[Bug 99684] New: [BDW] use-after-free in gen8_ppgtt_alloc_page_directories
bugzilla-daemon at freedesktop.org
bugzilla-daemon at freedesktop.org
Sun Feb 5 13:23:30 UTC 2017
https://bugs.freedesktop.org/show_bug.cgi?id=99684
Bug ID: 99684
Summary: [BDW] use-after-free in
gen8_ppgtt_alloc_page_directories
Product: DRI
Version: DRI git
Hardware: x86-64 (AMD64)
OS: Linux (All)
Status: NEW
Severity: normal
Priority: medium
Component: DRM/Intel
Assignee: intel-gfx-bugs at lists.freedesktop.org
Reporter: matthew.auld at intel.com
QA Contact: intel-gfx-bugs at lists.freedesktop.org
CC: intel-gfx-bugs at lists.freedesktop.org
Created attachment 129346
--> https://bugs.freedesktop.org/attachment.cgi?id=129346&action=edit
dmesg
It looks like we are hitting a use-after-free in
gen8_ppgtt_alloc_page_directories with some pdp state. One possible theory from
looking at the log is that the shrinker kicks in and starts swinging its axe,
evicting one or more vma's, which results in said pdp being freed, I guess we
didn't have anything else inserted in that range, which is why it was freed.
But all of this could have happened while we were in the middle of allocating a
va range for another vma which just so happens to touch the same pdp, and so
with a little bad timing the free could have happened just after we check if we
need to allocate a new pdp, resulting in all kinds of brokenness. It looks like
something similar could also happen with a pd.
--
You are receiving this mail because:
You are the assignee for the bug.
You are on the CC list for the bug.
You are the QA Contact for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/intel-gfx-bugs/attachments/20170205/c0854e90/attachment.html>
More information about the intel-gfx-bugs
mailing list