I had some questions on the trybot mailing list, let me copy&paste..

On 21/06/2021 12:41, Maarten Lankhorst wrote:
It doesn't work for legacy ring submission, and is in the best case
ignored.

Looks rejected instead of ignored:

static int set_ringsize(struct i915_gem_context *ctx,
            struct drm_i915_gem_context_param *args)
{
    if (!HAS_LOGICAL_RING_CONTEXTS(ctx->i915))
        return -ENODEV;

In the worst case we end up freeing engine->legacy.ring for all other
active engines, resulting in a use-after-free.

Worst case is cloning because ring_context_alloc is not taking a reference to engine->legacy.ring, or something else?

Regards,

Tvrtko


Signed-off-by: Maarten Lankhorst <maarten.lankho...@linux.intel.com>
Fixes: 88be76cdafc7 ("drm/i915: Allow userspace to specify ringsize on 
construction")
Cc: Chris Wilson <ch...@chris-wilson.co.uk>
---
  drivers/gpu/drm/i915/gt/intel_context_param.c | 3 +++
  1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/i915/gt/intel_context_param.c 
b/drivers/gpu/drm/i915/gt/intel_context_param.c
index 65dcd090245d..412c36d1b1dd 100644
--- a/drivers/gpu/drm/i915/gt/intel_context_param.c
+++ b/drivers/gpu/drm/i915/gt/intel_context_param.c
@@ -12,6 +12,9 @@ int intel_context_set_ring_size(struct intel_context *ce, 
long sz)
  {
        int err;
+ if (ce->engine->gt->submission_method == INTEL_SUBMISSION_RING)
+               return 0;
+
        if (intel_context_lock_pinned(ce))
                return -EINTR;
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx

Reply via email to