linux-kernel - [PATCH v11 09/10] drm/i915/selftest: maintain context ref during reset test

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 13 Jul 2022 14:50:21 +0100
From:   Robert Beckett <bob.beckett@...labora.com>
To:     dri-devel@...ts.freedesktop.org, intel-gfx@...ts.freedesktop.org,
        Jani Nikula <jani.nikula@...ux.intel.com>,
        Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>,
        Rodrigo Vivi <rodrigo.vivi@...el.com>,
        Tvrtko Ursulin <tvrtko.ursulin@...ux.intel.com>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>
Cc:     kernel@...labora.com, Robert Beckett <bob.beckett@...labora.com>,
        Matthew Auld <matthew.auld@...el.com>,
        Thomas Hellström 
        <thomas.hellstrom@...ux.intel.com>, linux-kernel@...r.kernel.org
Subject: [PATCH v11 09/10] drm/i915/selftest: maintain context ref during reset test

Commit "bcb9aa45d5a0 Revert "drm/i915: Hold reference to intel_context over life of i915_request""
Stopped requests from maintaining a ref on the context.
This caused the contexts to be freed, releasing stolen memory while
under test, leading to false positive detection of stolen corruption.
Fix this by maintaining a ref on the contexts until testing is complete.

Signed-off-by: Robert Beckett <bob.beckett@...labora.com>
---
 drivers/gpu/drm/i915/gt/selftest_reset.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/i915/gt/selftest_reset.c b/drivers/gpu/drm/i915/gt/selftest_reset.c
index 55f3b34e5f6e..ba536e8a2e32 100644
--- a/drivers/gpu/drm/i915/gt/selftest_reset.c
+++ b/drivers/gpu/drm/i915/gt/selftest_reset.c
@@ -6,6 +6,7 @@
 #include <linux/crc32.h>
 
 #include "gem/i915_gem_stolen.h"
+#include "gt/intel_gt.h"
 
 #include "i915_memcpy.h"
 #include "i915_selftest.h"
@@ -26,6 +27,7 @@ __igt_reset_stolen(struct intel_gt *gt,
 	intel_wakeref_t wakeref;
 	enum intel_engine_id id;
 	struct igt_spinner spin;
+	struct intel_context *contexts[I915_NUM_ENGINES] = {0};
 	long max, count;
 	void *tmp;
 	u32 *crc;
@@ -71,12 +73,12 @@ __igt_reset_stolen(struct intel_gt *gt,
 			goto err_spin;
 		}
 		rq = igt_spinner_create_request(&spin, ce, MI_ARB_CHECK);
-		intel_context_put(ce);
 		if (IS_ERR(rq)) {
 			err = PTR_ERR(rq);
 			goto err_spin;
 		}
 		i915_request_add(rq);
+		contexts[id] = ce;
 	}
 
 	for (page = 0; page < num_pages; page++) {
@@ -165,8 +167,21 @@ __igt_reset_stolen(struct intel_gt *gt,
 		err = -EINVAL;
 	}
 
+	err = intel_gt_wait_for_idle(gt, HZ);
+	if (err < 0) {
+		pr_err("%s failed to wait for gt idle: %d\n", msg, err);
+		goto err_spin;
+	}
+
+	err = 0;
+
 err_spin:
 	igt_spinner_fini(&spin);
+	for (id = 0; id < I915_NUM_ENGINES; id++) {
+		if (!contexts[id])
+			continue;
+		intel_context_put(contexts[id]);
+	}
 
 err_lock:
 	intel_runtime_pm_put(gt->uncore->rpm, wakeref);
-- 
2.25.1