similar to: [PATCH] drm/qxl: qxl_release use after free

Hi, > > The only way I see for this to happen is that the guest is preempted > > between qxl_push_{cursor,command}_ring_release() and > > qxl_release_fence_buffer_objects() calls. The host can complete the qxl > > command then, signal the guest, and the IRQ handler calls > > qxl_release_free_list() before qxl_release_fence_buffer_objects() runs. > > We think

On Mon, Apr 27, 2020 at 08:32:51AM +0300, Vasily Averin wrote: > Cc: stable at vger.kernel.org > Fixes: 8002db6336dd ("qxl: convert qxl driver to proper use for reservations") > Signed-off-by: Vasily Averin <vvs at virtuozzo.com> Both patches pushed to drm-misc-fixes. thanks, Gerd

On Sat, Apr 18, 2020 at 02:39:17PM +0800, Caicai wrote: > When a qxl resource is released, the list that needs to be released is > fetched from the linked list ring and cleared. When you empty the list, > instead of trying to determine whether the ttm buffer object for each > qxl in the list is locked, you release the qxl object and remove the > element from the list until the list

Lovely diffstat, thanks to the new generic fbdev emulation. drm/qxl/Makefile | 2 drm/qxl/qxl_draw.c | 232 ---------------------------------------- drm/qxl/qxl_drv.h | 21 --- drm/qxl/qxl_fb.c | 300 ----------------------------------------------------- Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 21 ---

From: Vasily Averin <vvs at virtuozzo.com> [ Upstream commit 5b5703dbafae74adfbe298a56a81694172caf5e6 ] v2: removed TODO reminder Signed-off-by: Vasily Averin <vvs at virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/a4e0ae09-a73c-1c62-04ef-3f990d41bea9 at virtuozzo.com Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Signed-off-by: Sasha Levin <sashal at

From: Vasily Averin <vvs at virtuozzo.com> [ Upstream commit 5b5703dbafae74adfbe298a56a81694172caf5e6 ] v2: removed TODO reminder Signed-off-by: Vasily Averin <vvs at virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/a4e0ae09-a73c-1c62-04ef-3f990d41bea9 at virtuozzo.com Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Signed-off-by: Sasha Levin <sashal at

From: Vasily Averin <vvs at virtuozzo.com> [ Upstream commit 5b5703dbafae74adfbe298a56a81694172caf5e6 ] v2: removed TODO reminder Signed-off-by: Vasily Averin <vvs at virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/a4e0ae09-a73c-1c62-04ef-3f990d41bea9 at virtuozzo.com Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Signed-off-by: Sasha Levin <sashal at

From: Vasily Averin <vvs at virtuozzo.com> [ Upstream commit 5b5703dbafae74adfbe298a56a81694172caf5e6 ] v2: removed TODO reminder Signed-off-by: Vasily Averin <vvs at virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/a4e0ae09-a73c-1c62-04ef-3f990d41bea9 at virtuozzo.com Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Signed-off-by: Sasha Levin <sashal at

From: Vasily Averin <vvs at virtuozzo.com> [ Upstream commit 5b5703dbafae74adfbe298a56a81694172caf5e6 ] v2: removed TODO reminder Signed-off-by: Vasily Averin <vvs at virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/a4e0ae09-a73c-1c62-04ef-3f990d41bea9 at virtuozzo.com Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Signed-off-by: Sasha Levin <sashal at

From: Vasily Averin <vvs at virtuozzo.com> [ Upstream commit 5b5703dbafae74adfbe298a56a81694172caf5e6 ] v2: removed TODO reminder Signed-off-by: Vasily Averin <vvs at virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/a4e0ae09-a73c-1c62-04ef-3f990d41bea9 at virtuozzo.com Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Signed-off-by: Sasha Levin <sashal at

On Mon, Apr 27, 2020 at 10:55:27AM +0300, Vasily Averin wrote: > Signed-off-by: Vasily Averin <vvs at virtuozzo.com> > --- > drivers/gpu/drm/qxl/qxl_image.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/gpu/drm/qxl/qxl_image.c b/drivers/gpu/drm/qxl/qxl_image.c > index 43688ecdd8a0..7270da62fc29 100644 > --- a/drivers/gpu/drm/qxl/qxl_image.c >

Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c index 013b938986c7..f30460782f05 100644 --- a/drivers/gpu/drm/qxl/qxl_debugfs.c +++

Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Acked-by: Christian K?nig <christian.koenig at amd.com> --- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c index 013b938986c7..f30460782f05 100644 ---

Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Acked-by: Christian K?nig <christian.koenig at amd.com> --- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c index bdb5ac0987ab..94439212a5c5 100644 ---

Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Acked-by: Christian K?nig <christian.koenig at amd.com> --- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c index bdb5ac0987ab..94439212a5c5 100644 ---

Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> Acked-by: Christian K?nig <christian.koenig at amd.com> --- drivers/gpu/drm/qxl/qxl_debugfs.c | 2 +- drivers/gpu/drm/qxl/qxl_release.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_debugfs.c b/drivers/gpu/drm/qxl/qxl_debugfs.c index bdb5ac0987ab..94439212a5c5 100644 ---

Final driver! \o/ This is not a proper dma_fence because the hardware may never signal anything, so don't use dma-buf with qxl, ever. Signed-off-by: Maarten Lankhorst <maarten.lankhorst at canonical.com> --- drivers/gpu/drm/qxl/Makefile | 2 drivers/gpu/drm/qxl/qxl_cmd.c | 5 - drivers/gpu/drm/qxl/qxl_debugfs.c | 12 ++- drivers/gpu/drm/qxl/qxl_drv.h | 22 ++---

This reorders the list to keep track of what buffers are reserved, so previous members are always unreserved. This gets rid of some bookkeeping that's no longer needed, while simplifying the code some. Signed-off-by: Maarten Lankhorst <maarten.lankhorst at canonical.com> --- drivers/gpu/drm/qxl/qxl_release.c | 1 drivers/gpu/drm/ttm/ttm_execbuf_util.c | 142

No users are left, kill it off! :D Conversion to the reservation api is next on the list, after that the functionality can be restored with rcu. Signed-off-by: Maarten Lankhorst <maarten.lankhorst at canonical.com> --- drivers/gpu/drm/nouveau/nouveau_bo.c | 25 +++------- drivers/gpu/drm/nouveau/nouveau_display.c | 6 -- drivers/gpu/drm/nouveau/nouveau_gem.c | 16 +-----

qxl expects that list_first_entry(release->bos) returns the first element qxl added to the list. ttm_eu_reserve_buffers() may reorder the list though. Add a release_bo field to struct qxl_release and use that instead. Signed-off-by: Gerd Hoffmann <kraxel at redhat.com> --- drivers/gpu/drm/qxl/qxl_drv.h | 1 + drivers/gpu/drm/qxl/qxl_cmd.c | 6 ++----