Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <b9eb015b-6ba4-f980-17f1-db4921cefccc@amd.com>
Date:   Thu, 22 Jun 2023 14:26:15 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.11.0
Subject: Re: [PATCH 1/4] drm/ttm: Fix ttm_lru_bulk_move_pos_tail()
Content-Language: en-US
To:     =?UTF-8?Q?Thomas_Hellstr=c3=b6m?= 
        <thomas.hellstrom@linux.intel.com>, intel-xe@lists.freedesktop.org
Cc:     =?UTF-8?Q?Christian_K=c3=b6nig?= <ckoenig.leichtzumerken@gmail.com>,
        Daniel Vetter <daniel.vetter@ffwll.ch>,
        dri-devel@lists.freedesktop.org, stable@vger.kernel.org,
        intel-gfx@lists.freedesktop.org, linux-kernel@vger.kernel.org
References: <20230622101412.78426-1-thomas.hellstrom@linux.intel.com>
 <20230622101412.78426-2-thomas.hellstrom@linux.intel.com>
From:   =?UTF-8?Q?Christian_K=c3=b6nig?= <christian.koenig@amd.com>
In-Reply-To: <20230622101412.78426-2-thomas.hellstrom@linux.intel.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?bG8vaFpER3hFTWJmbU83ZjlhdVMzSjE4aTA3a1Rqc2F3NGpmTktpZnNZc0hr?=
 =?utf-8?B?Z0gyeXNlajVHbk5mTWVyWFluK1Q1dUczZWFrMkc1UUYvREMrL0RZV3k5b0Mw?=
 =?utf-8?B?TzR2Qlk0NlZGZ3NkMEZ0MUFqY1JreDhkamwvWUJSdkJLRUYyeHBwYXBVY2Vi?=
 =?utf-8?B?WThxTXNMQlRDQzl4azFoaWYxUU94VVRSV0lwankzeTVEMUthUWJ1Z2Q3WjlX?=
 =?utf-8?B?dFFSSm9HaXFON2tIeHBoSFNZbjBncitXWFBHZ1BTdUtsSUZxQ2FNd1ROZFZG?=
 =?utf-8?B?U2hGTE5VQVVDdFBhUU9nK2ZpcnBvVVBvU3lvNVd0dytiVFlTU3E1a2tKQ2ta?=
 =?utf-8?B?TVNZYTZhMDVNS2sxaDRFUitWR1hHRzNQa1lVbkE4QmI0aWl3VkFKOGVWdG5n?=
 =?utf-8?B?eXBQNGtFT1kvd2xJODNjNm02OFpxVTFMRlREdmtEWTNQSC82WnE0TXpVNmlE?=
 =?utf-8?B?L0YyOUczcEpuOCtVSVVxMldYZUZmdUd0WVlNTFo5dkxOSmo0UUNBWVNFZXU5?=
 =?utf-8?B?MDg2K09LZXFEeUNUV2dEd3MwSEFZOEtFc2VoNitqV3E2Z0JPc1VPNk5KcmFq?=
 =?utf-8?B?dm94U05kMmhlOVBjNWZDVHZhZmJiTm02SEczMzBZQ2NTeERWSDRNaEpjQm5C?=
 =?utf-8?B?ZFVUMVlXaVFQcmx6SmUvamFTRCtDWlpPcUVPTzlaYW9kRVpNTmJyblpCWWdr?=
 =?utf-8?B?YkNjcC9ueVNwQWFsVWR6NStDUzRaRGdnMUQ5STc1Zi82T2pCWUg5NkpQWnJl?=
 =?utf-8?B?SERWVktmMXIyUXB0dWpSSktHNSs4ZnoxdVZRVC9ZZjFBU1p4dU5TWHpsczVT?=
 =?utf-8?B?VnBYNmluVFM4V0ZtcTN4MXNaaUJESTJreWtOV0FzUUEvdjJwVGoxTVAzeFVP?=
 =?utf-8?B?K3hGSjNuUXlLMVV3WllGWjI3RjlkdnVhWkFXdlJnOFNQL0NXbnphUUc4d05w?=
 =?utf-8?B?OU94a01QTm9VUURqdUxPZVU5ejZzOFUvWVlrTlFsL1k0UXRSMCtSYm9FYmdo?=
 =?utf-8?B?K2ZrWW9VK01JTG1SOVJpczdtRXdoanhmTDk1VkJYSUhnU1NtR0pjVDRReXBh?=
 =?utf-8?B?RzZOd2UvcmFVTDMwMUMwRlk2R3FidVQ5M2IrNmZKTGdlc3VaSkJmdmZVR0xm?=
 =?utf-8?B?OG9EMVFRNmZob3hLSkxYTmIxVGYyNk9VM0FYZ0JPY3dEZU0rMlN2cEJRdm04?=
 =?utf-8?B?SGFwRFNHcnhFT1hsNkwxeEVoeDd1cHN3UjFwZFVwaTIxOWQ5Y1VIYjFlU2Rk?=
 =?utf-8?B?cHlnZk1Jci9HNFNqQmpJa292L1VHdDhra0dGRGtmM3Y3eXRIZDRQMTFqY0th?=
 =?utf-8?B?NGZRUVNsUllCc2RWdDB4dEE4RnpxalJxMlNPRDhpSW1GelVSdDNnNFA4cWZK?=
 =?utf-8?B?d3ZhaUh5TXVuS2xaVnRobnVkcXhhQk4xU3lnN2pMd3pXc25yM2FBSVZlYnhJ?=
 =?utf-8?B?ZFlJR2c3b3R1SDR2WVZiQmZMSnZ3Nmh0OXNsSlRHdHVKQmdza2M4YnJURUxw?=
 =?utf-8?B?WkFHamhLdzFuRSsxNHBMNHRNOVpNelhORmhLUzd4SDNPVDFOdWNGSXh1TXlL?=
 =?utf-8?B?THpyc09RSDhsNFg3VzE5Zk1sSFpycDNDZEJ6ZklRQzZjQU9DYVF4bTVpZDdv?=
 =?utf-8?B?QjFaRTNpc2UraVUyZ3Zac1h3dmw5bmxwTXlnM2VlNUFLN0JqbUdlRkQ4MVE1?=
 =?utf-8?B?ZEhyUFQweWJEcklPd01GQnorNkdIVk41ODNEUW1LeUZ3aFJLcmF1cnd0Mmp1?=
 =?utf-8?B?Q3c2aFA3L3F6MVA1a3F0V3ZqVE8zbHE0TFQ0N01IUjZrV0haaTFoVmwvMTdD?=
 =?utf-8?B?OE5GeThaWkVVL213QVY3akk5NThGUnN4cTZLd3orUHd3NXBWeTRJdXNEY1p4?=
 =?utf-8?B?RklBSExUZmlZUDVmSHdGSUZ2QWJiLzMyK1hxajRHTU1MMFIyS0FrZnJZWWZH?=
 =?utf-8?B?NUVDVVU0c2oyKzU1dXpsTkhEZzJuUS9YaTN2WVBUejk4UTU4YmNPTkhXVy9C?=
 =?utf-8?B?S2V0R0tPdjlhbmNJL2NYbDRIZlFWUzlpY3RqU2xXbVVac3hEQlRaNm5UZnhK?=
 =?utf-8?B?YVIybzlBa2tBa1B1UjNLWGQ0cllYaXJLZm5BL0tzWmJ5STdibHJoSS9hNGJS?=
 =?utf-8?B?K1RMKzJFUlZNOURQLzZsVzFSd1Vid0F4MmQ5cElCK2p2bDJuMjVIMlpmYXlt?=
 =?utf-8?Q?lFgw457+Svl3xUdubyOS4djWJWDl6UZm5SAjyqpxuU2J?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 48c8fa62-f789-4471-34de-08db731be2de
X-MS-Exchange-CrossTenant-AuthSource: BN8PR12MB3587.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Jun 2023 12:26:21.2903
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: kVPMQgHf0OsYeWUSM1hHvyHRvI2xq9usGPjYapsbWnKCIGjC/s9opg/OFFwhd2D/
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR12MB7861
X-Spam-Status: No, score=-1.2 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FORGED_SPF_HELO,NICE_REPLY_A,
        RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_PASS,SPF_NONE,
        T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Teddy already stumbled over this as well, but this patch here looks better.

Going to review and push it to drm-misc-fixes asap.

Thanks,
Christian.

Am 22.06.23 um 12:14 schrieb Thomas Hellström:
> The value of pos->first was not updated when the first resource of the
> range was moved. This could lead to errors like the one below.
> Fix this by updating pos->first when needed.
>
> <3> [218.963342] BUG: KASAN: null-ptr-deref in ttm_lru_bulk_move_del+0xc5/0x180 [ttm]
> <3> [218.963456] Read of size 8 at addr 0000000000000038 by task xe_evict/1529
> <3> [218.963546]
> <3> [218.963566] CPU: 0 PID: 1529 Comm: xe_evict Not tainted 6.3.0-xe #1
> <3> [218.963664] Hardware name: Intel Corporation Tiger Lake Client Platform/TigerLake H DDR4 SODIMM RVP, BIOS TGLSFWI1.R00.4064.A00.2102041619 02/04/2021
> <3> [218.963841] Call Trace:
> <3> [218.963881]  <TASK>
> <3> [218.963915]  dump_stack_lvl+0x64/0xb0
> <3> [218.963976]  print_report+0x3e5/0x600
> <3> [218.964036]  ? ttm_lru_bulk_move_del+0xc5/0x180 [ttm]
> <3> [218.964127]  kasan_report+0x96/0xc0
> <3> [218.964183]  ? ttm_lru_bulk_move_del+0xc5/0x180 [ttm]
> <3> [218.964276]  ttm_lru_bulk_move_del+0xc5/0x180 [ttm]
> <3> [218.964365]  ttm_bo_set_bulk_move+0x92/0x140 [ttm]
> <3> [218.964454]  xe_gem_object_close+0xc8/0x120 [xe]
> <3> [218.964675]  ? __pfx_xe_gem_object_close+0x10/0x10 [xe]
> <3> [218.964908]  ? drm_gem_object_handle_put_unlocked+0xc7/0x170 [drm]
> <3> [218.965071]  drm_gem_object_release_handle+0x45/0x80 [drm]
> <3> [218.965220]  ? __pfx_drm_gem_object_release_handle+0x10/0x10 [drm]
> <3> [218.965381]  idr_for_each+0xc9/0x180
> <3> [218.965437]  ? __pfx_idr_for_each+0x10/0x10
> <3> [218.965504]  drm_gem_release+0x20/0x30 [drm]
> <3> [218.965637]  drm_file_free.part.0+0x4cb/0x4f0 [drm]
> <3> [218.965778]  ? drm_close_helper.isra.0+0xb7/0xe0 [drm]
> <3> [218.965921]  drm_release_noglobal+0x49/0x90 [drm]
> <3> [218.966061]  __fput+0x122/0x450
> <3> [218.966115]  task_work_run+0xfe/0x190
> <3> [218.966175]  ? __pfx_task_work_run+0x10/0x10
> <3> [218.966239]  ? do_raw_spin_unlock+0xa7/0x140
> <3> [218.966308]  do_exit+0x55f/0x1430
> <3> [218.966364]  ? __pfx_lock_release+0x10/0x10
> <3> [218.966431]  ? do_raw_spin_lock+0x11d/0x1e0
> <3> [218.966498]  ? __pfx_do_exit+0x10/0x10
> <3> [218.966554]  ? __pfx_do_raw_spin_lock+0x10/0x10
> <3> [218.966625]  ? mark_held_locks+0x24/0x90
> <3> [218.966688]  ? lockdep_hardirqs_on_prepare+0x136/0x210
> <3> [218.966768]  do_group_exit+0x68/0x110
> <3> [218.966828]  __x64_sys_exit_group+0x2c/0x30
> <3> [218.966896]  do_syscall_64+0x3c/0x90
> <3> [218.966955]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
> <3> [218.967035] RIP: 0033:0x7f77b194f146
> <3> [218.967094] Code: Unable to access opcode bytes at 0x7f77b194f11c.
> <3> [218.967174] RSP: 002b:00007ffc64791188 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
> <3> [218.967271] RAX: ffffffffffffffda RBX: 00007f77b1a548a0 RCX: 00007f77b194f146
> <3> [218.967364] RDX: 0000000000000062 RSI: 000000000000003c RDI: 0000000000000062
> <3> [218.967458] RBP: 0000000000000062 R08: 00000000000000e7 R09: ffffffffffffff78
> <3> [218.967553] R10: 0000000000000058 R11: 0000000000000246 R12: 00007f77b1a548a0
> <3> [218.967648] R13: 0000000000000003 R14: 00007f77b1a5d2e8 R15: 0000000000000000
> <3> [218.967745]  </TASK>
>
> Fixes: fee2ede15542 ("drm/ttm: rework bulk move handling v5")
> Cc: "Christian König" <christian.koenig@amd.com>
> Cc: "Christian König" <ckoenig.leichtzumerken@gmail.com>
> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> Cc: dri-devel@lists.freedesktop.org
> Cc: <stable@vger.kernel.org> # v5.19+
> Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/411
> Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> ---
>   drivers/gpu/drm/ttm/ttm_resource.c | 2 ++
>   1 file changed, 2 insertions(+)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_resource.c b/drivers/gpu/drm/ttm/ttm_resource.c
> index 7333f7a87a2f..cb05e0a36576 100644
> --- a/drivers/gpu/drm/ttm/ttm_resource.c
> +++ b/drivers/gpu/drm/ttm/ttm_resource.c
> @@ -86,6 +86,8 @@ static void ttm_lru_bulk_move_pos_tail(struct ttm_lru_bulk_move_pos *pos,
>   				       struct ttm_resource *res)
>   {
>   	if (pos->last != res) {
> +		if (pos->first == res)
> +			pos->first = list_next_entry(res, lru);
>   		list_move(&res->lru, &pos->last->lru);
>   		pos->last = res;
>   	}