From patchwork Mon Sep 14 11:00:19 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Nikunj A. Dadhania" X-Patchwork-Id: 11775705 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id EE4316CA for ; Tue, 15 Sep 2020 07:08:02 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id D07B1218AC for ; Tue, 15 Sep 2020 07:08:02 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D07B1218AC Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.intel.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id D8C3F6E856; Tue, 15 Sep 2020 07:07:22 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by gabe.freedesktop.org (Postfix) with ESMTPS id 315526E428; Mon, 14 Sep 2020 11:02:37 +0000 (UTC) IronPort-SDR: ZjqAEiipFNA+06v0XBFeR4HVVvGotQg3SCmj9Oeuz8r/BL/5s3eN1yatwyCOqj4n/1ysSb74gm R0O1nattIRWA== X-IronPort-AV: E=McAfee;i="6000,8403,9743"; a="159991531" X-IronPort-AV: E=Sophos;i="5.76,425,1592895600"; d="scan'208";a="159991531" X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 14 Sep 2020 04:02:36 -0700 IronPort-SDR: /iK8HJSqSkiYu26QpgO2Bsa6RFRSPseDdqZgVCXQ8UFbhmxP5IIRHEi2arIyIDptiMnwVy2ydr me/9ChXlQqsA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.76,425,1592895600"; d="scan'208";a="408825940" Received: from unknown (HELO ndadhani-NUC7i5BNKP.iind.intel.com) ([10.223.165.84]) by fmsmga001.fm.intel.com with ESMTP; 14 Sep 2020 04:02:33 -0700 From: "Nikunj A. Dadhania" To: intel-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org, chris@chris-wilson.co.uk, Jani Nikula , Joonas Lahtinen , Rodrigo Vivi , David Airlie , Daniel Vetter Subject: [PATCH] drm/i915: Fix the race between the GEM close and debugfs Date: Mon, 14 Sep 2020 16:30:19 +0530 Message-Id: <20200914110019.18613-1-nikunj.dadhania@linux.intel.com> X-Mailer: git-send-email 2.17.1 X-Mailman-Approved-At: Tue, 15 Sep 2020 07:07:18 +0000 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: nikunj.dadhania@linux.intel.com MIME-Version: 1.0 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" As we close GEM object and set file_priv to -EBADF which is protected by ctx->mutex, populating the GEM debugfs info is not protected and results in the crash shown below. Make sure to protect the access to file_priv using ctx->mutex to avoid race. BUG: unable to handle page fault for address: ffffffffffffffff RIP: 0010:i915_gem_object_info+0x26b/0x3eb Code: 89 44 24 48 48 89 44 24 40 48 89 44 24 38 48 89 44 24 30 48 89 44 24 28 48 89 44 24 20 49 8b 46 f0 48 89 44 24 20 49 8b 46 a0 <48> 8b 58 08 b9 0a 00 00 00 48 b8 aa aa aa aa aa aa aa aa 48 8d bc RSP: 0018:ffffac81c14cfc30 EFLAGS: 00010246 RAX: fffffffffffffff7 RBX: ffff95094429c218 RCX: ffff95096756c740 RDX: 0000000000000000 RSI: ffffffff919b93ee RDI: ffff95094429c218 RBP: ffffac81c14cfd58 R08: ffff9509746fab80 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff9509753f8e80 R13: ffffac81c14cfc98 R14: ffff95094429c268 R15: ffffac81c14cfc88 FS: 00007a1bdcd52900(0000) GS:ffff950977e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffff CR3: 000000026b4e0000 CR4: 0000000000340ef0 Call Trace: seq_read+0x162/0x3ca full_proxy_read+0x5b/0x8d __vfs_read+0x45/0x1b9 vfs_read+0xc9/0x15e ksys_read+0x7e/0xde do_syscall_64+0x54/0x7e entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7a1bdd34cf03 Signed-off-by: Nikunj A. Dadhania --- drivers/gpu/drm/i915/i915_debugfs.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c index 784219962193..ea469168cd44 100644 --- a/drivers/gpu/drm/i915/i915_debugfs.c +++ b/drivers/gpu/drm/i915/i915_debugfs.c @@ -326,6 +326,7 @@ static void print_context_stats(struct seq_file *m, } i915_gem_context_unlock_engines(ctx); + mutex_lock(&ctx->mutex); if (!IS_ERR_OR_NULL(ctx->file_priv)) { struct file_stats stats = { .vm = rcu_access_pointer(ctx->vm), @@ -346,6 +347,7 @@ static void print_context_stats(struct seq_file *m, print_file_stats(m, name, stats); } + mutex_unlock(&ctx->mutex); spin_lock(&i915->gem.contexts.lock); list_safe_reset_next(ctx, cn, link);