Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Reply-To: christian.koenig@amd.com
Subject: Re: [PATCH] gpu: drm: drm_mm: Fix a sleep-in-atomic-context bug in
 show_leaks()
To:     Chris Wilson <chris@chris-wilson.co.uk>,
        Jia-Ju Bai <baijiaju1990@gmail.com>, airlied@linux.ie,
        gustavo@padovan.org, maarten.lankhorst@linux.intel.com,
        seanpaul@chromium.org, linux-kernel@vger.kernel.org,
        dri-devel@lists.freedesktop.org,
        Alex Deucher <alexdeucher@gmail.com>,
        amd-gfx@lists.freedesktop.org, David Zhou <David1.Zhou@amd.com>,
        =?UTF-8?Q?Christian_K=c3=b6nig?= <christian.koenig@amd.com>
References: <20180901122041.2357-1-baijiaju1990@gmail.com>
 <153580517420.12034.2035309606925619207@skylake-alporthouse-com>
 <20180903075244.GE21634@phenom.ffwll.local>
From:   =?UTF-8?Q?Christian_K=c3=b6nig?= <ckoenig.leichtzumerken@gmail.com>
Message-ID: <8e811ad1-ed57-0e1c-1b52-df0dc02923dc@gmail.com>
Date:   Mon, 3 Sep 2018 14:05:42 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <20180903075244.GE21634@phenom.ffwll.local>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Am 03.09.2018 um 09:52 schrieb Daniel Vetter:
> On Sat, Sep 01, 2018 at 01:32:54PM +0100, Chris Wilson wrote:
>> Quoting Jia-Ju Bai (2018-09-01 13:20:41)
>>> The driver may sleep with holding a spinlock.
>>>
>>> The function call paths (from bottom to top) in Linux-4.16 are:
>>>
>>> [FUNC] kmalloc(GFP_KERNEL)
>>> drivers/gpu/drm/drm_mm.c, 130:
>>>          kmalloc in show_leaks
>>> drivers/gpu/drm/drm_mm.c, 913:
>>>          show_leaks in drm_mm_takedown
>>> drivers/gpu/drm/drm_vma_manager.c, 107:
>>>          drm_mm_takedown in drm_vma_offset_manager_destroy
>>> drivers/gpu/drm/drm_vma_manager.c, 106:
>>>          _raw_write_lock in drm_vma_offset_manager_destroy
>>>
>>> [FUNC] kmalloc(GFP_KERNEL)
>>> drivers/gpu/drm/drm_mm.c, 130:
>>>          kmalloc in show_leaks
>>> drivers/gpu/drm/drm_mm.c, 913:
>>>          show_leaks in drm_mm_takedown
>>> drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c, 71:
>>>          drm_mm_takedown in amdgpu_vram_mgr_fini
>>> drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c, 70:
>>>          spin_lock in amdgpu_vram_mgr_fini
>>>
>>> [FUNC] kmalloc(GFP_KERNEL)
>>> drivers/gpu/drm/drm_mm.c, 130:
>>>          kmalloc in show_leaks
>>> drivers/gpu/drm/drm_mm.c, 913:
>>>          show_leaks in drm_mm_takedown
>>> drivers/gpu/drm/ttm/ttm_bo_manager.c, 128:
>>>          drm_mm_takedown in ttm_bo_man_takedown
>>> drivers/gpu/drm/ttm/ttm_bo_manager.c, 126:
>>>          spin_lock in ttm_bo_man_takedown
>>>
>>> To fix this bug, GFP_KERNEL is replaced with GFP_ATOMIC.
>> The bug are above, since those spinlocks do not protect the data and
>> imply use-after-free.
> Adding amdgpu, since that's where the bug seems to be.

When we have use after free we might have concurrent uses as well.

I think taking the lock here is probably a good idea if you don't want 
to accidentally access freed memory in show_leaks.

So Chris change sounds valid to me.

Christian.

> -Daniel