[Intel-xe] ✗ CI.checkpatch: warning for drm/drm_exec, drm/tests: Fix / WA for uaf and lock alloc tracking

Wed Sep 6 10:48:53 UTC 2023

== Series Details ==

Series: drm/drm_exec, drm/tests: Fix / WA for uaf and lock alloc tracking
URL   : https://patchwork.freedesktop.org/series/123322/
State : warning

== Summary ==

+ KERNEL=/kernel
+ git clone https://gitlab.freedesktop.org/drm/maintainer-tools mt
Cloning into 'mt'...
warning: redirecting to https://gitlab.freedesktop.org/drm/maintainer-tools.git/
+ git -C mt rev-list -n1 origin/master
63c2b6b160bca2df6efc7bc4cea6f442097d7854
+ cd /kernel
+ git config --global --add safe.directory /kernel
+ git log -n1
commit 1447e3de06133794b7da81d36afa52dc72e0e580
Author: Thomas Hellström <thomas.hellstrom at linux.intel.com>
Date:   Wed Sep 6 11:50:39 2023 +0200

    drm/drm_exec: Work around a WW mutex lockdep oddity
    
    If *any* object of a certain WW mutex class is locked, lockdep will
    consider *all* mutexes of that class as locked. Also the lock allocation
    tracking code will apparently register only the address of the first
    mutex of a given class locked in a sequence.
    This has the odd consequence that if that first mutex is unlocked while
    other mutexes of the same class remain locked and then its memory then
    freed, the lock alloc tracking code will incorrectly assume that memory
    is freed with a held lock in there.
    
    For now, work around that for drm_exec by releasing the first grabbed
    object lock last.
    
    v2:
    - Fix a typo (Danilo Krummrich)
    - Reword the commit message a bit.
    - Add a Fixes: tag
    
    Related lock alloc tracking warning:
    [  322.660067] =========================
    [  322.660070] WARNING: held lock freed!
    [  322.660074] 6.5.0-rc7+ #155 Tainted: G     U           N
    [  322.660078] -------------------------
    [  322.660081] kunit_try_catch/4981 is freeing memory ffff888112adc000-ffff888112adc3ff, with a lock still held there!
    [  322.660089] ffff888112adc1a0 (reservation_ww_class_mutex){+.+.}-{3:3}, at: drm_exec_lock_obj+0x11a/0x600 [drm_exec]
    [  322.660104] 2 locks held by kunit_try_catch/4981:
    [  322.660108]  #0: ffffc9000343fe18 (reservation_ww_class_acquire){+.+.}-{0:0}, at: test_early_put+0x22f/0x490 [drm_exec_test]
    [  322.660123]  #1: ffff888112adc1a0 (reservation_ww_class_mutex){+.+.}-{3:3}, at: drm_exec_lock_obj+0x11a/0x600 [drm_exec]
    [  322.660135]
                   stack backtrace:
    [  322.660139] CPU: 7 PID: 4981 Comm: kunit_try_catch Tainted: G     U           N 6.5.0-rc7+ #155
    [  322.660146] Hardware name: ASUS System Product Name/PRIME B560M-A AC, BIOS 0403 01/26/2021
    [  322.660152] Call Trace:
    [  322.660155]  <TASK>
    [  322.660158]  dump_stack_lvl+0x57/0x90
    [  322.660164]  debug_check_no_locks_freed+0x20b/0x2b0
    [  322.660172]  slab_free_freelist_hook+0xa1/0x160
    [  322.660179]  ? drm_exec_unlock_all+0x168/0x2a0 [drm_exec]
    [  322.660186]  __kmem_cache_free+0xb2/0x290
    [  322.660192]  drm_exec_unlock_all+0x168/0x2a0 [drm_exec]
    [  322.660200]  drm_exec_fini+0xf/0x1c0 [drm_exec]
    [  322.660206]  test_early_put+0x289/0x490 [drm_exec_test]
    [  322.660215]  ? __pfx_test_early_put+0x10/0x10 [drm_exec_test]
    [  322.660222]  ? __kasan_check_byte+0xf/0x40
    [  322.660227]  ? __ksize+0x63/0x140
    [  322.660233]  ? drmm_add_final_kfree+0x3e/0xa0 [drm]
    [  322.660289]  ? _raw_spin_unlock_irqrestore+0x30/0x60
    [  322.660294]  ? lockdep_hardirqs_on+0x7d/0x100
    [  322.660301]  ? __pfx_kunit_try_run_case+0x10/0x10 [kunit]
    [  322.660310]  ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [kunit]
    [  322.660319]  kunit_generic_run_threadfn_adapter+0x4a/0x90 [kunit]
    [  322.660328]  kthread+0x2e7/0x3c0
    [  322.660334]  ? __pfx_kthread+0x10/0x10
    [  322.660339]  ret_from_fork+0x2d/0x70
    [  322.660345]  ? __pfx_kthread+0x10/0x10
    [  322.660349]  ret_from_fork_asm+0x1b/0x30
    [  322.660358]  </TASK>
    [  322.660818]     ok 8 test_early_put
    
    Cc: Christian König <christian.koenig at amd.com>
    Cc: Boris Brezillon <boris.brezillon at collabora.com>
    Cc: Danilo Krummrich <dakr at redhat.com>
    Cc: dri-devel at lists.freedesktop.org
    Fixes: 09593216bff1 ("drm: execution context for GEM buffers v7")
    Signed-off-by: Thomas Hellström <thomas.hellstrom at linux.intel.com>
    Reviewed-by: Boris Brezillon <boris.brezillon at collabora.com>
    Reviewed-by: Danilo Krummrich <dakr at redhat.com>
    Reviewed-by: Christian König <christian.koenig at amd.com>
+ /mt/dim checkpatch 167cc07fb3afb065d3c1c869059fd01c265a6c5e drm-intel
a9c30f2c2 drm/tests: helpers: Avoid a driver uaf
-:118: WARNING:UNKNOWN_COMMIT_ID: Unknown commit id 'd98780310719', maybe rebased or not pulled?
#118: 
Fixes: d98780310719 ("drm/tests: helpers: Allow to pass a custom drm_driver")

total: 0 errors, 1 warnings, 0 checks, 16 lines checked
7437bdb09 drm/tests/drm_exec: Add a test for object freeing within drm_exec_fini()
1447e3de0 drm/drm_exec: Work around a WW mutex lockdep oddity
-:71: WARNING:UNKNOWN_COMMIT_ID: Unknown commit id '09593216bff1', maybe rebased or not pulled?
#71: 
Fixes: 09593216bff1 ("drm: execution context for GEM buffers v7")

-:123: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'index' - possible side-effects?
#123: FILE: include/drm/drm_exec.h:76:
+#define drm_exec_for_each_locked_object(exec, index, obj)		\
+	for ((index) = 0; ((obj) = drm_exec_obj(exec, index)); ++(index))

-:137: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'exec' - possible side-effects?
#137: FILE: include/drm/drm_exec.h:90:
+#define drm_exec_for_each_locked_object_reverse(exec, index, obj)	\
+	for ((index) = (exec)->num_objects - 1;				\
+	     ((obj) = drm_exec_obj(exec, index)); --(index))

-:137: CHECK:MACRO_ARG_REUSE: Macro argument reuse 'index' - possible side-effects?
#137: FILE: include/drm/drm_exec.h:90:
+#define drm_exec_for_each_locked_object_reverse(exec, index, obj)	\
+	for ((index) = (exec)->num_objects - 1;				\
+	     ((obj) = drm_exec_obj(exec, index)); --(index))

total: 0 errors, 1 warnings, 3 checks, 55 lines checked