diff mbox

drm/i915: Fix a use-after-free in intel_execlists_retire_requests

Message ID 1422550507-21957-1-git-send-email-nicholas.hoath@intel.com (mailing list archive)
State New, archived
Headers show

Commit Message

Nick Hoath Jan. 29, 2015, 4:55 p.m. UTC
Remove request from list before unreferencing it, in case it's actually
the only reference. (Found by Tvrtko Ursulin)

Signed-off-by: Nick Hoath <nicholas.hoath@intel.com>
---
 drivers/gpu/drm/i915/intel_lrc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Mika Kuoppala Jan. 30, 2015, 9:01 a.m. UTC | #1
Nick Hoath <nicholas.hoath@intel.com> writes:

> Remove request from list before unreferencing it, in case it's actually
> the only reference. (Found by Tvrtko Ursulin)
>
> Signed-off-by: Nick Hoath <nicholas.hoath@intel.com>

Reviewed-by: Mika Kuoppala <mika.kuoppala@intel.com>

> ---
>  drivers/gpu/drm/i915/intel_lrc.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
> index 70e449b..a94346f 100644
> --- a/drivers/gpu/drm/i915/intel_lrc.c
> +++ b/drivers/gpu/drm/i915/intel_lrc.c
> @@ -732,8 +732,8 @@ void intel_execlists_retire_requests(struct intel_engine_cs *ring)
>  			intel_lr_context_unpin(ring, ctx);
>  		intel_runtime_pm_put(dev_priv);
>  		i915_gem_context_unreference(ctx);
> -		i915_gem_request_unreference(req);
>  		list_del(&req->execlist_link);
> +		i915_gem_request_unreference(req);
>  	}
>  }
>  
> -- 
> 2.1.1
>
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@lists.freedesktop.org
> http://lists.freedesktop.org/mailman/listinfo/intel-gfx
Daniel Vetter Jan. 30, 2015, 4:33 p.m. UTC | #2
On Fri, Jan 30, 2015 at 11:01:30AM +0200, Mika Kuoppala wrote:
> Nick Hoath <nicholas.hoath@intel.com> writes:
> 
> > Remove request from list before unreferencing it, in case it's actually
> > the only reference. (Found by Tvrtko Ursulin)
> >
> > Signed-off-by: Nick Hoath <nicholas.hoath@intel.com>

Do we have a Bugzilla: or similar report? Also when fixing a regression
please dig out the offending original commit from the history. Though in
this case here I'm not sure whether it is one ...

Please reply with this information so that I can amend the commit message.

> Reviewed-by: Mika Kuoppala <mika.kuoppala@intel.com>

Queued for -next, thanks for the patch.
-Daniel
Nick Hoath Jan. 30, 2015, 4:45 p.m. UTC | #3
On 30/01/2015 16:33, Daniel Vetter wrote:
> On Fri, Jan 30, 2015 at 11:01:30AM +0200, Mika Kuoppala wrote:
>> Nick Hoath <nicholas.hoath@intel.com> writes:
>>
>>> Remove request from list before unreferencing it, in case it's actually
>>> the only reference. (Found by Tvrtko Ursulin)
>>>
>>> Signed-off-by: Nick Hoath <nicholas.hoath@intel.com>
>
> Do we have a Bugzilla: or similar report? Also when fixing a regression
There's no bug report.
> please dig out the offending original commit from the history. Though in
> this case here I'm not sure whether it is one ...
I guess the closest thing to an offending commit is 
6d3d8274bc45de4babb62d64562d92af984dd238 drm/i915: Subsume 
intel_ctx_submit_request in to drm_i915_gem_request
>
> Please reply with this information so that I can amend the commit message.
>
>> Reviewed-by: Mika Kuoppala <mika.kuoppala@intel.com>
>
> Queued for -next, thanks for the patch.
> -Daniel
>

Cheers,
Nick
Daniel Vetter Jan. 30, 2015, 6:37 p.m. UTC | #4
On Fri, Jan 30, 2015 at 5:45 PM, Nick Hoath <nicholas.hoath@intel.com> wrote:
> On 30/01/2015 16:33, Daniel Vetter wrote:
>>
>> On Fri, Jan 30, 2015 at 11:01:30AM +0200, Mika Kuoppala wrote:
>>>
>>> Nick Hoath <nicholas.hoath@intel.com> writes:
>>>
>>>> Remove request from list before unreferencing it, in case it's actually
>>>> the only reference. (Found by Tvrtko Ursulin)
>>>>
>>>> Signed-off-by: Nick Hoath <nicholas.hoath@intel.com>
>>
>>
>> Do we have a Bugzilla: or similar report? Also when fixing a regression
>
> There's no bug report.

Hm, would have expected one ... maybe just stuck somewhere.

>> please dig out the offending original commit from the history. Though in
>> this case here I'm not sure whether it is one ...
>
> I guess the closest thing to an offending commit is
> 6d3d8274bc45de4babb62d64562d92af984dd238 drm/i915: Subsume
> intel_ctx_submit_request in to drm_i915_gem_request

Thanks a lot, added.
-Daniel
Shuang He Jan. 31, 2015, 10:42 p.m. UTC | #5
Tested-By: PRC QA PRTS (Patch Regression Test System Contact: shuang.he@intel.com)
Task id: 5684
-------------------------------------Summary-------------------------------------
Platform          Delta          drm-intel-nightly          Series Applied
PNV                                  353/353              353/353
ILK                                  200/200              200/200
SNB                                  400/422              400/422
IVB              +2                 485/487              487/487
BYT                                  296/296              296/296
HSW              +1                 507/508              508/508
BDW                 -2              401/402              399/402
-------------------------------------Detailed-------------------------------------
Platform  Test                                drm-intel-nightly          Series Applied
 IVB  igt_gem_pwrite_pread_snooped-pwrite-blt-cpu_mmap-performance      DMESG_WARN(6, M34M21)PASS(8, M4M34)      PASS(1, M4)
 IVB  igt_gem_storedw_batches_loop_normal      DMESG_WARN(5, M34M4)PASS(15, M34M4M21)      PASS(1, M4)
 HSW  igt_gem_pwrite_pread_snooped-pwrite-blt-cpu_mmap-performance      DMESG_WARN(1, M40)PASS(18, M40M20)      PASS(1, M20)
 BDW  igt_gem_pwrite_pread_display-pwrite-blt-gtt_mmap-performance      DMESG_WARN(4, M28)PASS(2, M30)      DMESG_WARN(1, M28)
*BDW  igt_gem_pwrite_pread_uncached-pwrite-blt-gtt_mmap-performance      PASS(6, M30M28)      DMESG_WARN(1, M28)
Note: You need to pay more attention to line start with '*'
diff mbox

Patch

diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c
index 70e449b..a94346f 100644
--- a/drivers/gpu/drm/i915/intel_lrc.c
+++ b/drivers/gpu/drm/i915/intel_lrc.c
@@ -732,8 +732,8 @@  void intel_execlists_retire_requests(struct intel_engine_cs *ring)
 			intel_lr_context_unpin(ring, ctx);
 		intel_runtime_pm_put(dev_priv);
 		i915_gem_context_unreference(ctx);
-		i915_gem_request_unreference(req);
 		list_del(&req->execlist_link);
+		i915_gem_request_unreference(req);
 	}
 }