kernel_samsung_a53x/drivers/gpu/drm
Janusz Krzysztofik 0ecec1bda2 drm/i915/gt: Fix potential UAF by revoke of fence registers
commit 996c3412a06578e9d779a16b9e79ace18125ab50 upstream.

CI has been sporadically reporting the following issue triggered by
igt@i915_selftest@live@hangcheck on ADL-P and similar machines:

<6> [414.049203] i915: Running intel_hangcheck_live_selftests/igt_reset_evict_fence
...
<6> [414.068804] i915 0000:00:02.0: [drm] GT0: GUC: submission enabled
<6> [414.068812] i915 0000:00:02.0: [drm] GT0: GUC: SLPC enabled
<3> [414.070354] Unable to pin Y-tiled fence; err:-4
<3> [414.071282] i915_vma_revoke_fence:301 GEM_BUG_ON(!i915_active_is_idle(&fence->active))
...
<4>[  609.603992] ------------[ cut here ]------------
<2>[  609.603995] kernel BUG at drivers/gpu/drm/i915/gt/intel_ggtt_fencing.c:301!
<4>[  609.604003] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
<4>[  609.604006] CPU: 0 PID: 268 Comm: kworker/u64:3 Tainted: G     U  W          6.9.0-CI_DRM_14785-g1ba62f8cea9c+ #1
<4>[  609.604008] Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR4 RVP, BIOS RPLPFWI1.R00.4035.A00.2301200723 01/20/2023
<4>[  609.604010] Workqueue: i915 __i915_gem_free_work [i915]
<4>[  609.604149] RIP: 0010:i915_vma_revoke_fence+0x187/0x1f0 [i915]
...
<4>[  609.604271] Call Trace:
<4>[  609.604273]  <TASK>
...
<4>[  609.604716]  __i915_vma_evict+0x2e9/0x550 [i915]
<4>[  609.604852]  __i915_vma_unbind+0x7c/0x160 [i915]
<4>[  609.604977]  force_unbind+0x24/0xa0 [i915]
<4>[  609.605098]  i915_vma_destroy+0x2f/0xa0 [i915]
<4>[  609.605210]  __i915_gem_object_pages_fini+0x51/0x2f0 [i915]
<4>[  609.605330]  __i915_gem_free_objects.isra.0+0x6a/0xc0 [i915]
<4>[  609.605440]  process_scheduled_works+0x351/0x690
...

In the past, there were similar failures reported by CI from other IGT
tests, observed on other platforms.

Before commit 63baf4f3d587 ("drm/i915/gt: Only wait for GPU activity
before unbinding a GGTT fence"), i915_vma_revoke_fence() was waiting for
idleness of vma->active via fence_update().   That commit introduced
vma->fence->active in order for the fence_update() to be able to wait
selectively on that one instead of vma->active since only idleness of
fence registers was needed.  But then, another commit 0d86ee35097a
("drm/i915/gt: Make fence revocation unequivocal") replaced the call to
fence_update() in i915_vma_revoke_fence() with only fence_write(), and
also added that GEM_BUG_ON(!i915_active_is_idle(&fence->active)) in front.
No justification was provided on why we might then expect idleness of
vma->fence->active without first waiting on it.

The issue can be potentially caused by a race among revocation of fence
registers on one side and sequential execution of signal callbacks invoked
on completion of a request that was using them on the other, still
processed in parallel to revocation of those fence registers.  Fix it by
waiting for idleness of vma->fence->active in i915_vma_revoke_fence().

Fixes: 0d86ee35097a ("drm/i915/gt: Make fence revocation unequivocal")
Closes: https://gitlab.freedesktop.org/drm/intel/issues/10021
Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
Cc: stable@vger.kernel.org # v5.8+
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240603195446.297690-2-janusz.krzysztofik@linux.intel.com
(cherry picked from commit 24bb052d3dd499c5956abad5f7d8e4fd07da7fb1)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-11-19 14:19:34 +01:00
..
amd drm/amdgpu: fix UBSAN warning in kv_dpm.c 2024-11-19 14:19:31 +01:00
arc Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
arm drm/komeda: check for error-valued pointer 2024-11-19 14:19:03 +01:00
armada Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
aspeed Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ast Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
atmel-hlcdc Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bochs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bridge drm/bridge/panel: Fix runtime warning on panel bridge release 2024-11-19 14:19:03 +01:00
etnaviv drm/etnaviv: Restore some id values 2024-11-19 09:22:33 +01:00
exynos drm/exynos: hdmi: report safe 640x480 mode as a fallback when no EDID found 2024-11-19 14:19:04 +01:00
fsl-dcu Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
gma500 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hisilicon Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
i2c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
i810 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
i915 drm/i915/gt: Fix potential UAF by revoke of fence registers 2024-11-19 14:19:34 +01:00
imx drm/imx/ipuv3: do not return negative values from .get_modes() 2024-11-19 09:22:36 +01:00
ingenic Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
lib Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
lima drm/lima: mask irqs in timeout path before hard reset 2024-11-19 14:19:07 +01:00
mcde Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mediatek drm/mediatek: Add 0 size check to mtk_drm_gem_obj 2024-11-19 12:26:57 +01:00
meson drm/meson: vclk: fix calculation of 59.94 fractional rates 2024-11-19 12:26:57 +01:00
mga Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
mgag200 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
msm drm/msm/dpu: Always flush the slave INTF on the CTL 2024-11-19 12:27:06 +01:00
mxsfb Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nouveau drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes 2024-11-19 14:19:34 +01:00
omapdrm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
panel drm/panel: simple: Add missing display timing flags for KOE TX26D202VM0BWA 2024-11-19 14:19:32 +01:00
panfrost Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pl111 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
qxl drm/qxl: fix UAF on handle creation 2024-11-18 12:12:11 +01:00
r128 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
radeon drm/radeon/radeon_display: Decrease the size of allocated memory 2024-11-19 14:19:32 +01:00
rcar-du Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rockchip drm/rockchip: lvds: do not print scary message when probing defer 2024-11-19 08:44:51 +01:00
samsung exynos_gpu: Don't allow userspace to control freqs 2024-06-15 16:28:49 -03:00
savage Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
scheduler Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
selftests Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
shmobile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sis Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sti Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stm Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sun4i Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tdfx Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tegra drm/tegra: put drm_gem_object ref on error in tegra_fb_create 2024-11-19 08:44:54 +01:00
tidss drm/tidss: Fix initial plane zpos values 2024-11-19 08:44:54 +01:00
tilcdc Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tiny Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ttm drm/vmwgfx: Fix some static checker warnings 2024-11-19 09:22:15 +01:00
tve200 Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
udl Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
v3d Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vboxvideo Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vc4 drm: vc4: Fix possible null pointer dereference 2024-11-19 12:26:58 +01:00
vgem Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
via Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
virtio Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vkms Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
vmwgfx drm/vmwgfx: 3D disabled should not effect STDU memory limits 2024-11-19 14:19:03 +01:00
xen Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
xlnx Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
zte Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_agpsupport.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_atomic.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_atomic_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_atomic_state_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_atomic_uapi.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_auth.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_blend.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_bridge.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_bridge_connector.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_bufs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_cache.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_client.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_client_modeset.c drm/client: Fully protect modes[] with dev->mode_config.mutex 2024-11-19 11:32:20 +01:00
drm_color_mgmt.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_connector.c drm/connector: Add support for out-of-band hotplug notification (v3) 2024-11-08 11:26:15 +01:00
drm_context.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_crtc.c drm/crtc: fix uninitialized variable use 2024-11-18 12:12:18 +01:00
drm_crtc_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_crtc_helper_internal.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_crtc_internal.h drm/connector: Add drm_connector_find_by_fwnode() function (v3) 2024-11-08 11:26:15 +01:00
drm_damage_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_debugfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_debugfs_crc.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_dma.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_dp_aux_dev.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_dp_cec.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_dp_dual_mode_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_dp_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_dp_mst_topology.c drm/dp_mst: Fix NULL deref in get_mst_branch_device_by_guid_helper() 2024-11-18 10:58:29 +01:00
drm_dp_mst_topology_internal.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_drv.c drm/drv: propagate errors from drm_modeset_register_all() 2024-11-18 12:12:40 +01:00
drm_dsc.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_dumb_buffers.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_edid.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_edid_load.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_encoder.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_encoder_slave.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_fb_cma_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_fb_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_file.c drm/drm_file: fix use of uninitialized variable 2024-11-18 12:13:17 +01:00
drm_flip_work.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_format_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_fourcc.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_framebuffer.c drm/framebuffer: Fix use of uninitialized variable 2024-11-18 12:13:18 +01:00
drm_gem.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_gem_cma_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_gem_framebuffer_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_gem_shmem_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_gem_ttm_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_gem_vram_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_hashtab.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_hdcp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_internal.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_ioc32.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_ioctl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_irq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_kms_helper_common.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_lease.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_legacy.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_legacy_misc.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_lock.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_managed.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_memory.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_mipi_dbi.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_mipi_dsi.c drm/mipi-dsi: use correct return type for the DSC functions 2024-11-19 12:26:58 +01:00
drm_mm.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_mode_config.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_mode_object.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_modes.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_modeset_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_modeset_lock.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_of.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_panel.c drm/panel: do not return negative error codes from drm_panel_get_modes() 2024-11-19 09:22:36 +01:00
drm_panel_orientation_quirks.c drm: panel-orientation-quirks: Add quirk for One Mix 2S 2024-11-08 11:26:17 +01:00
drm_pci.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_plane.c drm: Don't unref the same fb many times by mistake due to deadlock handling 2024-11-18 12:13:03 +01:00
drm_plane_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_prime.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_print.c drm: Stub out debug prints 2024-11-17 17:45:26 +01:00
drm_probe_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_property.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_rect.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_scatter.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_scdc_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_self_refresh_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_simple_kms_helper.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_syncobj.c drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set 2024-11-18 22:25:42 +01:00
drm_sysfs.c drm/connector: Add a fwnode pointer to drm_connector and register with ACPI (v2) 2024-11-08 11:26:14 +01:00
drm_trace.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_trace_points.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_vblank.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_vblank_work.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_vm.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_vma_manager.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
drm_writeback.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00