From patchwork Mon Jan 7 17:41:46 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Kazlauskas, Nicholas" X-Patchwork-Id: 10750939 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 090A66C5 for ; Mon, 7 Jan 2019 17:42:11 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EDB071FE84 for ; Mon, 7 Jan 2019 17:42:10 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E19FC28949; Mon, 7 Jan 2019 17:42:10 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAD_ENC_HEADER,BAYES_00, MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 5E7671FE84 for ; Mon, 7 Jan 2019 17:42:10 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id D520D6E8A0; Mon, 7 Jan 2019 17:42:08 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-eopbgr810079.outbound.protection.outlook.com [40.107.81.79]) by gabe.freedesktop.org (Postfix) with ESMTPS id 07DCB6E8A0 for ; Mon, 7 Jan 2019 17:42:07 +0000 (UTC) Received: from BN6PR12CA0048.namprd12.prod.outlook.com (2603:10b6:405:70::34) by MN2PR12MB3487.namprd12.prod.outlook.com (2603:10b6:208:c7::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1495.7; Mon, 7 Jan 2019 17:42:05 +0000 Received: from DM3NAM03FT005.eop-NAM03.prod.protection.outlook.com (2a01:111:f400:7e49::201) by BN6PR12CA0048.outlook.office365.com (2603:10b6:405:70::34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1495.6 via Frontend Transport; Mon, 7 Jan 2019 17:42:05 +0000 Received-SPF: None (protection.outlook.com: amd.com does not designate permitted sender hosts) Received: from SATLEXCHOV02.amd.com (165.204.84.17) by DM3NAM03FT005.mail.protection.outlook.com (10.152.82.143) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.1471.13 via Frontend Transport; Mon, 7 Jan 2019 17:42:05 +0000 Received: from kazbox.amd.com (10.180.168.240) by SATLEXCHOV02.amd.com (10.181.40.72) with Microsoft SMTP Server id 14.3.389.1; Mon, 7 Jan 2019 11:42:03 -0600 From: Nicholas Kazlauskas To: Subject: [PATCH v2] drm: Block fb changes for async plane updates Date: Mon, 7 Jan 2019 12:41:46 -0500 Message-ID: <20190107174146.2947-1-nicholas.kazlauskas@amd.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:165.204.84.17; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10009020)(39860400002)(376002)(136003)(396003)(346002)(2980300002)(428003)(189003)(199004)(81166006)(47776003)(77096007)(8676002)(106466001)(476003)(126002)(305945005)(2616005)(50226002)(81156014)(4326008)(105586002)(53936002)(54906003)(7696005)(51416003)(14444005)(97736004)(53416004)(5660300001)(16586007)(316002)(8936002)(72206003)(68736007)(2906002)(104016004)(2351001)(15650500001)(44832011)(478600001)(48376002)(26005)(486006)(186003)(1076003)(6346003)(336012)(6916009)(36756003)(575784001)(426003)(50466002)(6666004)(356004)(86362001); DIR:OUT; SFP:1101; SCL:1; SRVR:MN2PR12MB3487; H:SATLEXCHOV02.amd.com; FPR:; SPF:None; LANG:en; PTR:InfoDomainNonexistent; MX:1; A:1; X-Microsoft-Exchange-Diagnostics: 1; DM3NAM03FT005; 1:HC2UtzOuoQGAEdf6j+L9VxxYNN8sVCNOzN/7UtqM5WUQAzfilaDnuNP3D2qUdqaPoyhZ57idLJluVmlZx/WjQ6w1qK2BG84wPsVNIzBWZG2u0af6deRdxy1K3N76Q9wT X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 482efbf4-ea49-481d-153a-08d674c7706f X-Microsoft-Antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600109)(711020)(2017052603328)(7153060); SRVR:MN2PR12MB3487; X-Microsoft-Exchange-Diagnostics: 1; MN2PR12MB3487; 3:C2+35R543mOPzFxP6gq2W2RkAsO2GuooY6bg8+i4gZUratf0Ktxer1wN1KvgW7jkOFqICVGKBjkzL6K4MDM2sT5KLj/SwJqeQProdudjuejc1Da9iLbJd6xIEAPIJkPerx172ahQIGRLGPvgSc0JUvXjSeDuWYKmNNI1zHAShANy4xGYTVmE8RMM511HUJAw0cg7nSxacBU991Wje/KFkIxpeKSBQIOaG/1D3Rg3wCQpTh8k0oxqBHk2CC+YwD5QecRrJmukGpsgzuHu6yhEdcOKHsknFpe54ifQWoP217/wqdxGQt6WuYSUk0RqmKOcWrw5wLK6udiV4BkBgA1rtU1EXloz0n9Et00fxBsBwvaB2YyVB9LHTSC4lMomKsQ6; 25:eyx1nci/z/AIHsPoSfo16pw9Hgc5Sv5bYPhRF0CU+o/sflEChTJ79xJbLW5Vexx7ktFNNf8Fn+ocksMOCKDkySrA+xReoR5WnmMePZLSvXyz46LqTJ3y7MP0M9BQ5W2kJg4RBC4XXu42Hv2WxPTrmff8hpbwIDBNW5e4hD7NWoNVmWqUexxksLoAxummUEbFDWDsv4oCrpNQcaQYvAac1JGNCipFsY+eGKtnhQExWp5onTRAYbJS4eGJHKmsSNCSRdv03lE0zWQ7sxczNmMU0NnKW/eGkfqTubvYDTc6zugwR3Sa1Eluckx0/O+dsx5wmljUrBFCNbb9Y/XuCNtp6Q== X-MS-TrafficTypeDiagnostic: MN2PR12MB3487: X-Microsoft-Exchange-Diagnostics: 1; MN2PR12MB3487; 31:jL0YFteyEkwmF5lbQ8qd9+Akhsm7L9QJ0umEXYUvVb/CfhprWWCQkJONg+BoWbRN1VQrRf+SpoQHKQHKIcvrMtYXcw2qjDIt+h6vDfbPPfYIi/gtStNyEmdnKRDgiC7Ge9pB5Xh8dPODqDuP8/yNk6U9uv19JVOhEbdhX/YOWBFQLe3snb3gFY+3M4mOB/l0g6jK1J4QWMHyUGblu6ETXTGLaFjTh+swkJGVoMA/Y8s=; 20:WfLQUCSe3msASM+mcWZfO87a7npsCs3LkftVAxAgTVHR2HEthJOGHRkcngfFJl7nA2rVTu7wZop2Q+iCF09eiM9I5wIyHBS03ILQ0INuh2MXu+BhA+GAVeg/pFaQMmKAqwDeACtH3yZjJAJNC1TOXIHh+TYz7EvRllU7flU+2AGESL1tSaPWF+C0unsq3tn2NIE8NEFzm0H1BSabbOi+7GO64YOo5cKDwwVSzz3Vf3Yg+6Xet8gUEUHoueE+Gg2Jb0+T+kp2ttUolGVnfWiHjcuBF9ttpT74b19OViGf+kUvcr/6588wryIdg4bSkHZTDYUq57ZoYOtSUaG8syY3yUcaxwPIPa3NR5LwTsKLoxeATnEBkP1+1dKvdi0lL/qfAm6eioMyRy2pyGXWnYmvvJP6uA/QzLFi5dqakFlq6tSu/QsOf/ts+QqaRn6t0UsYTs4Di9R+Dg+avwXAUw9+NpcktC31qnRTb8UBu2DZFsMvx0FPl1BMv1aj5+TUM056 X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(8211001083)(3230021)(908002)(999002)(5005026)(6040522)(8220060)(2401047)(8121501046)(10201501046)(3002001)(3231475)(944501520)(52105112)(93006095)(93003095)(6055026)(6041310)(20161123564045)(20161123562045)(20161123560045)(20161123558120)(201703131423095)(201702281528075)(20161123555045)(201703061421075)(201703061406153)(201708071742011)(7699051)(76991095); SRVR:MN2PR12MB3487; BCL:0; PCL:0; RULEID:; SRVR:MN2PR12MB3487; X-Microsoft-Exchange-Diagnostics: 1; MN2PR12MB3487; 4:w+2BBnT3osR1zpS9o1s1ZLbg3EEdS2Uxq1O1AfvLaUFcavT8dcOsji2g3eAaT6RYF91wGidQjazhKUFNo3pJG9zkYL+JBqfZ2CEt7TA/PrapSXsHZZjZNaQKiEk/1BAiEJhDcOBT3rCnetnbTvW4QsvRdlq/h+zO0bD9vEUgH9DItqFyo08yOHTWzaeOUak+ktieQCFkbyCR7IcT7AvFDyw+hVANVBcRm7tnLuy1P5CJwUFA6oxorGHmagT70GM4bj0B2aoCtwK4o9hTk62UzWsRI3/FRtyTF7PbRO1HB9885hZ43IcfvkRQIY5CtW4v X-Forefront-PRVS: 0910AAF391 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; MN2PR12MB3487; 23:lNJvTDGlCH9aos1mEu5h90JyVZWPS9EM2iJHlxTyJ?= CxP2GRWWqWflMkpAGpMx/BxsG8tE5ZDJt7EkWZhtWO1bQFTreU+irdSUlMWzJNGuky/yCL73deawRa0kl44FkNSfqXjblYK/u4Riab3fdKMxlkp587wHiPGj5FgmZiSl3MjmyHBloV5y8B9m61zVAFNmJ78++Y+xl9wbLMsVg7qZJKZh1RtTvzT6mpvrcCOVgl1eJLbEblFbzZzksxJAJEcBgWhqM/HMjoU2nQFStkfVFvk9ss7TIia89J+CpwJzy49B1DbLzAERVl8C9tn4RwLKWU1M0j8Ya9pvNX7/6U0+LX90k0RzzL2sZlUf8YahC7EEu+tRkGYS7O6FHhJf3I2drGeEjmQawf40MCYmJLP9KDFoy+7LQR5w7tz9JUC5aT0VQN31JrcR0KTao+4MUAtZg1m3zWwyjzyblAq6uBr7Jn/hVSuDHeJyWHv4OXQdtcnk8dJZ5NaLI5WUPcd68Kslhoby9ykxN62xfALYbQgWQGXo550GxfJ/N/SaQGp6ZDtd9e+cfU4TFENlc1AZEUeJHFLWrgTKoHmW9/MP7PC+sdsFeji+R+uYQQhlf1ybstt8XhNV3N5zq7/rn9piruEl+eBthF8tLn5jSr4E6IP8wRuHaTRRAZUGq2oqBj/oXUbn3/0/nBOD8Xer01UJxgBDKXUPmIu4x5ZKsBwZ8yBbX0/grmdQ45v5ymxDp9BStj0X5cFnBy5Q3gNM8zfvAgyu24jF2h6t9V+tv6GcRArBQ+1IhlzRYK+WvJNCeEkj3a/KXJcoqBXPFW5aBF7LOGjqMI41JWPKyG9FCM/YxaYOcWNRcas/NqzEJXXjf+7qhi4ZsA3mk7T3GiLLXH9F108ZcPTU6CfAI3e2gEpP65jwLpEpGHqTTDcq1LmY8GpJxJNWpKEt8DS2kMOKSqyWowpjRdc8nY2lrURUAMSC8XUvJcRsY03aJCZBYVXS18lkDcOM6lXwAQibBeyncUdput8yT1gueojywQuYJumN3Hzzq8WY7uOJ78BoASjiVJsgnoc9aeVg1Ke6N9h+G/YbREw9wfc3MCwcBG+nLC1GBYFJIKsE64EFtCYgB09hRCxVdQefKKSHmex9MnCxuD0YzVHX39h8swRHjiBFk4pgSsxpDgCUl7ZHnq5rAmiGp5g2G6yufr2IU7wPyVzdvA9YTAWrcfo5HMjQSP3WXl7rtecPg4kiBBx0KbWia+nQShDH5Y= X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Message-Info: xNxE6WSVS0or7/+nrfOOOJ+4PZnoVLSg7nfWGzjVNKUlGtJvgg6upf1j7IWs2Okj9pg3tnkhj2ReMrL8dGYCLacIPqglXpulbOfaCxLX+L9o+ocfF0Av8v3wZJ32Rli8gw5KWWMN8JCrDxQFmkYlQKLG/SwlE5xjjXE8ITWGR9XUfPF3nol3YN02RUeEL7GSrungle4Z6H97MZJg1ekgnDfzi2eHyccvviILEEmdUu/2+HBNT/4j9QdbMINjat+N439xMeh+i7UZGuj2loRrTdwnA+wA0fJc5uinINJzT5y/oD4BWPFGHnv8TBXKD3Jy X-Microsoft-Exchange-Diagnostics: 1; MN2PR12MB3487; 6:a1AXaLipl9Ao4zki6AeXiSg3Hpq5HVk9f6yvPbWUVdLisd/zC1Jn8oj/KmqLda3AncMQoQ2VUBRxkmcKOvtHKLavjzxEAyc8EuCIy3AHQfyMQ8LRYn/HKY2sIziiZ0wtPkg1C6Dq/mY4uWWgtQPy4eyHKahNT6hr8s5HNBVI8T/5FV4tBsOmyO6rwCpqeMhr6Q8/TzssRR2iYdl6ktuhC5nhm5TahRXSE2U1Nf9UHmt7DWff52dNCCVfuGD+mSGn5k6MSAk7HkHI40yXHEPRi3STcqPmoXoFWybMC1g2WRaTDLqusxRl4QkTk6WuPUlDV22HYwv79zO7yom5RvYM5jj5fFXneQQkTehUPUqkh6R4zJngUNE2oiJmiox4eixhiJqrH73haVcifKmclHhk0CiyVDjq0w7vpmIoh9ZxqvIBlMpcSUgVbpU7xTtHTi64VgAAnx0HinTHhfG1vLcCTw==; 5:w29ijdbr1Ucl+l5szmzyjD5XxztuUUWWxtJim3VNZVB/p/gxAS30/YkDvRAnEejFEcyfXHiqy2O+bPCz9JZHHuC3lSV+UXPELXVXw7BzRbboLJBRg+G+JxZZgHP16tfWr2b+yK2NEnQD2TqQWgpJr9U8kMcXAWvs+Xevvqy7Ehp6fWKPEAAdMONZtrZDYb2nTzZNNf0vIbHuYzlEZWPHrw==; 7:8BlGGLB0Z4gxBHXzUboxDfHNFndldBUhG2CnC4uxiJGwJhxcjDEdHI+7dHhT0BgmuqY5R+PvW+z5KClAVyaDerOpH1Fn5lzmSp1WtUCY6S6m8IipUq0jODEuQAM9Cx7Z5oL1K9LnLD4H3WRpTlw9yQ== SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1; MN2PR12MB3487; 20:Y0+LU1PuglXsA2o76fsY69YdEcqpwNwUrHTES6BBjGohxKxpQbufp7PY7bp65t1xHBzASaOEpG12QO7UdfI+kmTz5YGxPSl1g/R8Am8w55aOnP5jGYDwtENhI0lHGDxFhe3CKx3k3GAeewfPVAmbUOPl8/juqiaTvMf/PzQ80MbkTuZAZsjOV4JfUvOIHSR/aeqOcQUT4np3qo0tgR5NXsQobJj6V1xZLz4sPTnJ4F84+GbBGhrdlcv92nbRl9/k X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Jan 2019 17:42:05.0802 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 482efbf4-ea49-481d-153a-08d674c7706f X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d; Ip=[165.204.84.17]; Helo=[SATLEXCHOV02.amd.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR12MB3487 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Daniel Vetter , Nicholas Kazlauskas , stable@vger.kernel.org Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP The prepare_fb call always happens on new_plane_state. The drm_atomic_helper_cleanup_planes checks to see if plane state pointer has changed when deciding to call cleanup_fb on either the new_plane_state or the old_plane_state. For a non-async atomic commit the state pointer is swapped, so this helper calls prepare_fb on the new_plane_state and cleanup_fb on the old_plane_state. This makes sense, since we want to prepare the framebuffer we are going to use and cleanup the the framebuffer we are no longer using. For the async atomic update helpers this differs. The async atomic update helpers perform in-place updates on the existing state. They call drm_atomic_helper_cleanup_planes but the state pointer is not swapped. This means that prepare_fb is called on the new_plane_state and cleanup_fb is called on the new_plane_state (not the old). In the case where old_plane_state->fb == new_plane_state->fb then there should be no behavioral difference between an async update and a non-async commit. But there are issues that arise when old_plane_state->fb != new_plane_state->fb. The first is that the new_plane_state->fb is immediately cleaned up after it has been prepared, so we're using a fb that we shouldn't be. The second occurs during a sequence of async atomic updates and non-async regular atomic commits. Suppose there are two framebuffers being interleaved in a double-buffering scenario, fb1 and fb2: - Async update, oldfb = NULL, newfb = fb1, prepare fb1, cleanup fb1 - Async update, oldfb = fb1, newfb = fb2, prepare fb2, cleanup fb2 - Non-async commit, oldfb = fb2, newfb = fb1, prepare fb1, cleanup fb2 We call cleanup_fb on fb2 twice in this example scenario, and any further use will result in use-after-free. The simple fix to this problem is to block framebuffer changes in the drm_atomic_helper_async_check function for now. Cc: Daniel Vetter Cc: Harry Wentland Cc: Andrey Grodzovsky Cc: # v4.14+ Fixes: fef9df8b5945 ("drm/atomic: initial support for asynchronous plane update") Signed-off-by: Nicholas Kazlauskas --- drivers/gpu/drm/drm_atomic_helper.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c index 54e2ae614dcc..f4290f6b0c38 100644 --- a/drivers/gpu/drm/drm_atomic_helper.c +++ b/drivers/gpu/drm/drm_atomic_helper.c @@ -1602,6 +1602,15 @@ int drm_atomic_helper_async_check(struct drm_device *dev, old_plane_state->crtc != new_plane_state->crtc) return -EINVAL; + /* + * FIXME: Since prepare_fb and cleanup_fb are always called on + * the new_plane_state for async updates we need to block framebuffer + * changes. This prevents use of a fb that's been cleaned up and + * double cleanups from occuring. + */ + if (old_plane_state->fb != new_plane_state->fb) + return -EINVAL; + funcs = plane->helper_private; if (!funcs->atomic_async_update) return -EINVAL;