[RFC PATCH] drm/i915: Fix the race between the GEM close and debugfs

[Nikunj A. Dadhania]

As we close GEM object and set file_priv to -EBADF which is protected
by ctx->mutex, populating the GEM debugfs info is not protected
and results in the crash shown below.

Make sure to protect the access to file_priv using ctx->mutex to avoid
race.

BUG: unable to handle page fault for address: ffffffffffffffff
RIP: 0010:i915_gem_object_info+0x26b/0x3eb
Code: 89 44 24 48 48 89 44 24 40 48 89 44 24 38 48 89 44 24 30 48 89 44 24 28 48 89 44 24 20 49 8b 46 f0 48 89 44 24 20 49 8b 46 a0 <48> 8b 58 08 b9 0a 00 00 00 48 b8 aa aa aa aa aa aa aa aa 48 8d bc
RSP: 0018:ffffac81c14cfc30 EFLAGS: 00010246
RAX: fffffffffffffff7 RBX: ffff95094429c218 RCX: ffff95096756c740
RDX: 0000000000000000 RSI: ffffffff919b93ee RDI: ffff95094429c218
RBP: ffffac81c14cfd58 R08: ffff9509746fab80 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff9509753f8e80
R13: ffffac81c14cfc98 R14: ffff95094429c268 R15: ffffac81c14cfc88
FS:  00007a1bdcd52900(0000) GS:ffff950977e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffff CR3: 000000026b4e0000 CR4: 0000000000340ef0
Call Trace:
 seq_read+0x162/0x3ca
 full_proxy_read+0x5b/0x8d
 __vfs_read+0x45/0x1b9
 vfs_read+0xc9/0x15e
 ksys_read+0x7e/0xde
 do_syscall_64+0x54/0x7e
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7a1bdd34cf03

Signed-off-by: Nikunj A. Dadhania <nikunj.dadhania at linux.intel.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin at intel.com>
Cc: stable at vger.kernel.org
Change-Id: Iab4dd701b8c48e1058f448e7d2e99cb9f78ae645
---
 drivers/gpu/drm/i915/i915_debugfs.c | 73 ++++++++++++++---------------
 1 file changed, 35 insertions(+), 38 deletions(-)

diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 784219962193..a888222f31fe 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -300,59 +300,56 @@ static void print_context_stats(struct seq_file *m,
 				struct drm_i915_private *i915)
 {
 	struct file_stats kstats = {};
-	struct i915_gem_context *ctx, *cn;
-
-	spin_lock(&i915->gem.contexts.lock);
-	list_for_each_entry_safe(ctx, cn, &i915->gem.contexts.list, link) {
-		struct i915_gem_engines_iter it;
-		struct intel_context *ce;
-
-		if (!kref_get_unless_zero(&ctx->ref))
-			continue;
-
-		spin_unlock(&i915->gem.contexts.lock);
-
-		for_each_gem_engine(ce,
-				    i915_gem_context_lock_engines(ctx), it) {
-			if (intel_context_pin_if_active(ce)) {
-				rcu_read_lock();
-				if (ce->state)
-					per_file_stats(0,
-						       ce->state->obj, &kstats);
-				per_file_stats(0, ce->ring->vma->obj, &kstats);
-				rcu_read_unlock();
-				intel_context_unpin(ce);
-			}
-		}
-		i915_gem_context_unlock_engines(ctx);
-
-		if (!IS_ERR_OR_NULL(ctx->file_priv)) {
+	struct i915_gem_context *ctx;
+	struct drm_device *dev = &i915->drm;
+	struct drm_file *file;
+
+	mutex_lock(&dev->filelist_mutex);
+	list_for_each_entry(file, &dev->filelist, lhead) {
+		struct drm_i915_file_private *file_priv = file->driver_priv;
+		unsigned long idx;
+
+		rcu_read_lock();
+		xa_for_each(&file_priv->context_xa, idx, ctx) {
+			struct i915_gem_engines_iter it;
+			struct intel_context *ce;
 			struct file_stats stats = {
 				.vm = rcu_access_pointer(ctx->vm),
 			};
-			struct drm_file *file = ctx->file_priv->file;
 			struct task_struct *task;
 			char name[80];
 
-			rcu_read_lock();
-			idr_for_each(&file->object_idr, per_file_stats, &stats);
+			if (!kref_get_unless_zero(&ctx->ref))
+				continue;
+
 			rcu_read_unlock();
 
+			for_each_gem_engine(ce,
+					i915_gem_context_lock_engines(ctx), it) {
+				if (intel_context_pin_if_active(ce)) {
+					rcu_read_lock();
+					if (ce->state)
+						per_file_stats(0,
+							ce->state->obj, &kstats);
+					per_file_stats(0, ce->ring->vma->obj, &kstats);
+					rcu_read_unlock();
+					intel_context_unpin(ce);
+				}
+			}
+			i915_gem_context_unlock_engines(ctx);
+
 			rcu_read_lock();
+			idr_for_each(&file->object_idr, per_file_stats, &stats);
 			task = pid_task(ctx->pid ?: file->pid, PIDTYPE_PID);
 			snprintf(name, sizeof(name), "%s",
 				 task ? task->comm : "<unknown>");
-			rcu_read_unlock();
 
 			print_file_stats(m, name, stats);
+			i915_gem_context_put(ctx);
 		}
-
-		spin_lock(&i915->gem.contexts.lock);
-		list_safe_reset_next(ctx, cn, link);
-		i915_gem_context_put(ctx);
-	}
-	spin_unlock(&i915->gem.contexts.lock);
-
+		rcu_read_unlock();
+        }
+        mutex_unlock(&dev->filelist_mutex);
 	print_file_stats(m, "[k]contexts", kstats);
 }
 
-- 
2.17.1