380 [i915] > [161.363129] __gt_park+0x121/0x230 [i915] > [161.363515] ____intel_wakeref_put_last+0x1f/0x70 [i915] > > That has been tracked down to be happening when another thread was > deactivating the VMA inside __active_retire() helper, after the VMA's > active counter was already decremented to 0, but before deactivation of > the VMA's object was reported to the object debugging tools. Root cause > has been identified as premature release of last wakeref for the GPU tile > to which the active VMA belonged. > > In case of single-tile platforms, an engine associated with a request that > uses the VMA is usually keeping the tile's wakeref long enough for that > VMA to be deactivated on time, before it is going to be freed on last put > of that wakeref. However, on multi-tile platforms, a request may use a > VMA from a tile other than the one that hosts the request's engine, then, > not protected with the engine's wakeref. > > Get an extra wakeref for the VMA's tile when activating it, and put that > wakeref only after the VMA is deactivated. However, exclude GGTT from > that processing path, otherwise the GPU never goes idle. Since > __i915_vma_retire() may be called from atomic contexts, use async variant > of wakeref put. > > CI reports indicate that single-tile platforms also suffer sporadically > from the same race, however, unlike in case of multi-tile, exact scenario > when that happens hasn't been discovered yet. Then, while I submit this > patch as fix for multi-tile cases, and in hope it also addresses single- > tile, I'm not able to blame any particular commit for that issue. > However, I'm going to ask i915 maintainers to include this fix, if > accepted, in the current rc cycle (6.7-rc) as important for the first > supported multi-tile platform -- Meteor Lake. > > v2: Get the wakeref before vm mutex to avoid circular locking dependency, > - drop questionable Fixes: tag. > > Closes: https://gitlab.freedesktop.org/drm/intel/issues/8875 > Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> Can it be: Fixes: 12c255b5dad1 ("drm/i915: Provide an i915_active.acquire callback") Cc: Chris Wilson <chris@chris-wilson.co.uk> Cc: <stable@vger.kernel.org> # v5.4+ It's not exactly the one fix we need for as this patch is fixing something on its own but not explicitely stated (maybe it was a precautionary measure). But if the fix has to be applied, it has to date back to that period, I guess. Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com> Andi
On Thursday, 9 November 2023 22:44:02 CET Patchwork wrote: > == Series Details == > > Series: drm/i915/vma: Fix potential UAF on multi-tile platforms (rev3) > URL : https://patchwork.freedesktop.org/series/126012/ > State : failure > > == Summary == > > CI Bug Log - changes from CI_DRM_13856 -> Patchwork_126012v3 > ==================================================== > > Summary > ------- > > **FAILURE** > > Serious unknown changes coming with Patchwork_126012v3 absolutely need to be > verified manually. > > If you think the reported changes have nothing to do with the changes > introduced in Patchwork_126012v3, please notify your bug team (lgci.bug.filing@intel.com) to allow them > to document this new failure mode, which will reduce false positives in CI. > > External URL: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/index.html > > Participating hosts (34 -> 34) > ------------------------------ > > Additional (1): fi-kbl-soraka > Missing (1): bat-dg2-8 > > Possible new issues > ------------------- > > Here are the unknown changes that may have been introduced in Patchwork_126012v3: > > ### IGT changes ### > > #### Possible regressions #### > > * igt@i915_suspend@basic-s2idle-without-i915: > - bat-adlp-11: NOTRUN -> [FAIL][1] > [1]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-11/igt@i915_suspend@basic-s2idle-without-i915.html Andi, Since that issue popped up again after your re-run, I've had a closer look. The test igt@i915_suspend@basic-s2idle-without-i915 seems to be never executed on BAT ADL machines (e.g., adlp-11, adln-1) because of an abort triggered on those machines by igt@kms_pm_rpm@basic-pci-d3-state. The latter can be found below among possible fixes -- it succeeded, and that explains why igt@i915_suspend@basic-s2idle-without-i915 was executed this time, and also for my original submission (rev2). I suspect there must be an issue with adlp-11 machine that results in failures from igt@i915_suspend@basic-s2idle-without-i915. Unfortunately, that issue is not visible for now because that test is never executed on that machine. @BUG Filing, I'm no sure how re-reporting works, but once you have filters updated after my request submitted earlier today for rev2 of this patch, please also re-report results of rev3 (re-run of rev2). Thanks, Janusz > > > Known issues > ------------ > > Here are the changes found in Patchwork_126012v3 that come from known issues: > > ### IGT changes ### > > #### Issues hit #### > > * igt@gem_huc_copy@huc-copy: > - fi-kbl-soraka: NOTRUN -> [SKIP][2] ([fdo#109271] / [i915#2190]) > [2]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/fi-kbl-soraka/igt@gem_huc_copy@huc-copy.html > > * igt@gem_lmem_swapping@basic: > - fi-kbl-soraka: NOTRUN -> [SKIP][3] ([fdo#109271] / [i915#4613]) +3 other tests skip > [3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/fi-kbl-soraka/igt@gem_lmem_swapping@basic.html > - bat-adln-1: NOTRUN -> [SKIP][4] ([i915#4613]) +3 other tests skip > [4]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adln-1/igt@gem_lmem_swapping@basic.html > > * igt@gem_lmem_swapping@parallel-random-engines: > - bat-rplp-1: NOTRUN -> [SKIP][5] ([i915#4613]) +3 other tests skip > [5]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-rplp-1/igt@gem_lmem_swapping@parallel-random-engines.html > > * igt@gem_lmem_swapping@random-engines: > - bat-adlp-6: NOTRUN -> [SKIP][6] ([i915#4613]) +3 other tests skip > [6]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-6/igt@gem_lmem_swapping@random-engines.html > > * igt@gem_lmem_swapping@verify-random: > - bat-adlp-11: NOTRUN -> [SKIP][7] ([i915#4613]) +3 other tests skip > [7]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-11/igt@gem_lmem_swapping@verify-random.html > > * igt@i915_pm_rps@basic-api: > - bat-adlp-6: NOTRUN -> [SKIP][8] ([i915#6621]) > [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-6/igt@i915_pm_rps@basic-api.html > - bat-rplp-1: NOTRUN -> [SKIP][9] ([i915#6621]) > [9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-rplp-1/igt@i915_pm_rps@basic-api.html > - bat-adlp-11: NOTRUN -> [SKIP][10] ([i915#6621]) > [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-11/igt@i915_pm_rps@basic-api.html > - bat-adln-1: NOTRUN -> [SKIP][11] ([i915#6621]) > [11]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adln-1/igt@i915_pm_rps@basic-api.html > > * igt@i915_selftest@live@gt_pm: > - fi-kbl-soraka: NOTRUN -> [DMESG-FAIL][12] ([i915#1886]) > [12]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/fi-kbl-soraka/igt@i915_selftest@live@gt_pm.html > > * igt@kms_dsc@dsc-basic: > - fi-kbl-soraka: NOTRUN -> [SKIP][13] ([fdo#109271]) +9 other tests skip > [13]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/fi-kbl-soraka/igt@kms_dsc@dsc-basic.html > > * igt@kms_psr@primary_page_flip: > - bat-rplp-1: NOTRUN -> [SKIP][14] ([i915#1072]) +3 other tests skip > [14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-rplp-1/igt@kms_psr@primary_page_flip.html > - bat-adlp-11: NOTRUN -> [SKIP][15] ([i915#1072]) +3 other tests skip > [15]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-11/igt@kms_psr@primary_page_flip.html > > * igt@kms_setmode@basic-clone-single-crtc: > - bat-adlp-6: NOTRUN -> [SKIP][16] ([i915#3555]) > [16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-6/igt@kms_setmode@basic-clone-single-crtc.html > - bat-rplp-1: NOTRUN -> [SKIP][17] ([i915#3555]) > [17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-rplp-1/igt@kms_setmode@basic-clone-single-crtc.html > - bat-adlp-11: NOTRUN -> [SKIP][18] ([i915#3555]) > [18]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-11/igt@kms_setmode@basic-clone-single-crtc.html > - bat-adln-1: NOTRUN -> [SKIP][19] ([i915#3555]) > [19]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adln-1/igt@kms_setmode@basic-clone-single-crtc.html > > * igt@prime_vgem@basic-fence-read: > - bat-adlp-11: NOTRUN -> [SKIP][20] ([fdo#109295] / [i915#3291] / [i915#3708]) +2 other tests skip > [20]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-11/igt@prime_vgem@basic-fence-read.html > - bat-adlp-6: NOTRUN -> [SKIP][21] ([fdo#109295] / [i915#3291] / [i915#3708]) +2 other tests skip > [21]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-6/igt@prime_vgem@basic-fence-read.html > > * igt@prime_vgem@basic-read: > - bat-rplp-1: NOTRUN -> [SKIP][22] ([i915#3708]) +2 other tests skip > [22]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-rplp-1/igt@prime_vgem@basic-read.html > > * igt@prime_vgem@basic-write: > - bat-adln-1: NOTRUN -> [SKIP][23] ([fdo#109295] / [i915#3291]) +2 other tests skip > [23]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adln-1/igt@prime_vgem@basic-write.html > > > #### Possible fixes #### > > * igt@gem_exec_suspend@basic-s0@lmem0: > - bat-dg2-9: [INCOMPLETE][24] ([i915#9275]) -> [PASS][25] > [24]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13856/bat-dg2-9/igt@gem_exec_suspend@basic-s0@lmem0.html > [25]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-dg2-9/igt@gem_exec_suspend@basic-s0@lmem0.html > > * igt@i915_module_load@reload: > - fi-skl-6600u: [DMESG-WARN][26] ([i915#1982]) -> [PASS][27] > [26]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13856/fi-skl-6600u/igt@i915_module_load@reload.html > [27]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/fi-skl-6600u/igt@i915_module_load@reload.html > > * igt@i915_selftest@live@gt_heartbeat: > - fi-apl-guc: [DMESG-FAIL][28] ([i915#5334]) -> [PASS][29] > [28]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13856/fi-apl-guc/igt@i915_selftest@live@gt_heartbeat.html > [29]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/fi-apl-guc/igt@i915_selftest@live@gt_heartbeat.html > > * igt@kms_frontbuffer_tracking@basic: > - fi-bsw-nick: [FAIL][30] ([i915#9276]) -> [PASS][31] > [30]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13856/fi-bsw-nick/igt@kms_frontbuffer_tracking@basic.html > [31]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/fi-bsw-nick/igt@kms_frontbuffer_tracking@basic.html > > * igt@kms_pipe_crc_basic@read-crc-frame-sequence@pipe-d-edp-1: > - bat-rplp-1: [ABORT][32] ([i915#8668]) -> [PASS][33] > [32]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13856/bat-rplp-1/igt@kms_pipe_crc_basic@read-crc-frame-sequence@pipe-d-edp-1.html > [33]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-rplp-1/igt@kms_pipe_crc_basic@read-crc-frame-sequence@pipe-d-edp-1.html > > * {igt@kms_pm_backlight@basic-brightness@edp-1}: > - bat-adlp-6: [ABORT][34] ([i915#8668]) -> [PASS][35] > [34]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13856/bat-adlp-6/igt@kms_pm_backlight@basic-brightness@edp-1.html > [35]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-6/igt@kms_pm_backlight@basic-brightness@edp-1.html > > * {igt@kms_pm_rpm@basic-pci-d3-state}: > - bat-adln-1: [ABORT][36] ([i915#8668]) -> [PASS][37] > [36]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13856/bat-adln-1/igt@kms_pm_rpm@basic-pci-d3-state.html > [37]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adln-1/igt@kms_pm_rpm@basic-pci-d3-state.html > - bat-adlp-11: [ABORT][38] ([i915#8668]) -> [PASS][39] > [38]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13856/bat-adlp-11/igt@kms_pm_rpm@basic-pci-d3-state.html > [39]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-11/igt@kms_pm_rpm@basic-pci-d3-state.html > > > {name}: This element is suppressed. This means it is ignored when computing > the status of the difference (SUCCESS, WARNING, or FAILURE). > > [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 > [fdo#109295]: https://bugs.freedesktop.org/show_bug.cgi?id=109295 > [i915#1072]: https://gitlab.freedesktop.org/drm/intel/issues/1072 > [i915#1886]: https://gitlab.freedesktop.org/drm/intel/issues/1886 > [i915#1982]: https://gitlab.freedesktop.org/drm/intel/issues/1982 > [i915#2190]: https://gitlab.freedesktop.org/drm/intel/issues/2190 > [i915#3291]: https://gitlab.freedesktop.org/drm/intel/issues/3291 > [i915#3555]: https://gitlab.freedesktop.org/drm/intel/issues/3555 > [i915#3708]: https://gitlab.freedesktop.org/drm/intel/issues/3708 > [i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613 > [i915#5334]: https://gitlab.freedesktop.org/drm/intel/issues/5334 > [i915#6621]: https://gitlab.freedesktop.org/drm/intel/issues/6621 > [i915#8668]: https://gitlab.freedesktop.org/drm/intel/issues/8668 > [i915#9275]: https://gitlab.freedesktop.org/drm/intel/issues/9275 > [i915#9276]: https://gitlab.freedesktop.org/drm/intel/issues/9276 > > > Build changes > ------------- > > * Linux: CI_DRM_13856 -> Patchwork_126012v3 > > CI-20190529: 20190529 > CI_DRM_13856: b81818fa6745cf79a86da57dc3a379bd80c7ea5f @ git://anongit.freedesktop.org/gfx-ci/linux > IGT_7580: 847ee1e7d365e2fb08bf4198d3bf5ee8a852649f @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git > Patchwork_126012v3: b81818fa6745cf79a86da57dc3a379bd80c7ea5f @ git://anongit.freedesktop.org/gfx-ci/linux > > > ### Linux commits > > bc174a299b6b drm/i915/vma: Fix potential UAF on multi-tile platforms > > == Logs == > > For more details see: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/index.html >
Hi, https://patchwork.freedesktop.org/series/126012/ - Re-reported Thanks, Tejasree -----Original Message----- From: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> Sent: Friday, November 10, 2023 4:27 AM To: Andi Shyti <andi.shyti@linux.intel.com> Cc: intel-gfx@lists.freedesktop.org; LGCI Bug Filing <lgci.bug.filing@intel.com> Subject: Re: ✗ Fi.CI.BAT: failure for drm/i915/vma: Fix potential UAF on multi-tile platforms (rev3) On Thursday, 9 November 2023 22:44:02 CET Patchwork wrote: > == Series Details == > > Series: drm/i915/vma: Fix potential UAF on multi-tile platforms (rev3) > URL : https://patchwork.freedesktop.org/series/126012/ > State : failure > > == Summary == > > CI Bug Log - changes from CI_DRM_13856 -> Patchwork_126012v3 > ==================================================== > > Summary > ------- > > **FAILURE** > > Serious unknown changes coming with Patchwork_126012v3 absolutely need to be > verified manually. > > If you think the reported changes have nothing to do with the changes > introduced in Patchwork_126012v3, please notify your bug team (lgci.bug.filing@intel.com) to allow them > to document this new failure mode, which will reduce false positives in CI. > > External URL: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/index.html > > Participating hosts (34 -> 34) > ------------------------------ > > Additional (1): fi-kbl-soraka > Missing (1): bat-dg2-8 > > Possible new issues > ------------------- > > Here are the unknown changes that may have been introduced in Patchwork_126012v3: > > ### IGT changes ### > > #### Possible regressions #### > > * igt@i915_suspend@basic-s2idle-without-i915: > - bat-adlp-11: NOTRUN -> [FAIL][1] > [1]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-1 > 1/igt@i915_suspend@basic-s2idle-without-i915.html Andi, Since that issue popped up again after your re-run, I've had a closer look. The test igt@i915_suspend@basic-s2idle-without-i915 seems to be never executed on BAT ADL machines (e.g., adlp-11, adln-1) because of an abort triggered on those machines by igt@kms_pm_rpm@basic-pci-d3-state. The latter can be found below among possible fixes -- it succeeded, and that explains why igt@i915_suspend@basic-s2idle-without-i915 was executed this time, and also for my original submission (rev2). I suspect there must be an issue with adlp-11 machine that results in failures from igt@i915_suspend@basic-s2idle-without-i915. Unfortunately, that issue is not visible for now because that test is never executed on that machine. @BUG Filing, I'm no sure how re-reporting works, but once you have filters updated after my request submitted earlier today for rev2 of this patch, please also re-report results of rev3 (re-run of rev2). Thanks, Janusz > > > Known issues > ------------ > > Here are the changes found in Patchwork_126012v3 that come from known issues: > > ### IGT changes ### > > #### Issues hit #### > > * igt@gem_huc_copy@huc-copy: > - fi-kbl-soraka: NOTRUN -> [SKIP][2] ([fdo#109271] / [i915#2190]) > [2]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/fi-kbl-sor > aka/igt@gem_huc_copy@huc-copy.html > > * igt@gem_lmem_swapping@basic: > - fi-kbl-soraka: NOTRUN -> [SKIP][3] ([fdo#109271] / [i915#4613]) +3 other tests skip > [3]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/fi-kbl-soraka/igt@gem_lmem_swapping@basic.html > - bat-adln-1: NOTRUN -> [SKIP][4] ([i915#4613]) +3 other tests skip > [4]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adln-1 > /igt@gem_lmem_swapping@basic.html > > * igt@gem_lmem_swapping@parallel-random-engines: > - bat-rplp-1: NOTRUN -> [SKIP][5] ([i915#4613]) +3 other tests skip > [5]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-rplp-1 > /igt@gem_lmem_swapping@parallel-random-engines.html > > * igt@gem_lmem_swapping@random-engines: > - bat-adlp-6: NOTRUN -> [SKIP][6] ([i915#4613]) +3 other tests skip > [6]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-6 > /igt@gem_lmem_swapping@random-engines.html > > * igt@gem_lmem_swapping@verify-random: > - bat-adlp-11: NOTRUN -> [SKIP][7] ([i915#4613]) +3 other tests skip > [7]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-1 > 1/igt@gem_lmem_swapping@verify-random.html > > * igt@i915_pm_rps@basic-api: > - bat-adlp-6: NOTRUN -> [SKIP][8] ([i915#6621]) > [8]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-6/igt@i915_pm_rps@basic-api.html > - bat-rplp-1: NOTRUN -> [SKIP][9] ([i915#6621]) > [9]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-rplp-1/igt@i915_pm_rps@basic-api.html > - bat-adlp-11: NOTRUN -> [SKIP][10] ([i915#6621]) > [10]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-11/igt@i915_pm_rps@basic-api.html > - bat-adln-1: NOTRUN -> [SKIP][11] ([i915#6621]) > [11]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adln-1 > /igt@i915_pm_rps@basic-api.html > > * igt@i915_selftest@live@gt_pm: > - fi-kbl-soraka: NOTRUN -> [DMESG-FAIL][12] ([i915#1886]) > [12]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/fi-kbl-sor > aka/igt@i915_selftest@live@gt_pm.html > > * igt@kms_dsc@dsc-basic: > - fi-kbl-soraka: NOTRUN -> [SKIP][13] ([fdo#109271]) +9 other tests skip > [13]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/fi-kbl-sor > aka/igt@kms_dsc@dsc-basic.html > > * igt@kms_psr@primary_page_flip: > - bat-rplp-1: NOTRUN -> [SKIP][14] ([i915#1072]) +3 other tests skip > [14]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-rplp-1/igt@kms_psr@primary_page_flip.html > - bat-adlp-11: NOTRUN -> [SKIP][15] ([i915#1072]) +3 other tests skip > [15]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-1 > 1/igt@kms_psr@primary_page_flip.html > > * igt@kms_setmode@basic-clone-single-crtc: > - bat-adlp-6: NOTRUN -> [SKIP][16] ([i915#3555]) > [16]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-6/igt@kms_setmode@basic-clone-single-crtc.html > - bat-rplp-1: NOTRUN -> [SKIP][17] ([i915#3555]) > [17]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-rplp-1/igt@kms_setmode@basic-clone-single-crtc.html > - bat-adlp-11: NOTRUN -> [SKIP][18] ([i915#3555]) > [18]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-11/igt@kms_setmode@basic-clone-single-crtc.html > - bat-adln-1: NOTRUN -> [SKIP][19] ([i915#3555]) > [19]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adln-1 > /igt@kms_setmode@basic-clone-single-crtc.html > > * igt@prime_vgem@basic-fence-read: > - bat-adlp-11: NOTRUN -> [SKIP][20] ([fdo#109295] / [i915#3291] / [i915#3708]) +2 other tests skip > [20]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-11/igt@prime_vgem@basic-fence-read.html > - bat-adlp-6: NOTRUN -> [SKIP][21] ([fdo#109295] / [i915#3291] / [i915#3708]) +2 other tests skip > [21]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-6 > /igt@prime_vgem@basic-fence-read.html > > * igt@prime_vgem@basic-read: > - bat-rplp-1: NOTRUN -> [SKIP][22] ([i915#3708]) +2 other tests skip > [22]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-rplp-1 > /igt@prime_vgem@basic-read.html > > * igt@prime_vgem@basic-write: > - bat-adln-1: NOTRUN -> [SKIP][23] ([fdo#109295] / [i915#3291]) +2 other tests skip > [23]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adln-1 > /igt@prime_vgem@basic-write.html > > > #### Possible fixes #### > > * igt@gem_exec_suspend@basic-s0@lmem0: > - bat-dg2-9: [INCOMPLETE][24] ([i915#9275]) -> [PASS][25] > [24]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13856/bat-dg2-9/igt@gem_exec_suspend@basic-s0@lmem0.html > [25]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-dg2-9/ > igt@gem_exec_suspend@basic-s0@lmem0.html > > * igt@i915_module_load@reload: > - fi-skl-6600u: [DMESG-WARN][26] ([i915#1982]) -> [PASS][27] > [26]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13856/fi-skl-6600u/igt@i915_module_load@reload.html > [27]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/fi-skl-660 > 0u/igt@i915_module_load@reload.html > > * igt@i915_selftest@live@gt_heartbeat: > - fi-apl-guc: [DMESG-FAIL][28] ([i915#5334]) -> [PASS][29] > [28]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13856/fi-apl-guc/igt@i915_selftest@live@gt_heartbeat.html > [29]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/fi-apl-guc > /igt@i915_selftest@live@gt_heartbeat.html > > * igt@kms_frontbuffer_tracking@basic: > - fi-bsw-nick: [FAIL][30] ([i915#9276]) -> [PASS][31] > [30]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13856/fi-bsw-nick/igt@kms_frontbuffer_tracking@basic.html > [31]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/fi-bsw-nic > k/igt@kms_frontbuffer_tracking@basic.html > > * igt@kms_pipe_crc_basic@read-crc-frame-sequence@pipe-d-edp-1: > - bat-rplp-1: [ABORT][32] ([i915#8668]) -> [PASS][33] > [32]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13856/bat-rplp-1/igt@kms_pipe_crc_basic@read-crc-frame-sequence@pipe-d-edp-1.html > [33]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-rplp-1 > /igt@kms_pipe_crc_basic@read-crc-frame-sequence@pipe-d-edp-1.html > > * {igt@kms_pm_backlight@basic-brightness@edp-1}: > - bat-adlp-6: [ABORT][34] ([i915#8668]) -> [PASS][35] > [34]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13856/bat-adlp-6/igt@kms_pm_backlight@basic-brightness@edp-1.html > [35]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-6 > /igt@kms_pm_backlight@basic-brightness@edp-1.html > > * {igt@kms_pm_rpm@basic-pci-d3-state}: > - bat-adln-1: [ABORT][36] ([i915#8668]) -> [PASS][37] > [36]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13856/bat-adln-1/igt@kms_pm_rpm@basic-pci-d3-state.html > [37]: https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adln-1/igt@kms_pm_rpm@basic-pci-d3-state.html > - bat-adlp-11: [ABORT][38] ([i915#8668]) -> [PASS][39] > [38]: https://intel-gfx-ci.01.org/tree/drm-tip/CI_DRM_13856/bat-adlp-11/igt@kms_pm_rpm@basic-pci-d3-state.html > [39]: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/bat-adlp-1 > 1/igt@kms_pm_rpm@basic-pci-d3-state.html > > > {name}: This element is suppressed. This means it is ignored when computing > the status of the difference (SUCCESS, WARNING, or FAILURE). > > [fdo#109271]: https://bugs.freedesktop.org/show_bug.cgi?id=109271 > [fdo#109295]: https://bugs.freedesktop.org/show_bug.cgi?id=109295 > [i915#1072]: https://gitlab.freedesktop.org/drm/intel/issues/1072 > [i915#1886]: https://gitlab.freedesktop.org/drm/intel/issues/1886 > [i915#1982]: https://gitlab.freedesktop.org/drm/intel/issues/1982 > [i915#2190]: https://gitlab.freedesktop.org/drm/intel/issues/2190 > [i915#3291]: https://gitlab.freedesktop.org/drm/intel/issues/3291 > [i915#3555]: https://gitlab.freedesktop.org/drm/intel/issues/3555 > [i915#3708]: https://gitlab.freedesktop.org/drm/intel/issues/3708 > [i915#4613]: https://gitlab.freedesktop.org/drm/intel/issues/4613 > [i915#5334]: https://gitlab.freedesktop.org/drm/intel/issues/5334 > [i915#6621]: https://gitlab.freedesktop.org/drm/intel/issues/6621 > [i915#8668]: https://gitlab.freedesktop.org/drm/intel/issues/8668 > [i915#9275]: https://gitlab.freedesktop.org/drm/intel/issues/9275 > [i915#9276]: https://gitlab.freedesktop.org/drm/intel/issues/9276 > > > Build changes > ------------- > > * Linux: CI_DRM_13856 -> Patchwork_126012v3 > > CI-20190529: 20190529 > CI_DRM_13856: b81818fa6745cf79a86da57dc3a379bd80c7ea5f @ git://anongit.freedesktop.org/gfx-ci/linux > IGT_7580: 847ee1e7d365e2fb08bf4198d3bf5ee8a852649f @ https://gitlab.freedesktop.org/drm/igt-gpu-tools.git > Patchwork_126012v3: b81818fa6745cf79a86da57dc3a379bd80c7ea5f @ > git://anongit.freedesktop.org/gfx-ci/linux > > > ### Linux commits > > bc174a299b6b drm/i915/vma: Fix potential UAF on multi-tile platforms > > == Logs == > > For more details see: > https://intel-gfx-ci.01.org/tree/drm-tip/Patchwork_126012v3/index.html >
diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c index d09aad34ba37f..f56907f9bc756 100644 --- a/drivers/gpu/drm/i915/i915_vma.c +++ b/drivers/gpu/drm/i915/i915_vma.c @@ -34,6 +34,7 @@ #include "gt/intel_engine.h" #include "gt/intel_engine_heartbeat.h" #include "gt/intel_gt.h" +#include "gt/intel_gt_pm.h" #include "gt/intel_gt_requests.h" #include "gt/intel_tlb.h" @@ -103,12 +104,25 @@ static inline struct i915_vma *active_to_vma(struct i915_active *ref) static int __i915_vma_active(struct i915_active *ref) { - return i915_vma_tryget(active_to_vma(ref)) ? 0 : -ENOENT; + struct i915_vma *vma = active_to_vma(ref); + + if (!i915_vma_tryget(vma)) + return -ENOENT; + + if (!i915_vma_is_ggtt(vma)) + intel_gt_pm_get(vma->vm->gt); + + return 0; } static void __i915_vma_retire(struct i915_active *ref) { - i915_vma_put(active_to_vma(ref)); + struct i915_vma *vma = active_to_vma(ref); + + if (!i915_vma_is_ggtt(vma)) + intel_gt_pm_put_async(vma->vm->gt); + + i915_vma_put(vma); } static struct i915_vma * @@ -1404,7 +1418,7 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww, struct i915_vma_work *work = NULL; struct dma_fence *moving = NULL; struct i915_vma_resource *vma_res = NULL; - intel_wakeref_t wakeref = 0; + intel_wakeref_t wakeref; unsigned int bound; int err; @@ -1424,8 +1438,7 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww, if (err) return err; - if (flags & PIN_GLOBAL) - wakeref = intel_runtime_pm_get(&vma->vm->i915->runtime_pm); + wakeref = intel_runtime_pm_get(&vma->vm->i915->runtime_pm); if (flags & vma->vm->bind_async_flags) { /* lock VM */ @@ -1561,8 +1574,7 @@ int i915_vma_pin_ww(struct i915_vma *vma, struct i915_gem_ww_ctx *ww, if (work) dma_fence_work_commit_imm(&work->base); err_rpm: - if (wakeref) - intel_runtime_pm_put(&vma->vm->i915->runtime_pm, wakeref); + intel_runtime_pm_put(&vma->vm->i915->runtime_pm, wakeref); if (moving) dma_fence_put(moving);
Object debugging tools were sporadically reporting illegal attempts to free a still active i915 VMA object from when parking a GPU tile believed to be idle. [161.359441] ODEBUG: free active (active state 0) object: ffff88811643b958 object type: i915_active hint: __i915_vma_active+0x0/0x50 [i915] [161.360082] WARNING: CPU: 5 PID: 276 at lib/debugobjects.c:514 debug_print_object+0x80/0xb0 ... [161.360304] CPU: 5 PID: 276 Comm: kworker/5:2 Not tainted 6.5.0-rc1-CI_DRM_13375-g003f860e5577+ #1 [161.360314] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022 [161.360322] Workqueue: i915-unordered __intel_wakeref_put_work [i915] [161.360592] RIP: 0010:debug_print_object+0x80/0xb0 ... [161.361347] debug_object_free+0xeb/0x110 [161.361362] i915_active_fini+0x14/0x130 [i915] [161.361866] release_references+0xfe/0x1f0 [i915] [161.362543] i915_vma_parked+0x1db/0x380 [i915] [161.363129] __gt_park+0x121/0x230 [i915] [161.363515] ____intel_wakeref_put_last+0x1f/0x70 [i915] That has been tracked down to be happening when another thread was deactivating the VMA inside __active_retire() helper, after the VMA's active counter was already decremented to 0, but before deactivation of the VMA's object was reported to the object debugging tools. Root cause has been identified as premature release of last wakeref for the GPU tile to which the active VMA belonged. In case of single-tile platforms, an engine associated with a request that uses the VMA is usually keeping the tile's wakeref long enough for that VMA to be deactivated on time, before it is going to be freed on last put of that wakeref. However, on multi-tile platforms, a request may use a VMA from a tile other than the one that hosts the request's engine, then, not protected with the engine's wakeref. Get an extra wakeref for the VMA's tile when activating it, and put that wakeref only after the VMA is deactivated. However, exclude GGTT from that processing path, otherwise the GPU never goes idle. Since __i915_vma_retire() may be called from atomic contexts, use async variant of wakeref put. CI reports indicate that single-tile platforms also suffer sporadically from the same race, however, unlike in case of multi-tile, exact scenario when that happens hasn't been discovered yet. Then, while I submit this patch as fix for multi-tile cases, and in hope it also addresses single- tile, I'm not able to blame any particular commit for that issue. However, I'm going to ask i915 maintainers to include this fix, if accepted, in the current rc cycle (6.7-rc) as important for the first supported multi-tile platform -- Meteor Lake. v2: Get the wakeref before vm mutex to avoid circular locking dependency, - drop questionable Fixes: tag. Closes: https://gitlab.freedesktop.org/drm/intel/issues/8875 Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com> --- drivers/gpu/drm/i915/i915_vma.c | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-)