i915_vma_reopen checked if the vma is closed before without taking the lock. So multiple threads could attempt removing the vma.
Instead the lock needs to be taken before actually checking.
Cc: Chris Wilson chris@chris-wilson.co.uk Cc: intel-gfx@lists.freedesktop.org Cc: dri-devel@lists.freedesktop.org Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/5732 Signed-off-by: Karol Herbst kherbst@redhat.com --- drivers/gpu/drm/i915/i915_vma.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/i915/i915_vma.c b/drivers/gpu/drm/i915/i915_vma.c index 162e8d83691b..bb3b6e4bee8b 100644 --- a/drivers/gpu/drm/i915/i915_vma.c +++ b/drivers/gpu/drm/i915/i915_vma.c @@ -1615,17 +1615,17 @@ void i915_vma_close(struct i915_vma *vma)
static void __i915_vma_remove_closed(struct i915_vma *vma) { - struct intel_gt *gt = vma->vm->gt; - - spin_lock_irq(>->closed_lock); list_del_init(&vma->closed_link); - spin_unlock_irq(>->closed_lock); }
void i915_vma_reopen(struct i915_vma *vma) { + struct intel_gt *gt = vma->vm->gt; + + spin_lock_irq(>->closed_lock); if (i915_vma_is_closed(vma)) __i915_vma_remove_closed(vma); + spin_unlock_irq(>->closed_lock); }
static void force_unbind(struct i915_vma *vma) @@ -1651,7 +1651,11 @@ static void release_references(struct i915_vma *vma, bool vm_ddestroy)
spin_unlock(&obj->vma.lock);
+ struct intel_gt *gt = vma->vm->gt; + + spin_lock_irq(>->closed_lock); __i915_vma_remove_closed(vma); + spin_unlock_irq(>->closed_lock);
if (vm_ddestroy) i915_vm_resv_put(vma->vm);
Hi Karol,
I love your patch! Perhaps something to improve:
[auto build test WARNING on drm-tip/drm-tip] [also build test WARNING on linus/master v5.18-rc3 next-20220419] [cannot apply to drm-intel/for-linux-next linux/master] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch]
url: https://github.com/intel-lab-lkp/linux/commits/Karol-Herbst/drm-i915-Fix-rac... base: git://anongit.freedesktop.org/drm/drm-tip drm-tip config: x86_64-randconfig-a011 (https://download.01.org/0day-ci/archive/20220420/202204201422.5Bu5aV2Z-lkp@i...) compiler: gcc-11 (Debian 11.2.0-20) 11.2.0 reproduce (this is a W=1 build): # https://github.com/intel-lab-lkp/linux/commit/50a17180127b7d2527ee9a8f5c9e82... git remote add linux-review https://github.com/intel-lab-lkp/linux git fetch --no-tags linux-review Karol-Herbst/drm-i915-Fix-race-in-__i915_vma_remove_closed/20220420-074525 git checkout 50a17180127b7d2527ee9a8f5c9e8207e158afb6 # save the config file mkdir build_dir && cp config build_dir/.config make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash drivers/gpu/drm/i915/
If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot lkp@intel.com
All warnings (new ones prefixed by >>):
drivers/gpu/drm/i915/i915_vma.c: In function 'release_references':
drivers/gpu/drm/i915/i915_vma.c:1654:9: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
1654 | struct intel_gt *gt = vma->vm->gt; | ^~~~~~
vim +1654 drivers/gpu/drm/i915/i915_vma.c
1640 1641 static void release_references(struct i915_vma *vma, bool vm_ddestroy) 1642 { 1643 struct drm_i915_gem_object *obj = vma->obj; 1644 1645 GEM_BUG_ON(i915_vma_is_active(vma)); 1646 1647 spin_lock(&obj->vma.lock); 1648 list_del(&vma->obj_link); 1649 if (!RB_EMPTY_NODE(&vma->obj_node)) 1650 rb_erase(&vma->obj_node, &obj->vma.tree); 1651 1652 spin_unlock(&obj->vma.lock); 1653
1654 struct intel_gt *gt = vma->vm->gt;
1655 1656 spin_lock_irq(>->closed_lock); 1657 __i915_vma_remove_closed(vma); 1658 spin_unlock_irq(>->closed_lock); 1659 1660 if (vm_ddestroy) 1661 i915_vm_resv_put(vma->vm); 1662 1663 i915_active_fini(&vma->active); 1664 GEM_WARN_ON(vma->resource); 1665 i915_vma_free(vma); 1666 } 1667
Hi Karol,
I love your patch! Perhaps something to improve:
[auto build test WARNING on drm-tip/drm-tip] [also build test WARNING on linus/master v5.18-rc3 next-20220419] [cannot apply to drm-intel/for-linux-next linux/master] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch]
url: https://github.com/intel-lab-lkp/linux/commits/Karol-Herbst/drm-i915-Fix-rac... base: git://anongit.freedesktop.org/drm/drm-tip drm-tip config: i386-randconfig-a013 (https://download.01.org/0day-ci/archive/20220420/202204201724.hgR7L8YU-lkp@i...) compiler: clang version 15.0.0 (https://github.com/llvm/llvm-project bac6cd5bf85669e3376610cfc4c4f9ca015e7b9b) reproduce (this is a W=1 build): wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # https://github.com/intel-lab-lkp/linux/commit/50a17180127b7d2527ee9a8f5c9e82... git remote add linux-review https://github.com/intel-lab-lkp/linux git fetch --no-tags linux-review Karol-Herbst/drm-i915-Fix-race-in-__i915_vma_remove_closed/20220420-074525 git checkout 50a17180127b7d2527ee9a8f5c9e8207e158afb6 # save the config file mkdir build_dir && cp config build_dir/.config COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=i386 SHELL=/bin/bash drivers/gpu/drm/i915/
If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot lkp@intel.com
All warnings (new ones prefixed by >>):
drivers/gpu/drm/i915/i915_vma.c:1654:19: warning: mixing declarations and code is incompatible with standards before C99 [-Wdeclaration-after-statement]
struct intel_gt *gt = vma->vm->gt; ^ 1 warning generated.
vim +1654 drivers/gpu/drm/i915/i915_vma.c
1640 1641 static void release_references(struct i915_vma *vma, bool vm_ddestroy) 1642 { 1643 struct drm_i915_gem_object *obj = vma->obj; 1644 1645 GEM_BUG_ON(i915_vma_is_active(vma)); 1646 1647 spin_lock(&obj->vma.lock); 1648 list_del(&vma->obj_link); 1649 if (!RB_EMPTY_NODE(&vma->obj_node)) 1650 rb_erase(&vma->obj_node, &obj->vma.tree); 1651 1652 spin_unlock(&obj->vma.lock); 1653
1654 struct intel_gt *gt = vma->vm->gt;
1655 1656 spin_lock_irq(>->closed_lock); 1657 __i915_vma_remove_closed(vma); 1658 spin_unlock_irq(>->closed_lock); 1659 1660 if (vm_ddestroy) 1661 i915_vm_resv_put(vma->vm); 1662 1663 i915_active_fini(&vma->active); 1664 GEM_WARN_ON(vma->resource); 1665 i915_vma_free(vma); 1666 } 1667
Hi Karol,
I love your patch! Yet something to improve:
[auto build test ERROR on drm-tip/drm-tip] [also build test ERROR on linus/master v5.18-rc3 next-20220420] [cannot apply to drm-intel/for-linux-next linux/master] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch]
url: https://github.com/intel-lab-lkp/linux/commits/Karol-Herbst/drm-i915-Fix-rac... base: git://anongit.freedesktop.org/drm/drm-tip drm-tip config: x86_64-randconfig-c002 (https://download.01.org/0day-ci/archive/20220420/202204201854.2R6j6WjR-lkp@i...) compiler: gcc-11 (Debian 11.2.0-20) 11.2.0 reproduce (this is a W=1 build): # https://github.com/intel-lab-lkp/linux/commit/50a17180127b7d2527ee9a8f5c9e82... git remote add linux-review https://github.com/intel-lab-lkp/linux git fetch --no-tags linux-review Karol-Herbst/drm-i915-Fix-race-in-__i915_vma_remove_closed/20220420-074525 git checkout 50a17180127b7d2527ee9a8f5c9e8207e158afb6 # save the config file mkdir build_dir && cp config build_dir/.config make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash drivers/gpu/drm/i915/
If you fix the issue, kindly add following tag as appropriate Reported-by: kernel test robot lkp@intel.com
All errors (new ones prefixed by >>):
drivers/gpu/drm/i915/i915_vma.c: In function 'release_references':
drivers/gpu/drm/i915/i915_vma.c:1654:9: error: ISO C90 forbids mixed declarations and code [-Werror=declaration-after-statement]
1654 | struct intel_gt *gt = vma->vm->gt; | ^~~~~~ cc1: all warnings being treated as errors
vim +1654 drivers/gpu/drm/i915/i915_vma.c
1640 1641 static void release_references(struct i915_vma *vma, bool vm_ddestroy) 1642 { 1643 struct drm_i915_gem_object *obj = vma->obj; 1644 1645 GEM_BUG_ON(i915_vma_is_active(vma)); 1646 1647 spin_lock(&obj->vma.lock); 1648 list_del(&vma->obj_link); 1649 if (!RB_EMPTY_NODE(&vma->obj_node)) 1650 rb_erase(&vma->obj_node, &obj->vma.tree); 1651 1652 spin_unlock(&obj->vma.lock); 1653
1654 struct intel_gt *gt = vma->vm->gt;
1655 1656 spin_lock_irq(>->closed_lock); 1657 __i915_vma_remove_closed(vma); 1658 spin_unlock_irq(>->closed_lock); 1659 1660 if (vm_ddestroy) 1661 i915_vm_resv_put(vma->vm); 1662 1663 i915_active_fini(&vma->active); 1664 GEM_WARN_ON(vma->resource); 1665 i915_vma_free(vma); 1666 } 1667
dri-devel@lists.freedesktop.org
-
Karol Herbst -
kernel test robot