Chris Wilson <chris@xxxxxxxxxxxxxxxxxx> writes:
> After a preempt-to-busy, we may find an active request that is caught
> between execution states. Walk back along the timeline instead of the
> execution list to be safe.
>
> [ 106.417541] i915 0000:00:02.0: Resetting rcs0 for preemption time out
> [ 106.417659] ==================================================================
> [ 106.418041] BUG: KASAN: slab-out-of-bounds in __execlists_reset+0x2f2/0x440 [i915]
> [ 106.418123] Read of size 8 at addr ffff888703506b30 by task swapper/1/0
> [ 106.418194]
> [ 106.418267] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G U 5.3.0-rc3+ #5
> [ 106.418344] Hardware name: Intel Corporation NUC7i5BNK/NUC7i5BNB, BIOS BNKBL357.86A.0052.2017.0918.1346 09/18/2017
> [ 106.418434] Call Trace:
> [ 106.418508] <IRQ>
> [ 106.418585] dump_stack+0x5b/0x90
> [ 106.418941] ? __execlists_reset+0x2f2/0x440 [i915]
> [ 106.419022] print_address_description+0x67/0x32d
> [ 106.419376] ? __execlists_reset+0x2f2/0x440 [i915]
> [ 106.419731] ? __execlists_reset+0x2f2/0x440 [i915]
> [ 106.419810] __kasan_report.cold.6+0x1a/0x3c
> [ 106.419888] ? __trace_bprintk+0xc0/0xd0
> [ 106.420239] ? __execlists_reset+0x2f2/0x440 [i915]
> [ 106.420318] check_memory_region+0x144/0x1c0
> [ 106.420671] __execlists_reset+0x2f2/0x440 [i915]
> [ 106.421029] execlists_reset+0x3d/0x50 [i915]
> [ 106.421387] intel_engine_reset+0x203/0x3a0 [i915]
> [ 106.421744] ? igt_reset_nop+0x2b0/0x2b0 [i915]
> [ 106.421825] ? _raw_spin_trylock_bh+0xe0/0xe0
> [ 106.421901] ? rcu_core+0x1b9/0x6a0
> [ 106.422251] preempt_reset+0x9a/0xf0 [i915]
> [ 106.422333] tasklet_action_common.isra.15+0xc0/0x1e0
> [ 106.422685] ? execlists_submit_request+0x200/0x200 [i915]
> [ 106.422764] __do_softirq+0x106/0x3cf
> [ 106.422840] irq_exit+0xdc/0xf0
> [ 106.422914] smp_apic_timer_interrupt+0x81/0x1c0
> [ 106.422988] apic_timer_interrupt+0xf/0x20
> [ 106.423059] </IRQ>
> [ 106.423144] RIP: 0010:cpuidle_enter_state+0xc3/0x620
> [ 106.423222] Code: 24 0f 1f 44 00 00 31 ff e8 da 87 9c ff 80 7c 24 10 00 74 12 9c 58 f6 c4 02 0f 85 33 05 00 00 31 ff e8 c1 77 a3 ff fb 45 85 e4 <0f> 89 bf 02 00 00 48 8d 7d 10 e8 4e 45 b9 ff c7 45 10 00 00 00 00
> [ 106.423311] RSP: 0018:ffff88881c30fda8 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13
> [ 106.423390] RAX: 0000000000000000 RBX: ffffffff825b4c80 RCX: ffffffff810c8a00
> [ 106.423465] RDX: dffffc0000000000 RSI: 0000000039f89620 RDI: ffff88881f6b00a8
> [ 106.423540] RBP: ffff88881f6b5bf8 R08: 0000000000000002 R09: 000000000002ed80
> [ 106.423616] R10: 0000003fdd956146 R11: ffff88881c2d1e47 R12: 0000000000000008
> [ 106.423691] R13: 0000000000000008 R14: ffffffff825b4f80 R15: ffffffff825b4fc0
> [ 106.423772] ? sched_idle_set_state+0x20/0x30
> [ 106.423851] ? cpuidle_enter_state+0xa6/0x620
> [ 106.423874] ? tick_nohz_idle_stop_tick+0x1d1/0x3f0
> [ 106.423896] cpuidle_enter+0x37/0x60
> [ 106.423919] do_idle+0x246/0x280
> [ 106.423941] ? arch_cpu_idle_exit+0x30/0x30
> [ 106.423964] ? __wake_up_common+0x46/0x240
> [ 106.423986] cpu_startup_entry+0x14/0x20
> [ 106.424009] start_secondary+0x1b0/0x200
> [ 106.424031] ? set_cpu_sibling_map+0x990/0x990
> [ 106.424054] secondary_startup_64+0xa4/0xb0
> [ 106.424075]
> [ 106.424096] Allocated by task 626:
> [ 106.424119] save_stack+0x19/0x80
> [ 106.424143] __kasan_kmalloc.constprop.7+0xc1/0xd0
> [ 106.424165] kmem_cache_alloc+0xb2/0x1d0
> [ 106.424277] i915_sched_lookup_priolist+0x1ab/0x320 [i915]
> [ 106.424385] execlists_submit_request+0x73/0x200 [i915]
> [ 106.424498] submit_notify+0x59/0x60 [i915]
> [ 106.424600] __i915_sw_fence_complete+0x9b/0x330 [i915]
> [ 106.424713] __i915_request_commit+0x4bf/0x570 [i915]
> [ 106.424818] intel_engine_pulse+0x213/0x310 [i915]
> [ 106.424925] context_close+0x22f/0x470 [i915]
> [ 106.425033] i915_gem_context_destroy_ioctl+0x7b/0xa0 [i915]
> [ 106.425058] drm_ioctl_kernel+0x131/0x170
> [ 106.425081] drm_ioctl+0x2d9/0x4f1
> [ 106.425104] do_vfs_ioctl+0x115/0x890
> [ 106.425126] ksys_ioctl+0x35/0x70
> [ 106.425147] __x64_sys_ioctl+0x38/0x40
> [ 106.425169] do_syscall_64+0x66/0x220
> [ 106.425191] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> [ 106.425213]
> [ 106.425234] Freed by task 0:
> [ 106.425255] (stack is not available)
> [ 106.425276]
> [ 106.425297] The buggy address belongs to the object at ffff888703506a40
> [ 106.425297] which belongs to the cache i915_priolist of size 104
> [ 106.425321] The buggy address is located 136 bytes to the right of
> [ 106.425321] 104-byte region [ffff888703506a40, ffff888703506aa8)
> [ 106.425345] The buggy address belongs to the page:
> [ 106.425367] page:ffffea001c0d4180 refcount:1 mapcount:0 mapping:ffff88873e1cf740 index:0xffff888703506e40 compound_mapcount: 0
> [ 106.425391] flags: 0x8000000000010200(slab|head)
> [ 106.425415] raw: 8000000000010200 ffffea0020192b88 ffff8888174b5450 ffff88873e1cf740
> [ 106.425439] raw: ffff888703506e40 000000000010000e 00000001ffffffff 0000000000000000
> [ 106.425464] page dumped because: kasan: bad access detected
> [ 106.425486]
> [ 106.425506] Memory state around the buggy address:
> [ 106.425528] ffff888703506a00: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
> [ 106.425551] ffff888703506a80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
> [ 106.425573] >ffff888703506b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 106.425597] ^
> [ 106.425619] ffff888703506b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 106.425642] ffff888703506c00: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
> [ 106.425664] ==================================================================
>
> Fixes: 22b7a426bbe1 ("drm/i915/execlists: Preempt-to-busy")
> Signed-off-by: Chris Wilson <chris@xxxxxxxxxxxxxxxxxx>
On agreement that the timeline is safer,
Reviewed-by: Mika Kuoppala <mika.kuoppala@xxxxxxxxxxxxxxx>
> ---
> drivers/gpu/drm/i915/gt/intel_lrc.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/gt/intel_lrc.c b/drivers/gpu/drm/i915/gt/intel_lrc.c
> index 191892f7b3a9..645f6b21d8c6 100644
> --- a/drivers/gpu/drm/i915/gt/intel_lrc.c
> +++ b/drivers/gpu/drm/i915/gt/intel_lrc.c
> @@ -2246,15 +2246,15 @@ static void reset_csb_pointers(struct intel_engine_cs *engine)
>
> static struct i915_request *active_request(struct i915_request *rq)
> {
> - const struct list_head * const list = &rq->engine->active.requests;
> - const struct intel_context * const context = rq->hw_context;
> + const struct list_head * const list = &rq->timeline->requests;
> + const struct intel_context * const ce = rq->hw_context;
> struct i915_request *active = NULL;
>
> - list_for_each_entry_from_reverse(rq, list, sched.link) {
> + list_for_each_entry_from_reverse(rq, list, link) {
> if (i915_request_completed(rq))
> break;
>
> - if (rq->hw_context != context)
> + if (rq->hw_context != ce)
> break;
>
> active = rq;
> --
> 2.23.0.rc1
>
> _______________________________________________
> Intel-gfx mailing list
> Intel-gfx@xxxxxxxxxxxxxxxxxxxxx
> https://lists.freedesktop.org/mailman/listinfo/intel-gfx
_______________________________________________
Intel-gfx mailing list
Intel-gfx@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
