Re: [PATCH] amdgpu_dm: fix nonblocking atomic commit use-after-free

2020-07-28 Thread daniel
On Tue, Jul 28, 2020 at 01:07:13PM -0400, Kazlauskas, Nicholas wrote: > On 2020-07-28 5:22 a.m., Paul Menzel wrote: > > Dear Linux folks, > > > > > > Am 25.07.20 um 07:20 schrieb Mazin Rezk: > > > On Saturday, July 25, 2020 12:59 AM, Duncan wrote: > > > > > > > On Sat, 25 Jul 2020 03:03:52 +

Re: [PATCH] amdgpu_dm: fix nonblocking atomic commit use-after-free

2020-07-28 Thread Paul Menzel
Dear Linux folks, Am 25.07.20 um 07:20 schrieb Mazin Rezk: On Saturday, July 25, 2020 12:59 AM, Duncan wrote: On Sat, 25 Jul 2020 03:03:52 + Mazin Rezk wrote: Am 24.07.20 um 19:33 schrieb Kees Cook: There was a fix to disable the async path for this driver that worked around the bug t

Re: [PATCH] amdgpu_dm: fix nonblocking atomic commit use-after-free

2020-07-28 Thread Kazlauskas, Nicholas
On 2020-07-28 5:22 a.m., Paul Menzel wrote: Dear Linux folks, Am 25.07.20 um 07:20 schrieb Mazin Rezk: On Saturday, July 25, 2020 12:59 AM, Duncan wrote: On Sat, 25 Jul 2020 03:03:52 + Mazin Rezk wrote: Am 24.07.20 um 19:33 schrieb Kees Cook: There was a fix to disable the async path

Re: [PATCH] amdgpu_dm: fix nonblocking atomic commit use-after-free

2020-07-26 Thread Mazin Rezk
On Saturday, July 25, 2020 12:59 AM, Duncan <1i5t5.dun...@cox.net> wrote: > On Sat, 25 Jul 2020 03:03:52 + > Mazin Rezk mn...@protonmail.com wrote: > > > > Am 24.07.20 um 19:33 schrieb Kees Cook: > > > > > > > There was a fix to disable the async path for this driver that > > > > worked around

Re: [PATCH] amdgpu_dm: fix nonblocking atomic commit use-after-free

2020-07-26 Thread Mazin Rezk
On Thursday, July 23, 2020 6:57 PM, Mazin Rezk wrote: > It seems that I spoke too soon. I ran the system for another hour after > submitting the patch and the bug just occurred. :/ > > Sadly, that means the bug isn't really fixed and that I have to go > investigate further. > > At the very least,

Re: [PATCH] amdgpu_dm: fix nonblocking atomic commit use-after-free

2020-07-26 Thread Mazin Rezk
On Friday, July 24, 2020 5:19 PM, Paul Menzel wrote: > Dear Kees, > > Am 24.07.20 um 19:33 schrieb Kees Cook: > > > On Fri, Jul 24, 2020 at 09:45:18AM +0200, Paul Menzel wrote: > > > > > Am 24.07.20 um 00:32 schrieb Kees Cook: > > > > > > > On Thu, Jul 23, 2020 at 09:10:15PM +, Mazin Rezk wro

Re: [PATCH] amdgpu_dm: fix nonblocking atomic commit use-after-free

2020-07-26 Thread Duncan
On Sat, 25 Jul 2020 03:03:52 + Mazin Rezk wrote: > > Am 24.07.20 um 19:33 schrieb Kees Cook: > > > > > There was a fix to disable the async path for this driver that > > > worked around the bug too, yes? That seems like a safer and more > > > focused change that doesn't revert the SLUB defe

Re: [PATCH] amdgpu_dm: fix nonblocking atomic commit use-after-free

2020-07-26 Thread Paul Menzel
Dear Kees, Am 24.07.20 um 19:33 schrieb Kees Cook: On Fri, Jul 24, 2020 at 09:45:18AM +0200, Paul Menzel wrote: Am 24.07.20 um 00:32 schrieb Kees Cook: On Thu, Jul 23, 2020 at 09:10:15PM +, Mazin Rezk wrote: As Linux 5.8-rc7 is going to be released this Sunday, I wonder, if commit 3202f

Re: [PATCH] amdgpu_dm: fix nonblocking atomic commit use-after-free

2020-07-26 Thread Paul Menzel
Dear Kees, Am 24.07.20 um 00:32 schrieb Kees Cook: On Thu, Jul 23, 2020 at 09:10:15PM +, Mazin Rezk wrote: When amdgpu_dm_atomic_commit_tail is running in the workqueue, drm_atomic_state_put will get called while amdgpu_dm_atomic_commit_tail is running, causing a race condition where state

Re: [PATCH] amdgpu_dm: fix nonblocking atomic commit use-after-free

2020-07-24 Thread Kees Cook
On Fri, Jul 24, 2020 at 09:45:18AM +0200, Paul Menzel wrote: > Am 24.07.20 um 00:32 schrieb Kees Cook: > > On Thu, Jul 23, 2020 at 09:10:15PM +, Mazin Rezk wrote: > As Linux 5.8-rc7 is going to be released this Sunday, I wonder, if commit > 3202fa62f ("slub: relocate freelist pointer to middle

Re: [PATCH] amdgpu_dm: fix nonblocking atomic commit use-after-free

2020-07-24 Thread Mazin Rezk
On Thursday, July 23, 2020 6:32 PM, Kees Cook wrote: > On Thu, Jul 23, 2020 at 09:10:15PM +, Mazin Rezk wrote: > > > When amdgpu_dm_atomic_commit_tail is running in the workqueue, > > drm_atomic_state_put will get called while amdgpu_dm_atomic_commit_tail is > > running, causing a race condit

Re: [PATCH] amdgpu_dm: fix nonblocking atomic commit use-after-free

2020-07-24 Thread Mazin Rezk
It seems that I spoke too soon. I ran the system for another hour after submitting the patch and the bug just occurred. :/ Sadly, that means the bug isn't really fixed and that I have to go investigate further. At the very least, this patch seems to delay the occurrence of the bug significantly w

Re: [PATCH] amdgpu_dm: fix nonblocking atomic commit use-after-free

2020-07-24 Thread Christian König
Am 24.07.20 um 00:58 schrieb Mazin Rezk: On Thursday, July 23, 2020 6:32 PM, Kees Cook wrote: On Thu, Jul 23, 2020 at 09:10:15PM +, Mazin Rezk wrote: When amdgpu_dm_atomic_commit_tail is running in the workqueue, drm_atomic_state_put will get called while amdgpu_dm_atomic_commit_tail is

Re: [PATCH] amdgpu_dm: fix nonblocking atomic commit use-after-free

2020-07-23 Thread Kees Cook
On Thu, Jul 23, 2020 at 09:10:15PM +, Mazin Rezk wrote: > When amdgpu_dm_atomic_commit_tail is running in the workqueue, > drm_atomic_state_put will get called while amdgpu_dm_atomic_commit_tail is > running, causing a race condition where state (and then dm_state) is > sometimes freed while am

Re: [PATCH] amdgpu_dm: fix nonblocking atomic commit use-after-free

2020-07-23 Thread Kazlauskas, Nicholas
On 2020-07-23 5:10 p.m., Mazin Rezk wrote: When amdgpu_dm_atomic_commit_tail is running in the workqueue, drm_atomic_state_put will get called while amdgpu_dm_atomic_commit_tail is running, causing a race condition where state (and then dm_state) is sometimes freed while amdgpu_dm_atomic_commit_t