Re: [BUG][5.20] refcount_t: underflow; use-after-free

2022-09-19 Thread Mikhail Gavrilov
Hi! Unfortunately the use-after-free issue still happens on the 6.0-rc5 kernel. The issue became hard to repeat. I spent the whole day at the computer when use-after-free again happened, I was playing the game Tiny Tina's Wonderlands. Therefore, forget about repeatability. It remains only to hope

Re: [BUG][5.20] refcount_t: underflow; use-after-free

2022-08-24 Thread Mikhail Gavrilov
On Fri, Aug 19, 2022 at 5:13 PM Maíra Canal wrote: > > Hi Mikhail, > > Could you please specify the steps to reproduce this use-after-free? I > will try to reproduce it on the RX5700 XT and bisect the issue. > Hi Maíra, thanks for help. I'm afraid that it will be unrealistic to reproduce,

Re: [BUG][5.20] refcount_t: underflow; use-after-free

2022-08-19 Thread Maíra Canal
On 8/17/22 17:57, Mikhail Gavrilov wrote: > On Wed, Aug 17, 2022 at 11:43 PM Maíra Canal wrote: >> >> Hi Mikhail, >> >> Looks like 45ecaea738830b9d521c93520c8f201359dcbd95 ("drm/sched: Partial >> revert of 'drm/sched: Keep s_fence->parent pointer'") introduced the >> error. Try reverting it

Re: [BUG][5.20] refcount_t: underflow; use-after-free

2022-08-17 Thread Mikhail Gavrilov
On Wed, Aug 17, 2022 at 11:43 PM Maíra Canal wrote: > > Hi Mikhail, > > Looks like 45ecaea738830b9d521c93520c8f201359dcbd95 ("drm/sched: Partial > revert of 'drm/sched: Keep s_fence->parent pointer'") introduced the > error. Try reverting it and check if the use-after-free still happens. Thanks,

Re: [BUG][5.20] refcount_t: underflow; use-after-free

2022-08-17 Thread Maíra Canal
On 8/17/22 14:44, Mikhail Gavrilov wrote: On Wed, Aug 17, 2022 at 9:08 PM Melissa Wen wrote: Hi Mikhail, IIUC, you got this second user-after-free by applying the first version of Maíra's patch, right? So, that version was adding another unbalanced unlock to the cs ioctl flow, but it was

Re: [BUG][5.20] refcount_t: underflow; use-after-free

2022-08-17 Thread Mikhail Gavrilov
On Wed, Aug 17, 2022 at 9:08 PM Melissa Wen wrote: > > Hi Mikhail, > > IIUC, you got this second user-after-free by applying the first version > of Maíra's patch, right? So, that version was adding another unbalanced > unlock to the cs ioctl flow, but it was solved in the latest version, > that

Re: [BUG][5.20] refcount_t: underflow; use-after-free

2022-08-17 Thread Melissa Wen
On 08/17, Mikhail Gavrilov wrote: > On Mon, Aug 15, 2022 at 3:37 PM Mikhail Gavrilov > wrote: > > > > Thanks, I tested this patch. > > But with this patch use-after-free problem happening in another place: > > Does anyone have an idea why the second use-after-free happened? > From the trace I

Re: [BUG][5.20] refcount_t: underflow; use-after-free

2022-08-16 Thread Mikhail Gavrilov
On Mon, Aug 15, 2022 at 3:37 PM Mikhail Gavrilov wrote: > > Thanks, I tested this patch. > But with this patch use-after-free problem happening in another place: Does anyone have an idea why the second use-after-free happened? >From the trace I don't understand which code is related. I don't

Re: [BUG][5.20] refcount_t: underflow; use-after-free

2022-08-15 Thread Christian König
Am 15.08.22 um 12:55 schrieb Melissa Wen: On 08/14, Maíra Canal wrote: Hi Mikhail Looks like this use-after-free problem was introduced on 90af0ca047f3049c4b46e902f432ad6ef1e2ded6. Checking this patch it seems like: if amdgpu_cs_vm_handling return r != 0, then it will unlock bo_list_mutex

Re: [BUG][5.20] refcount_t: underflow; use-after-free

2022-08-15 Thread Melissa Wen
On 08/14, Maíra Canal wrote: > Hi Mikhail > > Looks like this use-after-free problem was introduced on > 90af0ca047f3049c4b46e902f432ad6ef1e2ded6. Checking this patch it seems > like: if amdgpu_cs_vm_handling return r != 0, then it will unlock > bo_list_mutex inside the function

Re: [BUG][5.20] refcount_t: underflow; use-after-free

2022-08-15 Thread Mikhail Gavrilov
On Mon, Aug 15, 2022 at 5:20 AM Maíra Canal wrote: > > Hi Mikhail > > Looks like this use-after-free problem was introduced on > 90af0ca047f3049c4b46e902f432ad6ef1e2ded6. Checking this patch it seems > like: if amdgpu_cs_vm_handling return r != 0, then it will unlock > bo_list_mutex inside the

Re: [BUG][5.20] refcount_t: underflow; use-after-free

2022-08-14 Thread Maíra Canal
Hi Mikhail Looks like this use-after-free problem was introduced on 90af0ca047f3049c4b46e902f432ad6ef1e2ded6. Checking this patch it seems like: if amdgpu_cs_vm_handling return r != 0, then it will unlock bo_list_mutex inside the function amdgpu_cs_vm_handling and again on amdgpu_cs_parser_fini.

[BUG][5.20] refcount_t: underflow; use-after-free

2022-08-14 Thread Mikhail Gavrilov
Hi folks. Joined testing 5.20 today (7ebfc85e2cd7). I encountered a frequently GPU freeze, after which a message appears in the kernel logs: [ 220.280990] [ cut here ] [ 220.281000] refcount_t: underflow; use-after-free. [ 220.281019] WARNING: CPU: 1 PID: 3746 at