linux-kernel - Re: [PATCH] drm/atomic-helpers: remove legacy_cursor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 31 Jan 2024 05:17:08 +0000
From: Jason-JH Lin (林睿祥) <Jason-JH.Lin@...iatek.com>
To: "daniel@...ll.ch" <daniel@...ll.ch>
CC: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"linux-mediatek@...ts.infradead.org" <linux-mediatek@...ts.infradead.org>,
	"daniel.vetter@...ll.ch" <daniel.vetter@...ll.ch>, "michel@...nzer.net"
	<michel@...nzer.net>, "intel-gfx@...ts.freedesktop.org"
	<intel-gfx@...ts.freedesktop.org>, "chunkuang.hu@...nel.org"
	<chunkuang.hu@...nel.org>, "linux-arm-msm@...r.kernel.org"
	<linux-arm-msm@...r.kernel.org>, "mikita.lipski@....com"
	<mikita.lipski@....com>, "dmitry.baryshkov@...aro.org"
	<dmitry.baryshkov@...aro.org>, "tzimmermann@...e.de" <tzimmermann@...e.de>,
	"maxime@...no.tech" <maxime@...no.tech>, "daniel.vetter@...el.com"
	<daniel.vetter@...el.com>, "nicholas.kazlauskas@....com"
	<nicholas.kazlauskas@....com>, "dri-devel@...ts.freedesktop.org"
	<dri-devel@...ts.freedesktop.org>, "quic_abhinavk@...cinc.com"
	<quic_abhinavk@...cinc.com>, Project_Global_Chrome_Upstream_Group
	<Project_Global_Chrome_Upstream_Group@...iatek.com>,
	"manasi.d.navare@...el.com" <manasi.d.navare@...el.com>,
	"lucas.demarchi@...el.com" <lucas.demarchi@...el.com>, "sean@...rly.run"
	<sean@...rly.run>, "matthias.bgg@...il.com" <matthias.bgg@...il.com>,
	"dmitry.osipenko@...labora.com" <dmitry.osipenko@...labora.com>,
	"fshao@...omium.org" <fshao@...omium.org>,
	"linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "jani.nikula@...el.com"
	<jani.nikula@...el.com>, "angelogioacchino.delregno@...labora.com"
	<angelogioacchino.delregno@...labora.com>, "freedreno@...ts.freedesktop.org"
	<freedreno@...ts.freedesktop.org>
Subject: Re: [PATCH] drm/atomic-helpers: remove legacy_cursor_update hacks

On Thu, 2024-01-25 at 19:17 +0100, Daniel Vetter wrote:
>  	 
> External email : Please do not click links or open attachments until
> you have verified the sender or the content.
>  On Tue, Jan 23, 2024 at 06:09:05AM +0000, Jason-JH Lin (林睿祥) wrote:
> > Hi Maxime, Daniel,
> > 
> > We encountered similar issue with mediatek SoCs.
> > 
> > We have found that in drm_atomic_helper_commit_rpm(), when
> disabling
> > the cursor plane, the old_state->legacy_cursor_update in
> > drm_atomic_wait_for_vblank() is set to true.
> > As the result, we are not actually waiting for a vlbank to wait for
> our
> > hardware to close the cursor plane. Subsequently, the execution
> > proceeds to drm_atomic_helper_cleanup_planes() to  free the cursor
> > buffer. This can lead to use-after-free issues with our hardware.
> > 
> > Could you please apply this patch to fix our problem?
> > Or are there any considerations for not applying this patch?
> 
> Mostly it needs someone to collect a pile of acks/tested-by and then
> land
> it.
> 

Got it. I would add tested-by tag for mediatek SoC.

> I'd be _very_ happy if someone else can take care of that ...
> 
> There's also the potential issue that it might slow down some of the
> legacy X11 use-cases that really needed a non-blocking cursor, but I
> think
> all the drivers where this matters have switched over to the async
> plane
> update stuff meanwhile. So hopefully that's good.
> 

I think all the drivers should have switched to async plane update.

Can we add the checking condition to see if atomic_async_update/check
function are implemented?

Regards,
Jason-JH.Lin

> Cheers, Sima
> > 
> > Regards,
> > Jason-JH.Lin
> > 
> > On Tue, 2023-03-07 at 15:56 +0100, Maxime Ripard wrote:
> > > Hi,
> > > 
> > > On Thu, Feb 16, 2023 at 12:12:13PM +0100, Daniel Vetter wrote:
> > > > The stuff never really worked, and leads to lots of fun because
> it
> > > > out-of-order frees atomic states. Which upsets KASAN, among
> other
> > > > things.
> > > > 
> > > > For async updates we now have a more solid solution with the
> > > > ->atomic_async_check and ->atomic_async_commit hooks. Support
> for
> > > > that
> > > > for msm and vc4 landed. nouveau and i915 have their own commit
> > > > routines, doing something similar.
> > > > 
> > > > For everyone else it's probably better to remove the use-after-
> free
> > > > bug, and encourage folks to use the async support instead. The
> > > > affected drivers which register a legacy cursor plane and don't
> > > > either
> > > > use the new async stuff or their own commit routine are:
> amdgpu,
> > > > atmel, mediatek, qxl, rockchip, sti, sun4i, tegra, virtio, and
> > > > vmwgfx.
> > > > 
> > > > Inspired by an amdgpu bug report.
> > > 
> > > Thanks for submitting that patch. It's been in the downstream RPi
> > > tree
> > > for a while, so I'd really like it to be merged eventually :)
> > > 
> > > Acked-by: Maxime Ripard <maxime@...no.tech>
> > > 
> > > Maxime
>