From patchwork Wed Aug 3 23:03:24 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Summers, Stuart" X-Patchwork-Id: 12935950 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 59725C19F2D for ; Wed, 3 Aug 2022 23:04:09 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id DDF372BFB1; Wed, 3 Aug 2022 23:03:47 +0000 (UTC) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by gabe.freedesktop.org (Postfix) with ESMTPS id E21392BA19 for ; Wed, 3 Aug 2022 23:03:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1659567806; x=1691103806; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=YTRZDzL/OTyoKldOwu2AcV4LAiGrt6uFNVb2Gju6ijQ=; b=glBxE5CRC3wPGjCKgBIpgqNH8RgwS5Rs2gDOMa0DKm9fsXv8Yu75qFVv ECz2NUbAiPLcPL1gp/2YK2TexN4N8XhfDOMkWKRY04KYahf2eU2N0Dk4v W0mHkVbGylSss5+oSGw5ELGKoPlOceIr/gQQPJHRHA8M1vU/QEuu7DhJ3 o/H99sfNKCugAWeLnIGxAV2ef6VL1m12zkf2rHZaK6YHoZF08p+iYem7L EUry8o38nLKajh49Y+2cp9y/LHY8vq59ednYfqBroR/IF1kDNLMZy1QwO 7iBGbnC/R+eAXbnPwYX6zBKBlslfHR3X2Hi6OHo1yKOWJ/aMabcZj20bW A==; X-IronPort-AV: E=McAfee;i="6400,9594,10428"; a="376095917" X-IronPort-AV: E=Sophos;i="5.93,214,1654585200"; d="scan'208";a="376095917" Received: from orsmga002.jf.intel.com ([10.7.209.21]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Aug 2022 16:03:25 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.93,214,1654585200"; d="scan'208";a="603001769" Received: from dut022-tglu.fm.intel.com ([10.105.19.23]) by orsmga002.jf.intel.com with ESMTP; 03 Aug 2022 16:03:25 -0700 From: Stuart Summers To: Date: Wed, 3 Aug 2022 23:03:24 +0000 Message-Id: <20220803230325.137593-1-stuart.summers@intel.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Subject: [Intel-gfx] [PATCH 1/2] drm/i915: Fix NPD in PMU during driver teardown X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: intel-gfx@lists.freedesktop.org Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" In the driver teardown, we are unregistering the gt prior to unregistering the PMU. This means there is a small window of time in which the application can request metrics from the PMU, some of which are calling into the uapi engines list, while the engines are not available. In this case we can see null pointer dereferences. Fix this ordering in both the driver load and unload sequences. v1: Actually address the driver load/unload ordering issue v2: Remove the NULL checks since they shouldn't be necessary now with the proper ordering Fixes: 42014f69bb235 ("drm/i915: Hook up GT power management") Signed-off-by: Stuart Summers --- drivers/gpu/drm/i915/i915_driver.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_driver.c b/drivers/gpu/drm/i915/i915_driver.c index deb8a8b76965a..ee4dcb85d2060 100644 --- a/drivers/gpu/drm/i915/i915_driver.c +++ b/drivers/gpu/drm/i915/i915_driver.c @@ -717,7 +717,6 @@ static void i915_driver_register(struct drm_i915_private *dev_priv) struct drm_device *dev = &dev_priv->drm; i915_gem_driver_register(dev_priv); - i915_pmu_register(dev_priv); intel_vgpu_register(dev_priv); @@ -731,11 +730,12 @@ static void i915_driver_register(struct drm_i915_private *dev_priv) i915_debugfs_register(dev_priv); i915_setup_sysfs(dev_priv); + intel_gt_driver_register(to_gt(dev_priv)); + /* Depends on sysfs having been initialized */ + i915_pmu_register(dev_priv); i915_perf_register(dev_priv); - intel_gt_driver_register(to_gt(dev_priv)); - intel_display_driver_register(dev_priv); intel_power_domains_enable(dev_priv); @@ -762,11 +762,12 @@ static void i915_driver_unregister(struct drm_i915_private *dev_priv) intel_display_driver_unregister(dev_priv); - intel_gt_driver_unregister(to_gt(dev_priv)); - i915_perf_unregister(dev_priv); + /* GT should be available until PMU is gone */ i915_pmu_unregister(dev_priv); + intel_gt_driver_unregister(to_gt(dev_priv)); + i915_teardown_sysfs(dev_priv); drm_dev_unplug(&dev_priv->drm); From patchwork Wed Aug 3 23:03:25 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Summers, Stuart" X-Patchwork-Id: 12935949 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id F0792C19F2B for ; Wed, 3 Aug 2022 23:03:42 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 63D032BF9D; Wed, 3 Aug 2022 23:03:39 +0000 (UTC) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by gabe.freedesktop.org (Postfix) with ESMTPS id 4D7CE2AC2F for ; Wed, 3 Aug 2022 23:03:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1659567807; x=1691103807; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=ojYydcw4fKilI4BG+AUOp4AFByCjjMTvur965ObJLQs=; b=Cep49evfAFRZh09Dgf78OlWAXMlv9jybBVZPPTdJ2py5+0td996XI59C bjV2cuctVcql0Y+aPEmSSN0OsiZW7JknCN0x9U4tA2VpyJl/9+LwZ/1vs a0qpeS7XcsSxpfxPGqm4XRCZc/KKWx8VVfOVd4OyijuR3n2tLCXx/EaQU 9SdnjajcrrXllHVQkGWCKTObNnuid+Cxn2z9vrtb/BV968TuwrQSRB4Re GA+r8cdMfpOSaJKwO8cjjBGSKl7Bohu5r2+Pzhl0Yo7SGeWGEfGF46PEX F6sfDbAkqqfk2AbnxK/2ZtBXIE3T12oDiupK+/SyHyrOo2+16ladW5ZUS w==; X-IronPort-AV: E=McAfee;i="6400,9594,10428"; a="376095920" X-IronPort-AV: E=Sophos;i="5.93,214,1654585200"; d="scan'208";a="376095920" Received: from orsmga002.jf.intel.com ([10.7.209.21]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Aug 2022 16:03:26 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.93,214,1654585200"; d="scan'208";a="603001776" Received: from dut022-tglu.fm.intel.com ([10.105.19.23]) by orsmga002.jf.intel.com with ESMTP; 03 Aug 2022 16:03:25 -0700 From: Stuart Summers To: Date: Wed, 3 Aug 2022 23:03:25 +0000 Message-Id: <20220803230325.137593-2-stuart.summers@intel.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220803230325.137593-1-stuart.summers@intel.com> References: <20220803230325.137593-1-stuart.summers@intel.com> MIME-Version: 1.0 Subject: [Intel-gfx] [PATCH 2/2] drm/i915: Only disable PMU on stop if not already closed X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: intel-gfx@lists.freedesktop.org Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" There can be a race in the PMU process teardown vs the time when the driver is unbound in which the user attempts to stop the PMU process, but the actual data structure in the kernel is no longer available. Avoid this use-after-free by skipping the PMU disable in i915_pmu_event_stop() when the PMU has already been closed/unregistered by the driver. Fixes: b00bccb3f0bb ("drm/i915/pmu: Handle PCI unbind") Suggested-by: Tvrtko Ursulin Signed-off-by: Stuart Summers Reviewed-by: Tvrtko Ursulin Reviewed-by: Umesh Nerlige Ramappa --- drivers/gpu/drm/i915/i915_pmu.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/gpu/drm/i915/i915_pmu.c b/drivers/gpu/drm/i915/i915_pmu.c index 958b37123bf12..0d02f338118e4 100644 --- a/drivers/gpu/drm/i915/i915_pmu.c +++ b/drivers/gpu/drm/i915/i915_pmu.c @@ -760,9 +760,17 @@ static void i915_pmu_event_start(struct perf_event *event, int flags) static void i915_pmu_event_stop(struct perf_event *event, int flags) { + struct drm_i915_private *i915 = + container_of(event->pmu, typeof(*i915), pmu.base); + struct i915_pmu *pmu = &i915->pmu; + + if (pmu->closed) + goto out; + if (flags & PERF_EF_UPDATE) i915_pmu_event_read(event); i915_pmu_disable(event); +out: event->hw.state = PERF_HES_STOPPED; }