Re: [Intel-gfx] [PATCH] drm/i915: fix use-after-free in page_flip_completed()
On Thu, Jan 26, 2017 at 02:46:20PM +, Chris Wilson wrote: > On Thu, Jan 26, 2017 at 05:32:11PM +0300, Andrey Ryabinin wrote: > > page_flip_completed() dereferences 'work' variable after executing > > queue_work(). This is not safe as the 'work' item might be already freed > > by queued work: > > > > BUG: KASAN: use-after-free in page_flip_completed+0x3ff/0x490 at addr > > 8803dc010f90 > > Call Trace: > > __asan_report_load8_noabort+0x59/0x80 > > page_flip_completed+0x3ff/0x490 > > intel_finish_page_flip_mmio+0xe3/0x130 > > intel_pipe_handle_vblank+0x2d/0x40 > > gen8_irq_handler+0x4a7/0xed0 > > __handle_irq_event_percpu+0xf6/0x860 > > handle_irq_event_percpu+0x6b/0x160 > > handle_irq_event+0xc7/0x1b0 > > handle_edge_irq+0x1f4/0xa50 > > handle_irq+0x41/0x70 > > do_IRQ+0x9a/0x200 > > common_interrupt+0x89/0x89 > > > > Freed: > > kfree+0x113/0x4d0 > > intel_unpin_work_fn+0x29a/0x3b0 > > process_one_work+0x79e/0x1b70 > > worker_thread+0x611/0x1460 > > kthread+0x241/0x3a0 > > ret_from_fork+0x27/0x40 > > > > Move queue_work() after trace_i915_flip_complete() to fix this. > > > > Fixes: e5510fac98a7 ("drm/i915: add tracepoints for flip requests & > > completions") > > Signed-off-by: Andrey Ryabinin > > That's old, and indeed does seem to be present from that commit and not > exposed by something later. > > Cc: # v2.6.36+ > Reviewed-by: Chris Wilson Applied, thanks for patch&review. -Daniel -- Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch
Re: [PATCH] drm/i915: fix use-after-free in page_flip_completed()
On Thu, Jan 26, 2017 at 05:32:11PM +0300, Andrey Ryabinin wrote: > page_flip_completed() dereferences 'work' variable after executing > queue_work(). This is not safe as the 'work' item might be already freed > by queued work: > > BUG: KASAN: use-after-free in page_flip_completed+0x3ff/0x490 at addr > 8803dc010f90 > Call Trace: > __asan_report_load8_noabort+0x59/0x80 > page_flip_completed+0x3ff/0x490 > intel_finish_page_flip_mmio+0xe3/0x130 > intel_pipe_handle_vblank+0x2d/0x40 > gen8_irq_handler+0x4a7/0xed0 > __handle_irq_event_percpu+0xf6/0x860 > handle_irq_event_percpu+0x6b/0x160 > handle_irq_event+0xc7/0x1b0 > handle_edge_irq+0x1f4/0xa50 > handle_irq+0x41/0x70 > do_IRQ+0x9a/0x200 > common_interrupt+0x89/0x89 > > Freed: > kfree+0x113/0x4d0 > intel_unpin_work_fn+0x29a/0x3b0 > process_one_work+0x79e/0x1b70 > worker_thread+0x611/0x1460 > kthread+0x241/0x3a0 > ret_from_fork+0x27/0x40 > > Move queue_work() after trace_i915_flip_complete() to fix this. > > Fixes: e5510fac98a7 ("drm/i915: add tracepoints for flip requests & > completions") > Signed-off-by: Andrey Ryabinin That's old, and indeed does seem to be present from that commit and not exposed by something later. Cc: # v2.6.36+ Reviewed-by: Chris Wilson -Chris -- Chris Wilson, Intel Open Source Technology Centre
[PATCH] drm/i915: fix use-after-free in page_flip_completed()
page_flip_completed() dereferences 'work' variable after executing queue_work(). This is not safe as the 'work' item might be already freed by queued work: BUG: KASAN: use-after-free in page_flip_completed+0x3ff/0x490 at addr 8803dc010f90 Call Trace: __asan_report_load8_noabort+0x59/0x80 page_flip_completed+0x3ff/0x490 intel_finish_page_flip_mmio+0xe3/0x130 intel_pipe_handle_vblank+0x2d/0x40 gen8_irq_handler+0x4a7/0xed0 __handle_irq_event_percpu+0xf6/0x860 handle_irq_event_percpu+0x6b/0x160 handle_irq_event+0xc7/0x1b0 handle_edge_irq+0x1f4/0xa50 handle_irq+0x41/0x70 do_IRQ+0x9a/0x200 common_interrupt+0x89/0x89 Freed: kfree+0x113/0x4d0 intel_unpin_work_fn+0x29a/0x3b0 process_one_work+0x79e/0x1b70 worker_thread+0x611/0x1460 kthread+0x241/0x3a0 ret_from_fork+0x27/0x40 Move queue_work() after trace_i915_flip_complete() to fix this. Fixes: e5510fac98a7 ("drm/i915: add tracepoints for flip requests & completions") Signed-off-by: Andrey Ryabinin --- drivers/gpu/drm/i915/intel_display.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c index 8d702cf..f04a95cd 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -4268,10 +4268,10 @@ static void page_flip_completed(struct intel_crtc *intel_crtc) drm_crtc_vblank_put(&intel_crtc->base); wake_up_all(&dev_priv->pending_flip_queue); - queue_work(dev_priv->wq, &work->unpin_work); - trace_i915_flip_complete(intel_crtc->plane, work->pending_flip_obj); + + queue_work(dev_priv->wq, &work->unpin_work); } static int intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc) -- 2.10.2