On Mon, Aug 15, 2022 at 5:20 AM Maíra Canal <mairacanal@xxxxxxxxxx> wrote: > > Hi Mikhail > > Looks like this use-after-free problem was introduced on > 90af0ca047f3049c4b46e902f432ad6ef1e2ded6. Checking this patch it seems > like: if amdgpu_cs_vm_handling return r != 0, then it will unlock > bo_list_mutex inside the function amdgpu_cs_vm_handling and again on > amdgpu_cs_parser_fini. > > Maybe the following patch will help: Thanks, I tested this patch. But with this patch use-after-free problem happening in another place: [ 894.012920] ------------[ cut here ]------------ [ 894.012939] refcount_t: underflow; use-after-free. [ 894.012968] WARNING: CPU: 14 PID: 205 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x110 [ 894.012999] Modules linked in: tls uinput rfcomm snd_seq_dummy snd_hrtimer nft_objref nf_conntrack_netbios_ns nf_conntrack_broadcast nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables nfnetlink qrtr bnep sunrpc snd_seq_midi snd_seq_midi_event snd_hda_codec_realtek mt76x2u mt76x2_common snd_hda_codec_generic snd_hda_codec_hdmi intel_rapl_msr mt76x02_usb intel_rapl_common snd_hda_intel mt76_usb snd_intel_dspcfg vfat iwlmvm snd_intel_sdw_acpi mt76x02_lib fat snd_usb_audio snd_hda_codec mt76 edac_mce_amd snd_usbmidi_lib snd_hda_core btusb snd_rawmidi snd_hwdep mac80211 mc iwlwifi btrtl eeepc_wmi asus_wmi btbcm snd_seq kvm_amd libarc4 ledtrig_audio snd_seq_device btintel iwlmei sparse_keymap btmtk kvm snd_pcm irqbypass platform_profile snd_timer xpad joydev cfg80211 rapl hid_logitech_hidpp bluetooth ff_memless wmi_bmof video pcspkr snd k10temp i2c_piix4 [ 894.013086] soundcore rfkill mei asus_ec_sensors acpi_cpufreq zram amdgpu drm_ttm_helper ttm iommu_v2 crct10dif_pclmul ucsi_ccg gpu_sched crc32_pclmul crc32c_intel typec_ucsi drm_buddy typec drm_display_helper ghash_clmulni_intel igb ccp cec nvme sp5100_tco nvme_core dca wmi ip6_tables ip_tables fuse [ 894.013322] Unloaded tainted modules: amd64_edac():1 amd64_edac():1 amd64_edac():1 amd64_edac():1 amd64_edac():1 amd64_edac():1 amd64_edac():1 amd64_edac():1 pcc_cpufreq():1 pcc_cpufreq():1 amd64_edac():1 pcc_cpufreq():1 amd64_edac():1 amd64_edac():1 pcc_cpufreq():1 amd64_edac():1 pcc_cpufreq():1 amd64_edac():1 pcc_cpufreq():1 amd64_edac():1 pcc_cpufreq():1 pcc_cpufreq():1 amd64_edac():1 amd64_edac():1 pcc_cpufreq():1 amd64_edac():1 pcc_cpufreq():1 pcc_cpufreq():1 amd64_edac():1 pcc_cpufreq():1 amd64_edac():1 pcc_cpufreq():1 amd64_edac():1 pcc_cpufreq():1 amd64_edac():1 pcc_cpufreq():1 amd64_edac():1 pcc_cpufreq():1 amd64_edac():1 pcc_cpufreq():1 pcc_cpufreq():1 amd64_edac():1 pcc_cpufreq():1 amd64_edac():1 pcc_cpufreq():1 amd64_edac():1 amd64_edac():1 pcc_cpufreq():1 amd64_edac():1 pcc_cpufreq():1 pcc_cpufreq():1 amd64_edac():1 pcc_cpufreq():1 amd64_edac():1 amd64_edac():1 pcc_cpufreq():1 amd64_edac():1 pcc_cpufreq():1 pcc_cpufreq():1 pcc_cpufreq():1 fjes():1 pcc_cpufreq():1 fjes():1 [ 894.013455] pcc_cpufreq():1 pcc_cpufreq():1 fjes():1 pcc_cpufreq():1 fjes():1 fjes():1 fjes():1 fjes():1 fjes():1 [ 894.013690] CPU: 14 PID: 205 Comm: kworker/14:1 Tainted: G W L ------- --- 5.20.0-0.rc0.20220812git7ebfc85e2cd7.11.fc38.x86_64 #1 [ 894.013725] Hardware name: System manufacturer System Product Name/ROG STRIX X570-I GAMING, BIOS 4403 04/27/2022 [ 894.013756] Workqueue: events drm_sched_entity_kill_jobs_work [gpu_sched] [ 894.013779] RIP: 0010:refcount_warn_saturate+0xba/0x110 [ 894.013796] Code: 01 01 e8 79 4a 6f 00 0f 0b e9 42 47 a5 00 80 3d de 7e be 01 00 75 85 48 c7 c7 f8 98 8e 9c c6 05 ce 7e be 01 01 e8 56 4a 6f 00 <0f> 0b e9 1f 47 a5 00 80 3d b9 7e be 01 00 0f 85 5e ff ff ff 48 c7 [ 894.013842] RSP: 0018:ffffb48681153e60 EFLAGS: 00010286 [ 894.013858] RAX: 0000000000000026 RBX: ffff9bad16f1f028 RCX: 0000000000000000 [ 894.013878] RDX: 0000000000000001 RSI: ffffffff9c8d06dc RDI: 00000000ffffffff [ 894.013897] RBP: ffff9bba663f5600 R08: 0000000000000000 R09: ffffb48681153d10 [ 894.013916] R10: 0000000000000003 R11: ffff9bbaae2fffe8 R12: ffff9bba663fc800 [ 894.013934] R13: ffff9bab93fcab40 R14: ffff9bba663fc805 R15: ffff9bad16f1f030 [ 894.013954] FS: 0000000000000000(0000) GS:ffff9bba66200000(0000) knlGS:0000000000000000 [ 894.013975] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 894.013991] CR2: 00001aa46b2ec008 CR3: 0000000101516000 CR4: 0000000000350ee0 [ 894.014011] Call Trace: [ 894.014022] <TASK> [ 894.014030] process_one_work+0x2a0/0x600 [ 894.014051] worker_thread+0x4f/0x3a0 [ 894.014065] ? process_one_work+0x600/0x600 [ 894.014079] kthread+0xf5/0x120 [ 894.014092] ? kthread_complete_and_exit+0x20/0x20 [ 894.014109] ret_from_fork+0x22/0x30 [ 894.014129] </TASK> [ 894.014137] irq event stamp: 5802 [ 894.014148] hardirqs last enabled at (5801): [<ffffffff9bf2a9e4>] _raw_spin_unlock_irq+0x24/0x50 [ 894.014178] hardirqs last disabled at (5802): [<ffffffff9bf21d8c>] __schedule+0xe2c/0x16d0 [ 894.014206] softirqs last enabled at (4350): [<ffffffff9b7acb88>] rht_deferred_worker+0x708/0xc00 [ 894.014235] softirqs last disabled at (4348): [<ffffffff9b7ac677>] rht_deferred_worker+0x1f7/0xc00 [ 894.014264] ---[ end trace 0000000000000000 ]--- Full kernel log is here: https://pastebin.com/wwWkXQJZ -- Best Regards, Mike Gavrilov.
