HMM related use-after-free with amdgpu

[Michel Dänzer]

On 2019-07-15 7:25 p.m., Jason Gunthorpe wrote:
> On Mon, Jul 15, 2019 at 06:51:06PM +0200, Michel Dänzer wrote:
>>
>> With a KASAN enabled kernel built from amd-staging-drm-next, the
>> attached use-after-free is pretty reliably detected during a piglit gpu run.
> 
> Does this branch you are testing have the hmm.git merged? I think from
> the name it does not?

Indeed, no.


> Use after free's of this nature were something that was fixed in
> hmm.git..
> 
> I don't see an obvious way you can hit something like this with the
> new code arrangement..

I tried merging the hmm-devmem-cleanup.4 changes[0] into my 5.2.y +
drm-next for 5.3 kernel. While the result didn't hit the problem, all
GL_AMD_pinned_memory piglit tests failed, so I suspect the problem was
simply avoided by not actually hitting the HMM related functionality.

It's possible that I made a mistake in merging the changes, or that I
missed some other required changes. But it's also possible that the HMM
changes broke the corresponding user-pointer functionality in amdgpu.


[0] Specifically, the following (ranges of) commits:

9ffbe8ac05dbb4ab4a4836a55a47fc6be945a38f (-> lockdep_assert_held_write)
e1bfa87399e372446454ecbaeba2800f0a385733..5da04cc86d1215fd9fe0e5c88ead6e8428a75e56
fec88ab0af9706b2201e5daf377c5031c62d11f7^..fec88ab0af9706b2201e5daf377c5031c62d11f7

-- 
Earthling Michel Dänzer               |              https://www.amd.com
Libre software enthusiast             |             Mesa and X developer