From patchwork Fri Dec 21 14:33:24 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Kazlauskas, Nicholas" X-Patchwork-Id: 10740513 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1885513B5 for ; Fri, 21 Dec 2018 14:33:43 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0792A1FFFE for ; Fri, 21 Dec 2018 14:33:43 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id ECC5120072; Fri, 21 Dec 2018 14:33:42 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 79C681FFFE for ; Fri, 21 Dec 2018 14:33:42 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 2AC156E06B; Fri, 21 Dec 2018 14:33:40 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from NAM02-CY1-obe.outbound.protection.outlook.com (mail-cys01nam02on061a.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe45::61a]) by gabe.freedesktop.org (Postfix) with ESMTPS id B6E2C6E05A for ; Fri, 21 Dec 2018 14:33:38 +0000 (UTC) Received: from DM5PR12CA0052.namprd12.prod.outlook.com (2603:10b6:3:103::14) by DM5PR12MB1322.namprd12.prod.outlook.com (2603:10b6:3:76::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1446.17; Fri, 21 Dec 2018 14:33:35 +0000 Received: from BY2NAM03FT032.eop-NAM03.prod.protection.outlook.com (2a01:111:f400:7e4a::207) by DM5PR12CA0052.outlook.office365.com (2603:10b6:3:103::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1446.19 via Frontend Transport; Fri, 21 Dec 2018 14:33:35 +0000 Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) Received: from SATLEXCHOV01.amd.com (165.204.84.17) by BY2NAM03FT032.mail.protection.outlook.com (10.152.84.228) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1471.13 via Frontend Transport; Fri, 21 Dec 2018 14:33:35 +0000 Received: from kazbox.amd.com (10.180.168.240) by SATLEXCHOV01.amd.com (10.181.40.71) with Microsoft SMTP Server id 14.3.389.1; Fri, 21 Dec 2018 08:33:34 -0600 From: Nicholas Kazlauskas To: Subject: [PATCH] drm: Block fb changes for async plane updates Date: Fri, 21 Dec 2018 09:33:24 -0500 Message-ID: <20181221143324.27679-1-nicholas.kazlauskas@amd.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:165.204.84.17; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10009020)(376002)(346002)(396003)(39860400002)(136003)(2980300002)(428003)(199004)(189003)(126002)(2870700001)(2616005)(26005)(5660300001)(53936002)(2906002)(1076003)(486006)(4326008)(104016004)(476003)(50466002)(44832011)(23676004)(7696005)(53416004)(66574012)(68736007)(316002)(6916009)(47776003)(14444005)(5820100001)(54906003)(336012)(50226002)(356004)(81166006)(81156014)(8676002)(478600001)(72206003)(8936002)(6666004)(2351001)(86362001)(305945005)(105586002)(77096007)(106466001)(186003)(36756003)(97736004)(426003)(15650500001); DIR:OUT; SFP:1101; SCL:1; SRVR:DM5PR12MB1322; H:SATLEXCHOV01.amd.com; FPR:; SPF:None; LANG:en; PTR:InfoDomainNonexistent; A:1; MX:1; X-Microsoft-Exchange-Diagnostics: 1; BY2NAM03FT032; 1:plZfiQTF9X04dQ9XBNjnSLekYSIk1ppapTbiY69VNvN8F32zDvV+Wv2pDKK2Eb4yDypaoNI1TMbcJDpalOwpeV26waD+XyPg42ujaQy67N0nOkRj210Q0vWUJyY75iZy X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 114d2d05-01ba-4836-0f90-08d667514a23 X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600074)(711020)(2017052603328)(7153060); SRVR:DM5PR12MB1322; X-Microsoft-Exchange-Diagnostics: 1; DM5PR12MB1322; 3:XmTOXZG3LBuMMDowT+EnlUORjEMwudd2ixDrjFUymgzbWtJjB6gwYt9ExHVNX9KtSM4UMnHAXKNA/DsXh+bBvd7JHYZFwm6X7LG2gr3TYGsLTRr/MedroubZO8V2Z/qcoGc+y3wcxE5aP0sgsFkgMq4HJIeO3MnIJg4s6hrWUV/mKIUUGs9OEhds6ibVvKnYMHyPIeriZo/IBSxHhlu9G1D+Au1yorIG02i2OuV+v3oXuuTrkeh6D83VfNOuhZ7qqD0seqCqXCrnXbZieejeGlKb3ioiaFNNTic7GS1gpJTp8TbN4bJETr1EbBqtv2h+lGdknHeJjYlkFdcWL1t9T+UwzbThaJvVKAfzUVFXf64=; 25:aquLO3j/QGNH5FflwXT/4CUiJV29afP51hqd+DK1LbK7ESCMdBE2fM/5PDNSr38KXRpMqwTeiTL3dFZfIC05aJjGVsQlO+GHLf1KjK5OG9445l/YeE+bDIYgZhIIqXkGFHZ4fOATXuxs8bhApYxDcaYbE5bqm9T8wMAbSrRgvQFgTRJuZyxmTzwcfGNOA7HjQ0Psyr4rZpAWOZOw+yYSZx5MhP5m6pqV4WWuLswe5ysYw/4RrbtAPVhnoA/QrZnfH286LG3x/9wqQBUYMfEyrvbo8YktwlucoAyJn9uDSHCxAhl/c/CxhXQGPsGINbueMdWzfAr5s+K+kCe2B0SjHw== X-MS-TrafficTypeDiagnostic: DM5PR12MB1322: X-Microsoft-Exchange-Diagnostics: 1; DM5PR12MB1322; 31:hHmMwebBCldqAF2R3wuYSJyHSPklwzO6kzHsGylSadrBJ/OgxB2jC5cNn9PgHMz7zib35ZjGz6+OuTs2cBtbDJIkOt4RumEucw5NTw6eYmvBdVtzMK2uoQRrxvZct2yXRLlQXPxPtHXps0NELoV9MzFQTUPtbGm0ju+tfkksgGlnnKPm69rfJ28McBZhFP018WkH8EQRXWnVEWnN7K0C+UR9WMovyxukenmCWv5DgEg=; 20:DL3DZMZZlxv2iJk5XoViaryeVKWbm/qm2zCE5+7qEC2I9Io7EssfavRMCYiWHx1OYONsOJjV8Ulu+Nv2ovg8ivGvfUC0Y9VLLeDG54ueuAelA59mSy8ch88sgl5IY8KEXSeHb0KWPdZLkoR/Zdt7K5oXjlzH/B43EgvebyPd6WJC9X5SGIIyWpxROR/On+3io5nwkwXbuhP+wR+5+We8IFlyp83I0Sl1OKFAsqR1AF6PaYsglX4aiHF+7+u5satFBdGy/6AI0ofDoEmE6nzPDJsnmHL9ESyM4rKGPELF87G6Vu4lzuxxY/EfTc5+pjjgikY/DUxyDjuOCMkybNdSMi19Wm5pEbKJ3xDhdCKGMnLT8wOArFBY/jRU7VOxoAo3i5gvUjlzbzLN2TKSCrniP82VpJnbKc2FML49HiItfo3upUllzTORbJG74xs7QUD3seD/UsfDwwjDNfRfU5Yw76BPji5Ka3/UDYwBfrP0Awsf7bgtD5vyHQ2zBVcS6oE+ X-Microsoft-Antispam-PRVS: X-MS-Exchange-SenderADCheck: 1 X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(8211001083)(3230021)(999002)(5005026)(6040522)(2401047)(8121501046)(10201501046)(3002001)(93006095)(93003095)(3231475)(944501520)(52105112)(6055026)(149066)(150057)(6041310)(20161123560045)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(20161123558120)(20161123564045)(20161123562045)(201708071742011)(7699051)(76991095); SRVR:DM5PR12MB1322; BCL:0; PCL:0; RULEID:; SRVR:DM5PR12MB1322; X-Microsoft-Exchange-Diagnostics: 1; DM5PR12MB1322; 4:X0Pa09EWytEFCizhkJNmGi+4JJodWEMxtEs8895BIGNQE5NVmuwaJK0j2aENZuZWGPAW5fTee2EnisERC7PNOmHGv9U9PV1Us0fSWevHpkoeEsTNvOl6ml7lOBqk8w7ggfoW1CHh8YKOyii01+t7tbP4qvGMQUHvLhzeIAth7qYUupCUmPzJYNShgskPwq4L2pV9LmVZ25EvQ94rzNJyeE7OI8/KPg02i08SR9AGdO7FwxsLn8KarpwWf5XHDwqVB91/QT46tpI4jfbpBG4mwg== X-Forefront-PRVS: 0893636978 X-Microsoft-Exchange-Diagnostics: =?utf-8?q?1=3BDM5PR12MB1322=3B23=3AS0iftip?= =?utf-8?q?w3hrr5H84aOuI94uhzjxY/1d5TZ+ke05Ythx+wAtvzImMA/9OOPTdHiAL8fbw4X4V?= =?utf-8?q?qBh03F8eOqFJzwonfwN+C2h4ButgX8/71LQ3KrBrN84EbieAUP+9Q0begy36+kzAa?= =?utf-8?q?ixIwmSqVfHDGi/TMAtKT1YaGTNgp+nH32nrKQF5BP9zvni7/23+eym3fHEmU/DkgT?= =?utf-8?q?G12pk65EVwYANO9Ksk22BNSE7xImmAWwBK5Mbp3lrl1a/PGqaWKJtwfjb9jbeGCzW?= =?utf-8?q?XfwUPU/B1U+ysQ6Cyd/gR60fRiKKStfrMN0FQlhr4bKxo+/vF6VNcNJKiMVaQHIKJ?= =?utf-8?q?zEW1K2Kt+TxL15opyrSb+KqlqGXTTBZItYv5unFuucCzKKLw1tISu2OCfTVHy2kq8?= =?utf-8?q?sPuTavBdOnUxF3xvkUito+h52470zWkvW1WjQhpQgMwJ8VRndqEkYPy9K6D07ouT1?= =?utf-8?q?AWFERJtpf0lNBLktoHf5LfJmPjuBoIEYW7tLQTiSAAIbr40ukKeYB8M9z+4HOJDtf?= =?utf-8?q?70QePt/pmalmDQ1h40Ee8O2NZOjzNWHraMTJ7hYS9azICRPcWghKlIrVFcY61+6vL?= =?utf-8?q?/PJ8SJrlqCJsr2TdH4XRkfNU5WJ/Bze0iOoqcOHp4ZfWMojFAnglBVaGJ36RGcDDY?= =?utf-8?q?aIXVru5Sraz0jD9QyXfbKQdxMuXMI3jdpHzLrOAGTgm8SqAo5lK7EX0Suv5NWv+Lv?= =?utf-8?q?amYApbUvnKPgU9Fgp4roJKTrjJapRLC6K596LT3j9yQuaGVwIZnJACG8UjTCEMld9?= =?utf-8?q?Q6Crve11QlXtGszPT5Hk+0MH+pGwMKGIWbDD9z8DH3CAxGqSbR5xImYQHyUyw9NLW?= =?utf-8?q?EH7VElJMmqUKywdDTgf+dXlYtiHlrWyGvs9oJaxnfCSU2mBwv7j2Ph7MTXPENPLVf?= =?utf-8?q?GgENml0nEr/BajAqDqrZ5V5AHAqihMhsjs4jtVp/KRNc8KX6AlmuR2wJytQOXdJ5A?= =?utf-8?q?AbokwsFFxKNTCn5dk4CfYVXgt9FK3EgLeannK4MUIs/T9G3Un7OJzoJs9WBv53FGu?= =?utf-8?q?5TQcXHV4gogeYnxFj3fIb/qMv0ObPYdTJYFBJavX4gNIjPR3aP9MafhY6ek3n9T95?= =?utf-8?q?7ev3EAebusVkENvTnl7+JtCl8gV1n6LUhaf7HKnDx7b+SgM7SlCLlhxjuJ9FTWvg9?= =?utf-8?q?9nVNyiqhDGSkXhsGwA1Uq3/XNetd/VXLZ4IqnKnjWEsRBu0YsjizEWlut18ZQ=3D?= =?utf-8?q?=3D?= X-Microsoft-Antispam-Message-Info: InsoNltL7rS1hh02XQOqSFWoh9ZE3yHswpd4IYZe+nn/aU5EBQUdTwaYrBPQI9ednsuKVpbQmYweDwoAiJwqg051crhZJZLaKB2aNUbsQ4mAKelS+K4g6RJQqerVZx1F/0KHQSJQJOPXlhpsbPPrtXHI9CeAkDhiM4GxuyQmj6rI0X6HhRr+Ej2aMwQ1kxUUU6+faLktW+bmdVHEIDl9zLSiVpX4u0l3aCchDCg4YrZblFJ702d7/QA+vBjc8UPhC0LLVcH7OaDxFf+6KYaITPjUtVme4yHKPdiYs3yL52zn9abmT5uqRQSAmOeEF+E6 X-Microsoft-Exchange-Diagnostics: 1; DM5PR12MB1322; 6:42r86rP5+J2Td9zEB9OIHqhgh8Wg8g4p/Du6bZKf0uH7gaAJwKwk2X9euSHXZMsZca2w6uHBeJHHfYAvf4ki09ZaqdwE8sEKh9pbQmtmGIhp8JbYOivVmXPrRdDdLEV6DDrddeTRIjODBEN71fEuyaQ4jTcx/v2h/IRrqTuxTYsaI0qm3959cczQ/s+jLnF842XY80fGWqvU0OLyd8WHyUesUOchaL200QtzLPUUO5jKvw1UUDzpJCjs6qF+qf0AXpHOIiiNCpIRfmecao8HGbrmvwr2uoTGsXowB1U+KLoHsYcMcwTPzUx52JfATw74nvXOGpaMjnnBD4tlM4Dy3sUMzsupU9ZKUAuehoi1rGIe6up6RQ1nJ9t7nbXRaiU0t1JYHlJHnmQCuUsEoWsJ69WNcz6CsI/Z6bxY2ST8kdYUYWY79IgjLOIzz9ssDKUDc6Dg6AzPugNWNpUxpBTrMQ==; 5:iaspGv3YxM7cCmIMmtHkTtoxx8uCAi19HdzV0aG+APcoAOXNl+k8DmCqiV+UyOiqOE4pVc9KFQLOLdBcR2EtGLf2/xlHI4xd9Tdo38izxPeTdb6gyLD3k216WBriy+u3reUp0pwjcBTYsJEU+qxgRBU13Xzk9FweLTBTSYNGCqk=; 7:ECQmRevkeNwVRm5jvPBur6LM787JKhezV6iV7HGNf044WKwUJ++elMAR3sDevkDq6PyQzbnFxn/BjeO1DMCqO711jNXhp9RI7YIgRl/HYgfoCQWcInRujr6wyS+jgYyQ+kddeEg61F0WyeywAwQRLA== SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; DM5PR12MB1322; 20:iWiNuS897ZrWsZEoIMnL+lDzXYnbZHM+WQ7QR+a+cxuKgsSBvnmtSVBwAMsB79kcXkJnjKCUmg/6NmyzmKXnpFdAgylTFYOxrV83YtoCEiNQbggdLT7Y1fltc2iYes8W8kUZbJpXnB6eoyw1jYMLIZx9Us2di5SuSFGRmEA6Vplu63xt/xniS1C0B8W1fSU4mJKkAvEI8MrgtCEEIvAJ6qrZLHWvdh/YM/jDpXJV49AgI4hk/6mCzsHm92Co9cVZ X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Dec 2018 14:33:35.1607 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 114d2d05-01ba-4836-0f90-08d667514a23 X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d; Ip=[165.204.84.17]; Helo=[SATLEXCHOV01.amd.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR12MB1322 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Daniel Vetter , =?utf-8?q?Michel_D=C3=A4nzer?= , Nicholas Kazlauskas Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP The behavior of drm_atomic_helper_cleanup_planes differs depending on whether the commit was an asynchronous update or not. For a typical (non-async) atomic commit prepare_fb is called on the new_plane_state and cleanup_fb is called on the old_plane_state. However, async commits are performed in place and don't swap the state for the plane. The call to prepare_fb happens on the new_plane_state and the call to cleanup_fb is also called on the new_plane_state in this case (since the state hasn't swapped). This behavior can lead to use-after-free or unpin of an active fb. Consider the following sequence of events for interleaving fbs: - Async update, fb1 prepare, fb1 cleanup_fb - Async update, fb2 prepare, fb2 cleanup_fb - Non-async update, fb1 prepare, fb2 cleanup_fb - Async update, fb2 cleanup_fb -> double cleanup, use-after-free This situation has been observed in practice for a double buffered cursor when closing an X client. The non-async update occurs because the new_plane_state->crtc != old_plane_state->crtc which forces the non-async path to occur. The simplest fix for this is to block fb updates in drm_atomic_helper_async_check. This guarantees that the framebuffer will have previously been prepared and any subsequent async updates will always call prepare and cleanup_fb like the non-async atomic commit path would. Cc: Michel Dänzer Cc: Daniel Vetter Cc: Andrey Grodzovsky Cc: Harry Wentland Signed-off-by: Nicholas Kazlauskas Acked-by: Andrey Grodzovsky --- drivers/gpu/drm/drm_atomic_helper.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index 54e2ae614dcc..d2f80bf14f86 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -1599,7 +1599,8 @@ int drm_atomic_helper_async_check(struct drm_device *dev, return -EINVAL; if (!new_plane_state->crtc || - old_plane_state->crtc != new_plane_state->crtc) + old_plane_state->crtc != new_plane_state->crtc || + old_plane_state->fb != new_plane_state->fb) return -EINVAL; funcs = plane->helper_private;