* [PATCH] drm/tests: provide exit function
@ 2023-09-13 8:32 José Pekkarinen
2023-09-13 9:50 ` Maxime Ripard
0 siblings, 1 reply; 9+ messages in thread
From: José Pekkarinen @ 2023-09-13 8:32 UTC (permalink / raw)
To: airlied, daniel
Cc: José Pekkarinen, christian.koenig, dakr, boris.brezillon,
alexander.deucher, mripard, arthurgrillo, dri-devel,
linux-kernel, linux-kernel-mentees
Running drm_exec_test by modprobing the module I
observe the following output:
[ 424.471936] KTAP version 1
[ 424.471942] 1..1
[ 424.472446] KTAP version 1
[ 424.472450] # Subtest: drm_exec
[ 424.472453] # module: drm_exec_test
[ 424.472459] 1..7
[ 424.479082] ==================================================================
[ 424.479095] BUG: KASAN: slab-use-after-free in drm_dev_put.part.0+0x4b/0x90 [drm]
[ 424.479426] Read of size 8 at addr ffff888132d3e028 by task kunit_try_catch/1866
[ 424.479436]
[ 424.479442] CPU: 1 PID: 1866 Comm: kunit_try_catch Tainted: G N 6.6.0-rc1-dirty #2
[ 424.479446] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
[ 424.479446] Call Trace:
[ 424.479446] <TASK>
[ 424.479446] dump_stack_lvl+0x43/0x60
[ 424.479446] print_report+0xcf/0x660
[ 424.479446] ? __virt_addr_valid+0xd9/0x160
[ 424.479446] ? drm_dev_put.part.0+0x4b/0x90 [drm]
[ 424.479446] kasan_report+0xda/0x110
[ 424.479446] ? drm_dev_put.part.0+0x4b/0x90 [drm]
[ 424.479446] drm_dev_put.part.0+0x4b/0x90 [drm]
[ 424.479446] release_nodes+0x83/0x160
[ 424.479446] devres_release_all+0xe6/0x130
[ 424.479446] ? __pfx_devres_release_all+0x10/0x10
[ 424.479446] ? mutex_unlock+0x80/0xd0
[ 424.479446] ? __pfx_mutex_unlock+0x10/0x10
[ 424.479446] device_unbind_cleanup+0x16/0xc0
[ 424.479446] device_release_driver_internal+0x28b/0x2e0
[ 424.479446] bus_remove_device+0x124/0x1d0
[ 424.479446] device_del+0x23d/0x580
[ 424.479446] ? __pfx_device_del+0x10/0x10
[ 424.479446] ? kasan_set_track+0x21/0x30
[ 424.479446] ? _raw_spin_lock_irqsave+0x98/0xf0
[ 424.479446] platform_device_del.part.0+0x19/0xe0
[ 424.479446] kunit_remove_resource+0xfa/0x140 [kunit]
[ 424.479446] kunit_cleanup+0x47/0xa0 [kunit]
[ 424.479446] ? __pfx_kunit_try_run_case_cleanup+0x10/0x10 [kunit]
[ 424.479446] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [kunit]
[ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
[ 424.479446] kthread+0x184/0x1c0
[ 424.479446] ? __pfx_kthread+0x10/0x10
[ 424.479446] ret_from_fork+0x30/0x50
[ 424.479446] ? __pfx_kthread+0x10/0x10
[ 424.479446] ret_from_fork_asm+0x1b/0x30
[ 424.479446] </TASK>
[ 424.479446]
[ 424.479446] Allocated by task 1865:
[ 424.479446] kasan_save_stack+0x2f/0x50
[ 424.479446] kasan_set_track+0x21/0x30
[ 424.479446] __kasan_kmalloc+0xa6/0xb0
[ 424.479446] __kmalloc+0x5d/0x160
[ 424.479446] kunit_kmalloc_array+0x1c/0x50 [kunit]
[ 424.479446] drm_exec_test_init+0xef/0x260 [drm_exec_test]
[ 424.479446] kunit_try_run_case+0x6e/0x100 [kunit]
[ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
[ 424.479446] kthread+0x184/0x1c0
[ 424.479446] ret_from_fork+0x30/0x50
[ 424.479446] ret_from_fork_asm+0x1b/0x30
[ 424.479446]
[ 424.479446] Freed by task 1866:
[ 424.479446] kasan_save_stack+0x2f/0x50
[ 424.479446] kasan_set_track+0x21/0x30
[ 424.479446] kasan_save_free_info+0x27/0x40
[ 424.479446] ____kasan_slab_free+0x166/0x1c0
[ 424.479446] slab_free_freelist_hook+0x9f/0x1e0
[ 424.479446] __kmem_cache_free+0x187/0x2d0
[ 424.479446] kunit_remove_resource+0xfa/0x140 [kunit]
[ 424.479446] kunit_cleanup+0x47/0xa0 [kunit]
[ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
[ 424.479446] kthread+0x184/0x1c0
[ 424.479446] ret_from_fork+0x30/0x50
[ 424.479446] ret_from_fork_asm+0x1b/0x30
[ 424.479446]
[ 424.479446] The buggy address belongs to the object at ffff888132d3e000
[ 424.479446] which belongs to the cache kmalloc-256 of size 256
[ 424.479446] The buggy address is located 40 bytes inside of
[ 424.479446] freed 256-byte region [ffff888132d3e000, ffff888132d3e100)
[ 424.479446]
[ 424.479446] The buggy address belongs to the physical page:
[ 424.479446] page:0000000092ff6551 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888132d3f600 pfn:0x132d3c
[ 424.479446] head:0000000092ff6551 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 424.479446] ksm flags: 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
[ 424.479446] page_type: 0xffffffff()
[ 424.479446] raw: 0017ffffc0000840 ffff888100042b40 ffffea00042c8000 dead000000000003
[ 424.479446] raw: ffff888132d3f600 000000008020001f 00000001ffffffff 0000000000000000
[ 424.479446] page dumped because: kasan: bad access detected
[ 424.479446]
[ 424.479446] Memory state around the buggy address:
[ 424.479446] ffff888132d3df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 424.479446] ffff888132d3df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 424.479446] >ffff888132d3e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 424.479446] ^
[ 424.479446] ffff888132d3e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 424.479446] ffff888132d3e100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 424.479446] ==================================================================
[ 424.481686] Disabling lock debugging due to kernel taint
[ 424.484124] not ok 1 sanitycheck
[ 424.492981] ok 2 test_lock
[ 424.503610] ok 3 test_lock_unlock
[ 424.515058] ok 4 test_duplicates
[ 424.530453] ok 5 test_prepare
[ 424.539099] ok 6 test_prepare_array
[ 424.550730] ok 7 test_multiple_loops
[ 424.550743] # drm_exec: pass:6 fail:1 skip:0 total:7
[ 424.550750] # Totals: pass:6 fail:1 skip:0 total:7
[ 424.550756] not ok 5 drm_exec
The ouptut suggest the init function is allocating a drm_device
that is not being freed. This patch provides the function and
add it to the kunit_suite to produce the following result of
the test:
[ 3363.342560] KTAP version 1
[ 3363.342571] 1..1
[ 3363.343090] KTAP version 1
[ 3363.343095] # Subtest: drm_exec
[ 3363.343098] # module: drm_exec_test
[ 3363.343103] 1..7
[ 3363.353659] ok 1 sanitycheck
[ 3363.364281] ok 2 test_lock
[ 3363.375616] ok 3 test_lock_unlock
[ 3363.388741] ok 4 test_duplicates
[ 3363.402544] ok 5 test_prepare
[ 3363.413163] ok 6 test_prepare_array
[ 3363.424614] ok 7 test_multiple_loops
[ 3363.424630] # drm_exec: pass:7 fail:0 skip:0 total:7
[ 3363.424637] # Totals: pass:7 fail:0 skip:0 total:7
[ 3363.424643] ok 1 drm_exec
Signed-off-by: José Pekkarinen <jose.pekkarinen@foxhound.fi>
---
drivers/gpu/drm/tests/drm_exec_test.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/gpu/drm/tests/drm_exec_test.c b/drivers/gpu/drm/tests/drm_exec_test.c
index 563949d777dd..7ff6bc6467d4 100644
--- a/drivers/gpu/drm/tests/drm_exec_test.c
+++ b/drivers/gpu/drm/tests/drm_exec_test.c
@@ -42,6 +42,19 @@ static int drm_exec_test_init(struct kunit *test)
return 0;
}
+static void drm_exec_test_exit(struct kunit *test)
+{
+ struct drm_exec_priv *priv = test->priv;
+
+ drm_kunit_helper_free_device(test, priv->dev);
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, priv->dev);
+
+ drm_dev_put(priv->drm);
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, priv->drm);
+
+ kunit_kfree(test, priv);
+}
+
static void sanitycheck(struct kunit *test)
{
struct drm_exec exec;
@@ -204,6 +217,7 @@ static struct kunit_case drm_exec_tests[] = {
static struct kunit_suite drm_exec_test_suite = {
.name = "drm_exec",
.init = drm_exec_test_init,
+ .exit = drm_exec_test_exit,
.test_cases = drm_exec_tests,
};
--
2.39.2
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] drm/tests: provide exit function
2023-09-13 8:32 [PATCH] drm/tests: provide exit function José Pekkarinen
@ 2023-09-13 9:50 ` Maxime Ripard
2023-09-13 14:01 ` José Pekkarinen
0 siblings, 1 reply; 9+ messages in thread
From: Maxime Ripard @ 2023-09-13 9:50 UTC (permalink / raw)
To: José Pekkarinen
Cc: airlied, daniel, christian.koenig, dakr, boris.brezillon,
alexander.deucher, arthurgrillo, dri-devel, linux-kernel,
linux-kernel-mentees
[-- Attachment #1: Type: text/plain, Size: 7825 bytes --]
Hi,
On Wed, Sep 13, 2023 at 11:32:23AM +0300, José Pekkarinen wrote:
> Running drm_exec_test by modprobing the module I
> observe the following output:
>
> [ 424.471936] KTAP version 1
> [ 424.471942] 1..1
> [ 424.472446] KTAP version 1
> [ 424.472450] # Subtest: drm_exec
> [ 424.472453] # module: drm_exec_test
> [ 424.472459] 1..7
> [ 424.479082] ==================================================================
> [ 424.479095] BUG: KASAN: slab-use-after-free in drm_dev_put.part.0+0x4b/0x90 [drm]
> [ 424.479426] Read of size 8 at addr ffff888132d3e028 by task kunit_try_catch/1866
> [ 424.479436]
> [ 424.479442] CPU: 1 PID: 1866 Comm: kunit_try_catch Tainted: G N 6.6.0-rc1-dirty #2
That's suspicious
> [ 424.479446] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
> [ 424.479446] Call Trace:
> [ 424.479446] <TASK>
> [ 424.479446] dump_stack_lvl+0x43/0x60
> [ 424.479446] print_report+0xcf/0x660
> [ 424.479446] ? __virt_addr_valid+0xd9/0x160
> [ 424.479446] ? drm_dev_put.part.0+0x4b/0x90 [drm]
> [ 424.479446] kasan_report+0xda/0x110
> [ 424.479446] ? drm_dev_put.part.0+0x4b/0x90 [drm]
> [ 424.479446] drm_dev_put.part.0+0x4b/0x90 [drm]
> [ 424.479446] release_nodes+0x83/0x160
> [ 424.479446] devres_release_all+0xe6/0x130
> [ 424.479446] ? __pfx_devres_release_all+0x10/0x10
> [ 424.479446] ? mutex_unlock+0x80/0xd0
> [ 424.479446] ? __pfx_mutex_unlock+0x10/0x10
> [ 424.479446] device_unbind_cleanup+0x16/0xc0
> [ 424.479446] device_release_driver_internal+0x28b/0x2e0
> [ 424.479446] bus_remove_device+0x124/0x1d0
> [ 424.479446] device_del+0x23d/0x580
> [ 424.479446] ? __pfx_device_del+0x10/0x10
> [ 424.479446] ? kasan_set_track+0x21/0x30
> [ 424.479446] ? _raw_spin_lock_irqsave+0x98/0xf0
> [ 424.479446] platform_device_del.part.0+0x19/0xe0
> [ 424.479446] kunit_remove_resource+0xfa/0x140 [kunit]
> [ 424.479446] kunit_cleanup+0x47/0xa0 [kunit]
> [ 424.479446] ? __pfx_kunit_try_run_case_cleanup+0x10/0x10 [kunit]
> [ 424.479446] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [kunit]
> [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
> [ 424.479446] kthread+0x184/0x1c0
> [ 424.479446] ? __pfx_kthread+0x10/0x10
> [ 424.479446] ret_from_fork+0x30/0x50
> [ 424.479446] ? __pfx_kthread+0x10/0x10
> [ 424.479446] ret_from_fork_asm+0x1b/0x30
> [ 424.479446] </TASK>
> [ 424.479446]
> [ 424.479446] Allocated by task 1865:
> [ 424.479446] kasan_save_stack+0x2f/0x50
> [ 424.479446] kasan_set_track+0x21/0x30
> [ 424.479446] __kasan_kmalloc+0xa6/0xb0
> [ 424.479446] __kmalloc+0x5d/0x160
> [ 424.479446] kunit_kmalloc_array+0x1c/0x50 [kunit]
> [ 424.479446] drm_exec_test_init+0xef/0x260 [drm_exec_test]
> [ 424.479446] kunit_try_run_case+0x6e/0x100 [kunit]
> [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
> [ 424.479446] kthread+0x184/0x1c0
> [ 424.479446] ret_from_fork+0x30/0x50
> [ 424.479446] ret_from_fork_asm+0x1b/0x30
> [ 424.479446]
> [ 424.479446] Freed by task 1866:
> [ 424.479446] kasan_save_stack+0x2f/0x50
> [ 424.479446] kasan_set_track+0x21/0x30
> [ 424.479446] kasan_save_free_info+0x27/0x40
> [ 424.479446] ____kasan_slab_free+0x166/0x1c0
> [ 424.479446] slab_free_freelist_hook+0x9f/0x1e0
> [ 424.479446] __kmem_cache_free+0x187/0x2d0
> [ 424.479446] kunit_remove_resource+0xfa/0x140 [kunit]
> [ 424.479446] kunit_cleanup+0x47/0xa0 [kunit]
> [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
> [ 424.479446] kthread+0x184/0x1c0
> [ 424.479446] ret_from_fork+0x30/0x50
> [ 424.479446] ret_from_fork_asm+0x1b/0x30
> [ 424.479446]
> [ 424.479446] The buggy address belongs to the object at ffff888132d3e000
> [ 424.479446] which belongs to the cache kmalloc-256 of size 256
> [ 424.479446] The buggy address is located 40 bytes inside of
> [ 424.479446] freed 256-byte region [ffff888132d3e000, ffff888132d3e100)
> [ 424.479446]
> [ 424.479446] The buggy address belongs to the physical page:
> [ 424.479446] page:0000000092ff6551 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888132d3f600 pfn:0x132d3c
> [ 424.479446] head:0000000092ff6551 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> [ 424.479446] ksm flags: 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
> [ 424.479446] page_type: 0xffffffff()
> [ 424.479446] raw: 0017ffffc0000840 ffff888100042b40 ffffea00042c8000 dead000000000003
> [ 424.479446] raw: ffff888132d3f600 000000008020001f 00000001ffffffff 0000000000000000
> [ 424.479446] page dumped because: kasan: bad access detected
> [ 424.479446]
> [ 424.479446] Memory state around the buggy address:
> [ 424.479446] ffff888132d3df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 424.479446] ffff888132d3df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 424.479446] >ffff888132d3e000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 424.479446] ^
> [ 424.479446] ffff888132d3e080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 424.479446] ffff888132d3e100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 424.479446] ==================================================================
> [ 424.481686] Disabling lock debugging due to kernel taint
> [ 424.484124] not ok 1 sanitycheck
> [ 424.492981] ok 2 test_lock
> [ 424.503610] ok 3 test_lock_unlock
> [ 424.515058] ok 4 test_duplicates
> [ 424.530453] ok 5 test_prepare
> [ 424.539099] ok 6 test_prepare_array
> [ 424.550730] ok 7 test_multiple_loops
> [ 424.550743] # drm_exec: pass:6 fail:1 skip:0 total:7
> [ 424.550750] # Totals: pass:6 fail:1 skip:0 total:7
> [ 424.550756] not ok 5 drm_exec
>
> The ouptut suggest the init function is allocating a drm_device
> that is not being freed. This patch provides the function and
> add it to the kunit_suite to produce the following result of
> the test:
>
> [ 3363.342560] KTAP version 1
> [ 3363.342571] 1..1
> [ 3363.343090] KTAP version 1
> [ 3363.343095] # Subtest: drm_exec
> [ 3363.343098] # module: drm_exec_test
> [ 3363.343103] 1..7
> [ 3363.353659] ok 1 sanitycheck
> [ 3363.364281] ok 2 test_lock
> [ 3363.375616] ok 3 test_lock_unlock
> [ 3363.388741] ok 4 test_duplicates
> [ 3363.402544] ok 5 test_prepare
> [ 3363.413163] ok 6 test_prepare_array
> [ 3363.424614] ok 7 test_multiple_loops
> [ 3363.424630] # drm_exec: pass:7 fail:0 skip:0 total:7
> [ 3363.424637] # Totals: pass:7 fail:0 skip:0 total:7
> [ 3363.424643] ok 1 drm_exec
>
> Signed-off-by: José Pekkarinen <jose.pekkarinen@foxhound.fi>
> ---
> drivers/gpu/drm/tests/drm_exec_test.c | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)
>
> diff --git a/drivers/gpu/drm/tests/drm_exec_test.c b/drivers/gpu/drm/tests/drm_exec_test.c
> index 563949d777dd..7ff6bc6467d4 100644
> --- a/drivers/gpu/drm/tests/drm_exec_test.c
> +++ b/drivers/gpu/drm/tests/drm_exec_test.c
> @@ -42,6 +42,19 @@ static int drm_exec_test_init(struct kunit *test)
> return 0;
> }
>
> +static void drm_exec_test_exit(struct kunit *test)
> +{
> + struct drm_exec_priv *priv = test->priv;
> +
> + drm_kunit_helper_free_device(test, priv->dev);
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, priv->dev);
This shouldn't be necessary at all since 4f2b0b583baa.
> + drm_dev_put(priv->drm);
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, priv->drm);
This isn't needed with devm_drm_dev_alloc
> + kunit_kfree(test, priv);
And that's not needed either, kunit actions will be run automatically.
Maxime
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] drm/tests: provide exit function
2023-09-13 9:50 ` Maxime Ripard
@ 2023-09-13 14:01 ` José Pekkarinen
2023-09-13 14:41 ` mripard
0 siblings, 1 reply; 9+ messages in thread
From: José Pekkarinen @ 2023-09-13 14:01 UTC (permalink / raw)
To: Maxime Ripard
Cc: airlied, daniel, christian.koenig, dakr, boris.brezillon,
alexander.deucher, arthurgrillo, dri-devel, linux-kernel,
linux-kernel-mentees
On 2023-09-13 12:50, Maxime Ripard wrote:
> Hi,
>
> On Wed, Sep 13, 2023 at 11:32:23AM +0300, José Pekkarinen wrote:
>> Running drm_exec_test by modprobing the module I
>> observe the following output:
>>
>> [ 424.471936] KTAP version 1
>> [ 424.471942] 1..1
>> [ 424.472446] KTAP version 1
>> [ 424.472450] # Subtest: drm_exec
>> [ 424.472453] # module: drm_exec_test
>> [ 424.472459] 1..7
>> [ 424.479082]
>> ==================================================================
>> [ 424.479095] BUG: KASAN: slab-use-after-free in
>> drm_dev_put.part.0+0x4b/0x90 [drm]
>> [ 424.479426] Read of size 8 at addr ffff888132d3e028 by task
>> kunit_try_catch/1866
>> [ 424.479436]
>> [ 424.479442] CPU: 1 PID: 1866 Comm: kunit_try_catch Tainted: G
>> N 6.6.0-rc1-dirty #2
>
> That's suspicious
>
>> [ 424.479446] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
>> BIOS 0.0.0 02/06/2015
>> [ 424.479446] Call Trace:
>> [ 424.479446] <TASK>
>> [ 424.479446] dump_stack_lvl+0x43/0x60
>> [ 424.479446] print_report+0xcf/0x660
>> [ 424.479446] ? __virt_addr_valid+0xd9/0x160
>> [ 424.479446] ? drm_dev_put.part.0+0x4b/0x90 [drm]
>> [ 424.479446] kasan_report+0xda/0x110
>> [ 424.479446] ? drm_dev_put.part.0+0x4b/0x90 [drm]
>> [ 424.479446] drm_dev_put.part.0+0x4b/0x90 [drm]
>> [ 424.479446] release_nodes+0x83/0x160
>> [ 424.479446] devres_release_all+0xe6/0x130
>> [ 424.479446] ? __pfx_devres_release_all+0x10/0x10
>> [ 424.479446] ? mutex_unlock+0x80/0xd0
>> [ 424.479446] ? __pfx_mutex_unlock+0x10/0x10
>> [ 424.479446] device_unbind_cleanup+0x16/0xc0
>> [ 424.479446] device_release_driver_internal+0x28b/0x2e0
>> [ 424.479446] bus_remove_device+0x124/0x1d0
>> [ 424.479446] device_del+0x23d/0x580
>> [ 424.479446] ? __pfx_device_del+0x10/0x10
>> [ 424.479446] ? kasan_set_track+0x21/0x30
>> [ 424.479446] ? _raw_spin_lock_irqsave+0x98/0xf0
>> [ 424.479446] platform_device_del.part.0+0x19/0xe0
>> [ 424.479446] kunit_remove_resource+0xfa/0x140 [kunit]
>> [ 424.479446] kunit_cleanup+0x47/0xa0 [kunit]
>> [ 424.479446] ? __pfx_kunit_try_run_case_cleanup+0x10/0x10 [kunit]
>> [ 424.479446] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
>> [kunit]
>> [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
>> [ 424.479446] kthread+0x184/0x1c0
>> [ 424.479446] ? __pfx_kthread+0x10/0x10
>> [ 424.479446] ret_from_fork+0x30/0x50
>> [ 424.479446] ? __pfx_kthread+0x10/0x10
>> [ 424.479446] ret_from_fork_asm+0x1b/0x30
>> [ 424.479446] </TASK>
>> [ 424.479446]
>> [ 424.479446] Allocated by task 1865:
>> [ 424.479446] kasan_save_stack+0x2f/0x50
>> [ 424.479446] kasan_set_track+0x21/0x30
>> [ 424.479446] __kasan_kmalloc+0xa6/0xb0
>> [ 424.479446] __kmalloc+0x5d/0x160
>> [ 424.479446] kunit_kmalloc_array+0x1c/0x50 [kunit]
>> [ 424.479446] drm_exec_test_init+0xef/0x260 [drm_exec_test]
>> [ 424.479446] kunit_try_run_case+0x6e/0x100 [kunit]
>> [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
>> [ 424.479446] kthread+0x184/0x1c0
>> [ 424.479446] ret_from_fork+0x30/0x50
>> [ 424.479446] ret_from_fork_asm+0x1b/0x30
>> [ 424.479446]
>> [ 424.479446] Freed by task 1866:
>> [ 424.479446] kasan_save_stack+0x2f/0x50
>> [ 424.479446] kasan_set_track+0x21/0x30
>> [ 424.479446] kasan_save_free_info+0x27/0x40
>> [ 424.479446] ____kasan_slab_free+0x166/0x1c0
>> [ 424.479446] slab_free_freelist_hook+0x9f/0x1e0
>> [ 424.479446] __kmem_cache_free+0x187/0x2d0
>> [ 424.479446] kunit_remove_resource+0xfa/0x140 [kunit]
>> [ 424.479446] kunit_cleanup+0x47/0xa0 [kunit]
>> [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
>> [ 424.479446] kthread+0x184/0x1c0
>> [ 424.479446] ret_from_fork+0x30/0x50
>> [ 424.479446] ret_from_fork_asm+0x1b/0x30
>> [ 424.479446]
>> [ 424.479446] The buggy address belongs to the object at
>> ffff888132d3e000
>> [ 424.479446] which belongs to the cache kmalloc-256 of size 256
>> [ 424.479446] The buggy address is located 40 bytes inside of
>> [ 424.479446] freed 256-byte region [ffff888132d3e000,
>> ffff888132d3e100)
>> [ 424.479446]
>> [ 424.479446] The buggy address belongs to the physical page:
>> [ 424.479446] page:0000000092ff6551 refcount:1 mapcount:0
>> mapping:0000000000000000 index:0xffff888132d3f600 pfn:0x132d3c
>> [ 424.479446] head:0000000092ff6551 order:2 entire_mapcount:0
>> nr_pages_mapped:0 pincount:0
>> [ 424.479446] ksm flags:
>> 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
>> [ 424.479446] page_type: 0xffffffff()
>> [ 424.479446] raw: 0017ffffc0000840 ffff888100042b40 ffffea00042c8000
>> dead000000000003
>> [ 424.479446] raw: ffff888132d3f600 000000008020001f 00000001ffffffff
>> 0000000000000000
>> [ 424.479446] page dumped because: kasan: bad access detected
>> [ 424.479446]
>> [ 424.479446] Memory state around the buggy address:
>> [ 424.479446] ffff888132d3df00: fc fc fc fc fc fc fc fc fc fc fc fc
>> fc fc fc fc
>> [ 424.479446] ffff888132d3df80: fc fc fc fc fc fc fc fc fc fc fc fc
>> fc fc fc fc
>> [ 424.479446] >ffff888132d3e000: fa fb fb fb fb fb fb fb fb fb fb fb
>> fb fb fb fb
>> [ 424.479446] ^
>> [ 424.479446] ffff888132d3e080: fb fb fb fb fb fb fb fb fb fb fb fb
>> fb fb fb fb
>> [ 424.479446] ffff888132d3e100: fc fc fc fc fc fc fc fc fc fc fc fc
>> fc fc fc fc
>> [ 424.479446]
>> ==================================================================
>> [ 424.481686] Disabling lock debugging due to kernel taint
>> [ 424.484124] not ok 1 sanitycheck
>> [ 424.492981] ok 2 test_lock
>> [ 424.503610] ok 3 test_lock_unlock
>> [ 424.515058] ok 4 test_duplicates
>> [ 424.530453] ok 5 test_prepare
>> [ 424.539099] ok 6 test_prepare_array
>> [ 424.550730] ok 7 test_multiple_loops
>> [ 424.550743] # drm_exec: pass:6 fail:1 skip:0 total:7
>> [ 424.550750] # Totals: pass:6 fail:1 skip:0 total:7
>> [ 424.550756] not ok 5 drm_exec
>>
>> The ouptut suggest the init function is allocating a drm_device
>> that is not being freed. This patch provides the function and
>> add it to the kunit_suite to produce the following result of
>> the test:
>>
>> [ 3363.342560] KTAP version 1
>> [ 3363.342571] 1..1
>> [ 3363.343090] KTAP version 1
>> [ 3363.343095] # Subtest: drm_exec
>> [ 3363.343098] # module: drm_exec_test
>> [ 3363.343103] 1..7
>> [ 3363.353659] ok 1 sanitycheck
>> [ 3363.364281] ok 2 test_lock
>> [ 3363.375616] ok 3 test_lock_unlock
>> [ 3363.388741] ok 4 test_duplicates
>> [ 3363.402544] ok 5 test_prepare
>> [ 3363.413163] ok 6 test_prepare_array
>> [ 3363.424614] ok 7 test_multiple_loops
>> [ 3363.424630] # drm_exec: pass:7 fail:0 skip:0 total:7
>> [ 3363.424637] # Totals: pass:7 fail:0 skip:0 total:7
>> [ 3363.424643] ok 1 drm_exec
>>
>> Signed-off-by: José Pekkarinen <jose.pekkarinen@foxhound.fi>
>> ---
>> drivers/gpu/drm/tests/drm_exec_test.c | 14 ++++++++++++++
>> 1 file changed, 14 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/tests/drm_exec_test.c
>> b/drivers/gpu/drm/tests/drm_exec_test.c
>> index 563949d777dd..7ff6bc6467d4 100644
>> --- a/drivers/gpu/drm/tests/drm_exec_test.c
>> +++ b/drivers/gpu/drm/tests/drm_exec_test.c
>> @@ -42,6 +42,19 @@ static int drm_exec_test_init(struct kunit *test)
>> return 0;
>> }
>>
>> +static void drm_exec_test_exit(struct kunit *test)
>> +{
>> + struct drm_exec_priv *priv = test->priv;
>> +
>> + drm_kunit_helper_free_device(test, priv->dev);
>> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, priv->dev);
>
> This shouldn't be necessary at all since 4f2b0b583baa.
Reading this suggested patch I see only references
to platform_driver_unregister, platform_device_put, and
platform_device_del, not the ones used in this patch.
Thanks!
José.
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] drm/tests: provide exit function
2023-09-13 14:01 ` José Pekkarinen
@ 2023-09-13 14:41 ` mripard
2023-09-13 16:35 ` José Pekkarinen
0 siblings, 1 reply; 9+ messages in thread
From: mripard @ 2023-09-13 14:41 UTC (permalink / raw)
To: José Pekkarinen
Cc: airlied, daniel, christian.koenig, dakr, boris.brezillon,
alexander.deucher, arthurgrillo, dri-devel, linux-kernel,
linux-kernel-mentees
[-- Attachment #1: Type: text/plain, Size: 8693 bytes --]
On Wed, Sep 13, 2023 at 05:01:40PM +0300, José Pekkarinen wrote:
> On 2023-09-13 12:50, Maxime Ripard wrote:
> > Hi,
> >
> > On Wed, Sep 13, 2023 at 11:32:23AM +0300, José Pekkarinen wrote:
> > > Running drm_exec_test by modprobing the module I
> > > observe the following output:
> > >
> > > [ 424.471936] KTAP version 1
> > > [ 424.471942] 1..1
> > > [ 424.472446] KTAP version 1
> > > [ 424.472450] # Subtest: drm_exec
> > > [ 424.472453] # module: drm_exec_test
> > > [ 424.472459] 1..7
> > > [ 424.479082]
> > > ==================================================================
> > > [ 424.479095] BUG: KASAN: slab-use-after-free in
> > > drm_dev_put.part.0+0x4b/0x90 [drm]
> > > [ 424.479426] Read of size 8 at addr ffff888132d3e028 by task
> > > kunit_try_catch/1866
> > > [ 424.479436]
> > > [ 424.479442] CPU: 1 PID: 1866 Comm: kunit_try_catch Tainted: G
> > > N 6.6.0-rc1-dirty #2
> >
> > That's suspicious
> >
> > > [ 424.479446] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
> > > BIOS 0.0.0 02/06/2015
> > > [ 424.479446] Call Trace:
> > > [ 424.479446] <TASK>
> > > [ 424.479446] dump_stack_lvl+0x43/0x60
> > > [ 424.479446] print_report+0xcf/0x660
> > > [ 424.479446] ? __virt_addr_valid+0xd9/0x160
> > > [ 424.479446] ? drm_dev_put.part.0+0x4b/0x90 [drm]
> > > [ 424.479446] kasan_report+0xda/0x110
> > > [ 424.479446] ? drm_dev_put.part.0+0x4b/0x90 [drm]
> > > [ 424.479446] drm_dev_put.part.0+0x4b/0x90 [drm]
> > > [ 424.479446] release_nodes+0x83/0x160
> > > [ 424.479446] devres_release_all+0xe6/0x130
> > > [ 424.479446] ? __pfx_devres_release_all+0x10/0x10
> > > [ 424.479446] ? mutex_unlock+0x80/0xd0
> > > [ 424.479446] ? __pfx_mutex_unlock+0x10/0x10
> > > [ 424.479446] device_unbind_cleanup+0x16/0xc0
> > > [ 424.479446] device_release_driver_internal+0x28b/0x2e0
> > > [ 424.479446] bus_remove_device+0x124/0x1d0
> > > [ 424.479446] device_del+0x23d/0x580
> > > [ 424.479446] ? __pfx_device_del+0x10/0x10
> > > [ 424.479446] ? kasan_set_track+0x21/0x30
> > > [ 424.479446] ? _raw_spin_lock_irqsave+0x98/0xf0
> > > [ 424.479446] platform_device_del.part.0+0x19/0xe0
> > > [ 424.479446] kunit_remove_resource+0xfa/0x140 [kunit]
> > > [ 424.479446] kunit_cleanup+0x47/0xa0 [kunit]
> > > [ 424.479446] ? __pfx_kunit_try_run_case_cleanup+0x10/0x10 [kunit]
> > > [ 424.479446] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
> > > [kunit]
> > > [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
> > > [ 424.479446] kthread+0x184/0x1c0
> > > [ 424.479446] ? __pfx_kthread+0x10/0x10
> > > [ 424.479446] ret_from_fork+0x30/0x50
> > > [ 424.479446] ? __pfx_kthread+0x10/0x10
> > > [ 424.479446] ret_from_fork_asm+0x1b/0x30
> > > [ 424.479446] </TASK>
> > > [ 424.479446]
> > > [ 424.479446] Allocated by task 1865:
> > > [ 424.479446] kasan_save_stack+0x2f/0x50
> > > [ 424.479446] kasan_set_track+0x21/0x30
> > > [ 424.479446] __kasan_kmalloc+0xa6/0xb0
> > > [ 424.479446] __kmalloc+0x5d/0x160
> > > [ 424.479446] kunit_kmalloc_array+0x1c/0x50 [kunit]
> > > [ 424.479446] drm_exec_test_init+0xef/0x260 [drm_exec_test]
> > > [ 424.479446] kunit_try_run_case+0x6e/0x100 [kunit]
> > > [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
> > > [ 424.479446] kthread+0x184/0x1c0
> > > [ 424.479446] ret_from_fork+0x30/0x50
> > > [ 424.479446] ret_from_fork_asm+0x1b/0x30
> > > [ 424.479446]
> > > [ 424.479446] Freed by task 1866:
> > > [ 424.479446] kasan_save_stack+0x2f/0x50
> > > [ 424.479446] kasan_set_track+0x21/0x30
> > > [ 424.479446] kasan_save_free_info+0x27/0x40
> > > [ 424.479446] ____kasan_slab_free+0x166/0x1c0
> > > [ 424.479446] slab_free_freelist_hook+0x9f/0x1e0
> > > [ 424.479446] __kmem_cache_free+0x187/0x2d0
> > > [ 424.479446] kunit_remove_resource+0xfa/0x140 [kunit]
> > > [ 424.479446] kunit_cleanup+0x47/0xa0 [kunit]
> > > [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
> > > [ 424.479446] kthread+0x184/0x1c0
> > > [ 424.479446] ret_from_fork+0x30/0x50
> > > [ 424.479446] ret_from_fork_asm+0x1b/0x30
> > > [ 424.479446]
> > > [ 424.479446] The buggy address belongs to the object at
> > > ffff888132d3e000
> > > [ 424.479446] which belongs to the cache kmalloc-256 of size 256
> > > [ 424.479446] The buggy address is located 40 bytes inside of
> > > [ 424.479446] freed 256-byte region [ffff888132d3e000,
> > > ffff888132d3e100)
> > > [ 424.479446]
> > > [ 424.479446] The buggy address belongs to the physical page:
> > > [ 424.479446] page:0000000092ff6551 refcount:1 mapcount:0
> > > mapping:0000000000000000 index:0xffff888132d3f600 pfn:0x132d3c
> > > [ 424.479446] head:0000000092ff6551 order:2 entire_mapcount:0
> > > nr_pages_mapped:0 pincount:0
> > > [ 424.479446] ksm flags:
> > > 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
> > > [ 424.479446] page_type: 0xffffffff()
> > > [ 424.479446] raw: 0017ffffc0000840 ffff888100042b40
> > > ffffea00042c8000 dead000000000003
> > > [ 424.479446] raw: ffff888132d3f600 000000008020001f
> > > 00000001ffffffff 0000000000000000
> > > [ 424.479446] page dumped because: kasan: bad access detected
> > > [ 424.479446]
> > > [ 424.479446] Memory state around the buggy address:
> > > [ 424.479446] ffff888132d3df00: fc fc fc fc fc fc fc fc fc fc fc
> > > fc fc fc fc fc
> > > [ 424.479446] ffff888132d3df80: fc fc fc fc fc fc fc fc fc fc fc
> > > fc fc fc fc fc
> > > [ 424.479446] >ffff888132d3e000: fa fb fb fb fb fb fb fb fb fb fb
> > > fb fb fb fb fb
> > > [ 424.479446] ^
> > > [ 424.479446] ffff888132d3e080: fb fb fb fb fb fb fb fb fb fb fb
> > > fb fb fb fb fb
> > > [ 424.479446] ffff888132d3e100: fc fc fc fc fc fc fc fc fc fc fc
> > > fc fc fc fc fc
> > > [ 424.479446]
> > > ==================================================================
> > > [ 424.481686] Disabling lock debugging due to kernel taint
> > > [ 424.484124] not ok 1 sanitycheck
> > > [ 424.492981] ok 2 test_lock
> > > [ 424.503610] ok 3 test_lock_unlock
> > > [ 424.515058] ok 4 test_duplicates
> > > [ 424.530453] ok 5 test_prepare
> > > [ 424.539099] ok 6 test_prepare_array
> > > [ 424.550730] ok 7 test_multiple_loops
> > > [ 424.550743] # drm_exec: pass:6 fail:1 skip:0 total:7
> > > [ 424.550750] # Totals: pass:6 fail:1 skip:0 total:7
> > > [ 424.550756] not ok 5 drm_exec
> > >
> > > The ouptut suggest the init function is allocating a drm_device
> > > that is not being freed. This patch provides the function and
> > > add it to the kunit_suite to produce the following result of
> > > the test:
> > >
> > > [ 3363.342560] KTAP version 1
> > > [ 3363.342571] 1..1
> > > [ 3363.343090] KTAP version 1
> > > [ 3363.343095] # Subtest: drm_exec
> > > [ 3363.343098] # module: drm_exec_test
> > > [ 3363.343103] 1..7
> > > [ 3363.353659] ok 1 sanitycheck
> > > [ 3363.364281] ok 2 test_lock
> > > [ 3363.375616] ok 3 test_lock_unlock
> > > [ 3363.388741] ok 4 test_duplicates
> > > [ 3363.402544] ok 5 test_prepare
> > > [ 3363.413163] ok 6 test_prepare_array
> > > [ 3363.424614] ok 7 test_multiple_loops
> > > [ 3363.424630] # drm_exec: pass:7 fail:0 skip:0 total:7
> > > [ 3363.424637] # Totals: pass:7 fail:0 skip:0 total:7
> > > [ 3363.424643] ok 1 drm_exec
> > >
> > > Signed-off-by: José Pekkarinen <jose.pekkarinen@foxhound.fi>
> > > ---
> > > drivers/gpu/drm/tests/drm_exec_test.c | 14 ++++++++++++++
> > > 1 file changed, 14 insertions(+)
> > >
> > > diff --git a/drivers/gpu/drm/tests/drm_exec_test.c
> > > b/drivers/gpu/drm/tests/drm_exec_test.c
> > > index 563949d777dd..7ff6bc6467d4 100644
> > > --- a/drivers/gpu/drm/tests/drm_exec_test.c
> > > +++ b/drivers/gpu/drm/tests/drm_exec_test.c
> > > @@ -42,6 +42,19 @@ static int drm_exec_test_init(struct kunit *test)
> > > return 0;
> > > }
> > >
> > > +static void drm_exec_test_exit(struct kunit *test)
> > > +{
> > > + struct drm_exec_priv *priv = test->priv;
> > > +
> > > + drm_kunit_helper_free_device(test, priv->dev);
> > > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, priv->dev);
> >
> > This shouldn't be necessary at all since 4f2b0b583baa.
>
>
> Reading this suggested patch I see only references to
> platform_driver_unregister, platform_device_put, and
> platform_device_del, not the ones used in this patch.
I mean, what is drm_kunit_helper_free_device calling?
Maxime
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] drm/tests: provide exit function
2023-09-13 14:41 ` mripard
@ 2023-09-13 16:35 ` José Pekkarinen
2023-09-14 12:00 ` Maxime Ripard
0 siblings, 1 reply; 9+ messages in thread
From: José Pekkarinen @ 2023-09-13 16:35 UTC (permalink / raw)
To: mripard
Cc: airlied, daniel, christian.koenig, dakr, boris.brezillon,
alexander.deucher, arthurgrillo, dri-devel, linux-kernel,
linux-kernel-mentees
On 2023-09-13 17:41, mripard@kernel.org wrote:
> On Wed, Sep 13, 2023 at 05:01:40PM +0300, José Pekkarinen wrote:
>> On 2023-09-13 12:50, Maxime Ripard wrote:
>> > Hi,
>> >
>> > On Wed, Sep 13, 2023 at 11:32:23AM +0300, José Pekkarinen wrote:
>> > > Running drm_exec_test by modprobing the module I
>> > > observe the following output:
>> > >
>> > > [ 424.471936] KTAP version 1
>> > > [ 424.471942] 1..1
>> > > [ 424.472446] KTAP version 1
>> > > [ 424.472450] # Subtest: drm_exec
>> > > [ 424.472453] # module: drm_exec_test
>> > > [ 424.472459] 1..7
>> > > [ 424.479082]
>> > > ==================================================================
>> > > [ 424.479095] BUG: KASAN: slab-use-after-free in
>> > > drm_dev_put.part.0+0x4b/0x90 [drm]
>> > > [ 424.479426] Read of size 8 at addr ffff888132d3e028 by task
>> > > kunit_try_catch/1866
>> > > [ 424.479436]
>> > > [ 424.479442] CPU: 1 PID: 1866 Comm: kunit_try_catch Tainted: G
>> > > N 6.6.0-rc1-dirty #2
>> >
>> > That's suspicious
>> >
>> > > [ 424.479446] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
>> > > BIOS 0.0.0 02/06/2015
>> > > [ 424.479446] Call Trace:
>> > > [ 424.479446] <TASK>
>> > > [ 424.479446] dump_stack_lvl+0x43/0x60
>> > > [ 424.479446] print_report+0xcf/0x660
>> > > [ 424.479446] ? __virt_addr_valid+0xd9/0x160
>> > > [ 424.479446] ? drm_dev_put.part.0+0x4b/0x90 [drm]
>> > > [ 424.479446] kasan_report+0xda/0x110
>> > > [ 424.479446] ? drm_dev_put.part.0+0x4b/0x90 [drm]
>> > > [ 424.479446] drm_dev_put.part.0+0x4b/0x90 [drm]
>> > > [ 424.479446] release_nodes+0x83/0x160
>> > > [ 424.479446] devres_release_all+0xe6/0x130
>> > > [ 424.479446] ? __pfx_devres_release_all+0x10/0x10
>> > > [ 424.479446] ? mutex_unlock+0x80/0xd0
>> > > [ 424.479446] ? __pfx_mutex_unlock+0x10/0x10
>> > > [ 424.479446] device_unbind_cleanup+0x16/0xc0
>> > > [ 424.479446] device_release_driver_internal+0x28b/0x2e0
>> > > [ 424.479446] bus_remove_device+0x124/0x1d0
>> > > [ 424.479446] device_del+0x23d/0x580
>> > > [ 424.479446] ? __pfx_device_del+0x10/0x10
>> > > [ 424.479446] ? kasan_set_track+0x21/0x30
>> > > [ 424.479446] ? _raw_spin_lock_irqsave+0x98/0xf0
>> > > [ 424.479446] platform_device_del.part.0+0x19/0xe0
>> > > [ 424.479446] kunit_remove_resource+0xfa/0x140 [kunit]
>> > > [ 424.479446] kunit_cleanup+0x47/0xa0 [kunit]
>> > > [ 424.479446] ? __pfx_kunit_try_run_case_cleanup+0x10/0x10 [kunit]
>> > > [ 424.479446] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
>> > > [kunit]
>> > > [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
>> > > [ 424.479446] kthread+0x184/0x1c0
>> > > [ 424.479446] ? __pfx_kthread+0x10/0x10
>> > > [ 424.479446] ret_from_fork+0x30/0x50
>> > > [ 424.479446] ? __pfx_kthread+0x10/0x10
>> > > [ 424.479446] ret_from_fork_asm+0x1b/0x30
>> > > [ 424.479446] </TASK>
>> > > [ 424.479446]
>> > > [ 424.479446] Allocated by task 1865:
>> > > [ 424.479446] kasan_save_stack+0x2f/0x50
>> > > [ 424.479446] kasan_set_track+0x21/0x30
>> > > [ 424.479446] __kasan_kmalloc+0xa6/0xb0
>> > > [ 424.479446] __kmalloc+0x5d/0x160
>> > > [ 424.479446] kunit_kmalloc_array+0x1c/0x50 [kunit]
>> > > [ 424.479446] drm_exec_test_init+0xef/0x260 [drm_exec_test]
>> > > [ 424.479446] kunit_try_run_case+0x6e/0x100 [kunit]
>> > > [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
>> > > [ 424.479446] kthread+0x184/0x1c0
>> > > [ 424.479446] ret_from_fork+0x30/0x50
>> > > [ 424.479446] ret_from_fork_asm+0x1b/0x30
>> > > [ 424.479446]
>> > > [ 424.479446] Freed by task 1866:
>> > > [ 424.479446] kasan_save_stack+0x2f/0x50
>> > > [ 424.479446] kasan_set_track+0x21/0x30
>> > > [ 424.479446] kasan_save_free_info+0x27/0x40
>> > > [ 424.479446] ____kasan_slab_free+0x166/0x1c0
>> > > [ 424.479446] slab_free_freelist_hook+0x9f/0x1e0
>> > > [ 424.479446] __kmem_cache_free+0x187/0x2d0
>> > > [ 424.479446] kunit_remove_resource+0xfa/0x140 [kunit]
>> > > [ 424.479446] kunit_cleanup+0x47/0xa0 [kunit]
>> > > [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
>> > > [ 424.479446] kthread+0x184/0x1c0
>> > > [ 424.479446] ret_from_fork+0x30/0x50
>> > > [ 424.479446] ret_from_fork_asm+0x1b/0x30
>> > > [ 424.479446]
>> > > [ 424.479446] The buggy address belongs to the object at
>> > > ffff888132d3e000
>> > > [ 424.479446] which belongs to the cache kmalloc-256 of size 256
>> > > [ 424.479446] The buggy address is located 40 bytes inside of
>> > > [ 424.479446] freed 256-byte region [ffff888132d3e000,
>> > > ffff888132d3e100)
>> > > [ 424.479446]
>> > > [ 424.479446] The buggy address belongs to the physical page:
>> > > [ 424.479446] page:0000000092ff6551 refcount:1 mapcount:0
>> > > mapping:0000000000000000 index:0xffff888132d3f600 pfn:0x132d3c
>> > > [ 424.479446] head:0000000092ff6551 order:2 entire_mapcount:0
>> > > nr_pages_mapped:0 pincount:0
>> > > [ 424.479446] ksm flags:
>> > > 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
>> > > [ 424.479446] page_type: 0xffffffff()
>> > > [ 424.479446] raw: 0017ffffc0000840 ffff888100042b40
>> > > ffffea00042c8000 dead000000000003
>> > > [ 424.479446] raw: ffff888132d3f600 000000008020001f
>> > > 00000001ffffffff 0000000000000000
>> > > [ 424.479446] page dumped because: kasan: bad access detected
>> > > [ 424.479446]
>> > > [ 424.479446] Memory state around the buggy address:
>> > > [ 424.479446] ffff888132d3df00: fc fc fc fc fc fc fc fc fc fc fc
>> > > fc fc fc fc fc
>> > > [ 424.479446] ffff888132d3df80: fc fc fc fc fc fc fc fc fc fc fc
>> > > fc fc fc fc fc
>> > > [ 424.479446] >ffff888132d3e000: fa fb fb fb fb fb fb fb fb fb fb
>> > > fb fb fb fb fb
>> > > [ 424.479446] ^
>> > > [ 424.479446] ffff888132d3e080: fb fb fb fb fb fb fb fb fb fb fb
>> > > fb fb fb fb fb
>> > > [ 424.479446] ffff888132d3e100: fc fc fc fc fc fc fc fc fc fc fc
>> > > fc fc fc fc fc
>> > > [ 424.479446]
>> > > ==================================================================
>> > > [ 424.481686] Disabling lock debugging due to kernel taint
>> > > [ 424.484124] not ok 1 sanitycheck
>> > > [ 424.492981] ok 2 test_lock
>> > > [ 424.503610] ok 3 test_lock_unlock
>> > > [ 424.515058] ok 4 test_duplicates
>> > > [ 424.530453] ok 5 test_prepare
>> > > [ 424.539099] ok 6 test_prepare_array
>> > > [ 424.550730] ok 7 test_multiple_loops
>> > > [ 424.550743] # drm_exec: pass:6 fail:1 skip:0 total:7
>> > > [ 424.550750] # Totals: pass:6 fail:1 skip:0 total:7
>> > > [ 424.550756] not ok 5 drm_exec
>> > >
>> > > The ouptut suggest the init function is allocating a drm_device
>> > > that is not being freed. This patch provides the function and
>> > > add it to the kunit_suite to produce the following result of
>> > > the test:
>> > >
>> > > [ 3363.342560] KTAP version 1
>> > > [ 3363.342571] 1..1
>> > > [ 3363.343090] KTAP version 1
>> > > [ 3363.343095] # Subtest: drm_exec
>> > > [ 3363.343098] # module: drm_exec_test
>> > > [ 3363.343103] 1..7
>> > > [ 3363.353659] ok 1 sanitycheck
>> > > [ 3363.364281] ok 2 test_lock
>> > > [ 3363.375616] ok 3 test_lock_unlock
>> > > [ 3363.388741] ok 4 test_duplicates
>> > > [ 3363.402544] ok 5 test_prepare
>> > > [ 3363.413163] ok 6 test_prepare_array
>> > > [ 3363.424614] ok 7 test_multiple_loops
>> > > [ 3363.424630] # drm_exec: pass:7 fail:0 skip:0 total:7
>> > > [ 3363.424637] # Totals: pass:7 fail:0 skip:0 total:7
>> > > [ 3363.424643] ok 1 drm_exec
>> > >
>> > > Signed-off-by: José Pekkarinen <jose.pekkarinen@foxhound.fi>
>> > > ---
>> > > drivers/gpu/drm/tests/drm_exec_test.c | 14 ++++++++++++++
>> > > 1 file changed, 14 insertions(+)
>> > >
>> > > diff --git a/drivers/gpu/drm/tests/drm_exec_test.c
>> > > b/drivers/gpu/drm/tests/drm_exec_test.c
>> > > index 563949d777dd..7ff6bc6467d4 100644
>> > > --- a/drivers/gpu/drm/tests/drm_exec_test.c
>> > > +++ b/drivers/gpu/drm/tests/drm_exec_test.c
>> > > @@ -42,6 +42,19 @@ static int drm_exec_test_init(struct kunit *test)
>> > > return 0;
>> > > }
>> > >
>> > > +static void drm_exec_test_exit(struct kunit *test)
>> > > +{
>> > > + struct drm_exec_priv *priv = test->priv;
>> > > +
>> > > + drm_kunit_helper_free_device(test, priv->dev);
>> > > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, priv->dev);
>> >
>> > This shouldn't be necessary at all since 4f2b0b583baa.
>>
>>
>> Reading this suggested patch I see only references to
>> platform_driver_unregister, platform_device_put, and
>> platform_device_del, not the ones used in this patch.
>
> I mean, what is drm_kunit_helper_free_device calling?
That seems to be triggering any registered release
action immediately, so it calls platform_device_del,
followed by platform_device_put, followed by
platform_driver_unregister. Reducing the patch to
just call the drm_dev_put that doesn't seem to happen
automatically still triggers this stacktrace:
[ 3300.409436] refcount_t: underflow; use-after-free.
[ 3300.409483] WARNING: CPU: 6 PID: 13758 at lib/refcount.c:28
refcount_warn_saturate+0xcd/0x120
[ 3300.409504] Modules linked in: drm_exec_test drm_exec
drm_kunit_helpers kunit snd_usb_audio snd_usbmidi_lib uvcvideo snd_ump
snd_hwdep videobuf2_vmalloc snd_pcm videobuf2_memops snd
_rawmidi uvc videobuf2_v4l2 snd_seq_device snd_timer videodev snd
soundcore videobuf2_common mc rfkill binfmt_misc intel_rapl_msr
intel_rapl_common kvm_amd ccp rng_core kvm nls_ascii irqbypass nls_cp437
crct10dif_pclmul crct10dif_common
vfat crc32_pclmul fat ghash_clmulni_intel sha512_ssse3 sha512_generic
aesni_intel crypto_simd cryptd iTCO_wdt pcspkr intel_pmc_bxt
virtio_console iTCO_vendor_support intel_agp joydev evdev intel_gtt
watchdog button serio_raw sg nft_ct
msr nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 parport_pc nf_tables
ppdev lp libcrc32c parport nfnetlink loop fuse efi_pstore configfs
efivarfs qemu_fw_cfg ip_tables x_tables autofs4 ext4 crc32c_generic
crc16 mbcache jbd2 hid_generic us
bhid hid dm_mod virtio_gpu virtio_dma_buf drm_shmem_helper
drm_kms_helper sr_mod virtio_net cdrom net_failover drm failover
virtio_blk ahci
2023-09-13T18:21:01.438934+03:00 woodpecker kernel: [ 3300.410013]
libahci virtio_pci libata xhci_pci virtio xhci_hcd i2c_i801 crc32c_intel
virtio_pci_legacy_dev scsi_mod usbcore virtio_pci_modern_dev psmouse
i2c_smbus scsi_common lpc_
ich usb_common virtio_ring
[ 3300.410081] CPU: 6 PID: 13758 Comm: kunit_try_catch Tainted: G B
N 6.6.0-rc1+ #3
[ 3300.410092] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
0.0.0 02/06/2015
[ 3300.410098] RIP: 0010:refcount_warn_saturate+0xcd/0x120
[ 3300.410113] Code: 0a 21 fc 01 01 e8 03 9d 7f ff 0f 0b eb 95 80 3d f9
20 fc 01 00 75 8c 48 c7 c7 e0 10 a8 b9 c6 05 e9 20 fc 01 01 e8 e3 9c 7f
ff <0f> 0b e9 72 ff ff ff 80 3d d4 20 fc
01 00 0f 85 65 ff ff ff 48 c7
[ 3300.410122] RSP: 0018:ffff888284397bf0 EFLAGS: 00010286
[ 3300.410132] RAX: 0000000000000000 RBX: 0000000000000003 RCX:
0000000000000000
[ 3300.410138] RDX: 0000000000000002 RSI: ffffffffb8567c64 RDI:
ffffffffbb90c7a0
[ 3300.410145] RBP: ffff888271e3d004 R08: 0000000000000001 R09:
ffffed1062726081
[ 3300.410151] R10: ffff88831393040b R11: 0000000000000001 R12:
ffff888124145c80
[ 3300.410158] R13: ffff888284397c78 R14: ffffffffc0c11b20 R15:
0000000000000010
[ 3300.410168] FS: 0000000000000000(0000) GS:ffff888313900000(0000)
knlGS:0000000000000000
[ 3300.410176] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3300.410182] CR2: 00007ffdbe910148 CR3: 0000000119c3c000 CR4:
0000000000350ee0
[ 3300.410191] Call Trace:
[ 3300.410197] <TASK>
[ 3300.410203] ? __warn+0xa1/0x1a0
[ 3300.410221] ? refcount_warn_saturate+0xcd/0x120
[ 3300.410239] ? report_bug+0x1f2/0x220
[ 3300.410258] ? handle_bug+0x41/0x80
[ 3300.410272] ? exc_invalid_op+0x13/0x40
[ 3300.410285] ? asm_exc_invalid_op+0x16/0x20
[ 3300.410304] ? preempt_count_sub+0x14/0xc0
[ 3300.410316] ? refcount_warn_saturate+0xcd/0x120
[ 3300.410323] release_nodes+0x83/0x160
[ 3300.410332] devres_release_all+0xe6/0x130
[ 3300.410338] ? __pfx_devres_release_all+0x10/0x10
[ 3300.410343] ? mutex_unlock+0x80/0xd0
[ 3300.410349] ? __pfx_mutex_unlock+0x10/0x10
[ 3300.410356] device_unbind_cleanup+0x16/0xc0
[ 3300.410364] device_release_driver_internal+0x28b/0x2e0
[ 3300.410372] bus_remove_device+0x124/0x1d0
[ 3300.410378] device_del+0x23d/0x580
[ 3300.410384] ? __pfx_device_del+0x10/0x10
[ 3300.410389] ? kasan_set_track+0x21/0x30
[ 3300.410395] ? _raw_spin_lock_irqsave+0x98/0xf0
[ 3300.410402] platform_device_del.part.0+0x19/0xe0
[ 3300.410408] kunit_remove_resource+0xfa/0x140 [kunit]
[ 3300.410427] kunit_cleanup+0x47/0xa0 [kunit]
[ 3300.410443] ? __pfx_kunit_try_run_case_cleanup+0x10/0x10 [kunit]
[ 3300.410460] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[kunit]
[ 3300.410477] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
[ 3300.410494] kthread+0x184/0x1c0
[ 3300.410499] ? __pfx_kthread+0x10/0x10
[ 3300.410503] ret_from_fork+0x30/0x50
[ 3300.410509] ? __pfx_kthread+0x10/0x10
[ 3300.410513] ret_from_fork_asm+0x1b/0x30
[ 3300.410522] </TASK>
[ 3300.410524] ---[ end trace 0000000000000000 ]---
[ 3300.411310] ok 1 sanitycheck
[ 3300.422160] ok 2 test_lock
[ 3300.433030] ok 3 test_lock_unlock
[ 3300.443877] ok 4 test_duplicates
[ 3300.454591] ok 5 test_prepare
[ 3300.467181] ok 6 test_prepare_array
[ 3300.479030] ok 7 test_multiple_loops
[ 3300.479052] # drm_exec: pass:7 fail:0 skip:0 total:7
[ 3300.479065] # Totals: pass:7 fail:0 skip:0 total:7
[ 3300.479076] ok 1 drm_exec
Thanks!
José.
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] drm/tests: provide exit function
2023-09-13 16:35 ` José Pekkarinen
@ 2023-09-14 12:00 ` Maxime Ripard
2023-09-14 14:24 ` José Pekkarinen
0 siblings, 1 reply; 9+ messages in thread
From: Maxime Ripard @ 2023-09-14 12:00 UTC (permalink / raw)
To: José Pekkarinen
Cc: airlied, daniel, christian.koenig, dakr, boris.brezillon,
alexander.deucher, arthurgrillo, dri-devel, linux-kernel,
linux-kernel-mentees
[-- Attachment #1: Type: text/plain, Size: 9859 bytes --]
On Wed, Sep 13, 2023 at 07:35:57PM +0300, José Pekkarinen wrote:
> On 2023-09-13 17:41, mripard@kernel.org wrote:
> > On Wed, Sep 13, 2023 at 05:01:40PM +0300, José Pekkarinen wrote:
> > > On 2023-09-13 12:50, Maxime Ripard wrote:
> > > > Hi,
> > > >
> > > > On Wed, Sep 13, 2023 at 11:32:23AM +0300, José Pekkarinen wrote:
> > > > > Running drm_exec_test by modprobing the module I
> > > > > observe the following output:
> > > > >
> > > > > [ 424.471936] KTAP version 1
> > > > > [ 424.471942] 1..1
> > > > > [ 424.472446] KTAP version 1
> > > > > [ 424.472450] # Subtest: drm_exec
> > > > > [ 424.472453] # module: drm_exec_test
> > > > > [ 424.472459] 1..7
> > > > > [ 424.479082]
> > > > > ==================================================================
> > > > > [ 424.479095] BUG: KASAN: slab-use-after-free in
> > > > > drm_dev_put.part.0+0x4b/0x90 [drm]
> > > > > [ 424.479426] Read of size 8 at addr ffff888132d3e028 by task
> > > > > kunit_try_catch/1866
> > > > > [ 424.479436]
> > > > > [ 424.479442] CPU: 1 PID: 1866 Comm: kunit_try_catch Tainted: G
> > > > > N 6.6.0-rc1-dirty #2
> > > >
> > > > That's suspicious
> > > >
> > > > > [ 424.479446] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
> > > > > BIOS 0.0.0 02/06/2015
> > > > > [ 424.479446] Call Trace:
> > > > > [ 424.479446] <TASK>
> > > > > [ 424.479446] dump_stack_lvl+0x43/0x60
> > > > > [ 424.479446] print_report+0xcf/0x660
> > > > > [ 424.479446] ? __virt_addr_valid+0xd9/0x160
> > > > > [ 424.479446] ? drm_dev_put.part.0+0x4b/0x90 [drm]
> > > > > [ 424.479446] kasan_report+0xda/0x110
> > > > > [ 424.479446] ? drm_dev_put.part.0+0x4b/0x90 [drm]
> > > > > [ 424.479446] drm_dev_put.part.0+0x4b/0x90 [drm]
> > > > > [ 424.479446] release_nodes+0x83/0x160
> > > > > [ 424.479446] devres_release_all+0xe6/0x130
> > > > > [ 424.479446] ? __pfx_devres_release_all+0x10/0x10
> > > > > [ 424.479446] ? mutex_unlock+0x80/0xd0
> > > > > [ 424.479446] ? __pfx_mutex_unlock+0x10/0x10
> > > > > [ 424.479446] device_unbind_cleanup+0x16/0xc0
> > > > > [ 424.479446] device_release_driver_internal+0x28b/0x2e0
> > > > > [ 424.479446] bus_remove_device+0x124/0x1d0
> > > > > [ 424.479446] device_del+0x23d/0x580
> > > > > [ 424.479446] ? __pfx_device_del+0x10/0x10
> > > > > [ 424.479446] ? kasan_set_track+0x21/0x30
> > > > > [ 424.479446] ? _raw_spin_lock_irqsave+0x98/0xf0
> > > > > [ 424.479446] platform_device_del.part.0+0x19/0xe0
> > > > > [ 424.479446] kunit_remove_resource+0xfa/0x140 [kunit]
> > > > > [ 424.479446] kunit_cleanup+0x47/0xa0 [kunit]
> > > > > [ 424.479446] ? __pfx_kunit_try_run_case_cleanup+0x10/0x10 [kunit]
> > > > > [ 424.479446] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
> > > > > [kunit]
> > > > > [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
> > > > > [ 424.479446] kthread+0x184/0x1c0
> > > > > [ 424.479446] ? __pfx_kthread+0x10/0x10
> > > > > [ 424.479446] ret_from_fork+0x30/0x50
> > > > > [ 424.479446] ? __pfx_kthread+0x10/0x10
> > > > > [ 424.479446] ret_from_fork_asm+0x1b/0x30
> > > > > [ 424.479446] </TASK>
> > > > > [ 424.479446]
> > > > > [ 424.479446] Allocated by task 1865:
> > > > > [ 424.479446] kasan_save_stack+0x2f/0x50
> > > > > [ 424.479446] kasan_set_track+0x21/0x30
> > > > > [ 424.479446] __kasan_kmalloc+0xa6/0xb0
> > > > > [ 424.479446] __kmalloc+0x5d/0x160
> > > > > [ 424.479446] kunit_kmalloc_array+0x1c/0x50 [kunit]
> > > > > [ 424.479446] drm_exec_test_init+0xef/0x260 [drm_exec_test]
> > > > > [ 424.479446] kunit_try_run_case+0x6e/0x100 [kunit]
> > > > > [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
> > > > > [ 424.479446] kthread+0x184/0x1c0
> > > > > [ 424.479446] ret_from_fork+0x30/0x50
> > > > > [ 424.479446] ret_from_fork_asm+0x1b/0x30
> > > > > [ 424.479446]
> > > > > [ 424.479446] Freed by task 1866:
> > > > > [ 424.479446] kasan_save_stack+0x2f/0x50
> > > > > [ 424.479446] kasan_set_track+0x21/0x30
> > > > > [ 424.479446] kasan_save_free_info+0x27/0x40
> > > > > [ 424.479446] ____kasan_slab_free+0x166/0x1c0
> > > > > [ 424.479446] slab_free_freelist_hook+0x9f/0x1e0
> > > > > [ 424.479446] __kmem_cache_free+0x187/0x2d0
> > > > > [ 424.479446] kunit_remove_resource+0xfa/0x140 [kunit]
> > > > > [ 424.479446] kunit_cleanup+0x47/0xa0 [kunit]
> > > > > [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
> > > > > [ 424.479446] kthread+0x184/0x1c0
> > > > > [ 424.479446] ret_from_fork+0x30/0x50
> > > > > [ 424.479446] ret_from_fork_asm+0x1b/0x30
> > > > > [ 424.479446]
> > > > > [ 424.479446] The buggy address belongs to the object at
> > > > > ffff888132d3e000
> > > > > [ 424.479446] which belongs to the cache kmalloc-256 of size 256
> > > > > [ 424.479446] The buggy address is located 40 bytes inside of
> > > > > [ 424.479446] freed 256-byte region [ffff888132d3e000,
> > > > > ffff888132d3e100)
> > > > > [ 424.479446]
> > > > > [ 424.479446] The buggy address belongs to the physical page:
> > > > > [ 424.479446] page:0000000092ff6551 refcount:1 mapcount:0
> > > > > mapping:0000000000000000 index:0xffff888132d3f600 pfn:0x132d3c
> > > > > [ 424.479446] head:0000000092ff6551 order:2 entire_mapcount:0
> > > > > nr_pages_mapped:0 pincount:0
> > > > > [ 424.479446] ksm flags:
> > > > > 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
> > > > > [ 424.479446] page_type: 0xffffffff()
> > > > > [ 424.479446] raw: 0017ffffc0000840 ffff888100042b40
> > > > > ffffea00042c8000 dead000000000003
> > > > > [ 424.479446] raw: ffff888132d3f600 000000008020001f
> > > > > 00000001ffffffff 0000000000000000
> > > > > [ 424.479446] page dumped because: kasan: bad access detected
> > > > > [ 424.479446]
> > > > > [ 424.479446] Memory state around the buggy address:
> > > > > [ 424.479446] ffff888132d3df00: fc fc fc fc fc fc fc fc fc fc fc
> > > > > fc fc fc fc fc
> > > > > [ 424.479446] ffff888132d3df80: fc fc fc fc fc fc fc fc fc fc fc
> > > > > fc fc fc fc fc
> > > > > [ 424.479446] >ffff888132d3e000: fa fb fb fb fb fb fb fb fb fb fb
> > > > > fb fb fb fb fb
> > > > > [ 424.479446] ^
> > > > > [ 424.479446] ffff888132d3e080: fb fb fb fb fb fb fb fb fb fb fb
> > > > > fb fb fb fb fb
> > > > > [ 424.479446] ffff888132d3e100: fc fc fc fc fc fc fc fc fc fc fc
> > > > > fc fc fc fc fc
> > > > > [ 424.479446]
> > > > > ==================================================================
> > > > > [ 424.481686] Disabling lock debugging due to kernel taint
> > > > > [ 424.484124] not ok 1 sanitycheck
> > > > > [ 424.492981] ok 2 test_lock
> > > > > [ 424.503610] ok 3 test_lock_unlock
> > > > > [ 424.515058] ok 4 test_duplicates
> > > > > [ 424.530453] ok 5 test_prepare
> > > > > [ 424.539099] ok 6 test_prepare_array
> > > > > [ 424.550730] ok 7 test_multiple_loops
> > > > > [ 424.550743] # drm_exec: pass:6 fail:1 skip:0 total:7
> > > > > [ 424.550750] # Totals: pass:6 fail:1 skip:0 total:7
> > > > > [ 424.550756] not ok 5 drm_exec
> > > > >
> > > > > The ouptut suggest the init function is allocating a drm_device
> > > > > that is not being freed. This patch provides the function and
> > > > > add it to the kunit_suite to produce the following result of
> > > > > the test:
> > > > >
> > > > > [ 3363.342560] KTAP version 1
> > > > > [ 3363.342571] 1..1
> > > > > [ 3363.343090] KTAP version 1
> > > > > [ 3363.343095] # Subtest: drm_exec
> > > > > [ 3363.343098] # module: drm_exec_test
> > > > > [ 3363.343103] 1..7
> > > > > [ 3363.353659] ok 1 sanitycheck
> > > > > [ 3363.364281] ok 2 test_lock
> > > > > [ 3363.375616] ok 3 test_lock_unlock
> > > > > [ 3363.388741] ok 4 test_duplicates
> > > > > [ 3363.402544] ok 5 test_prepare
> > > > > [ 3363.413163] ok 6 test_prepare_array
> > > > > [ 3363.424614] ok 7 test_multiple_loops
> > > > > [ 3363.424630] # drm_exec: pass:7 fail:0 skip:0 total:7
> > > > > [ 3363.424637] # Totals: pass:7 fail:0 skip:0 total:7
> > > > > [ 3363.424643] ok 1 drm_exec
> > > > >
> > > > > Signed-off-by: José Pekkarinen <jose.pekkarinen@foxhound.fi>
> > > > > ---
> > > > > drivers/gpu/drm/tests/drm_exec_test.c | 14 ++++++++++++++
> > > > > 1 file changed, 14 insertions(+)
> > > > >
> > > > > diff --git a/drivers/gpu/drm/tests/drm_exec_test.c
> > > > > b/drivers/gpu/drm/tests/drm_exec_test.c
> > > > > index 563949d777dd..7ff6bc6467d4 100644
> > > > > --- a/drivers/gpu/drm/tests/drm_exec_test.c
> > > > > +++ b/drivers/gpu/drm/tests/drm_exec_test.c
> > > > > @@ -42,6 +42,19 @@ static int drm_exec_test_init(struct kunit *test)
> > > > > return 0;
> > > > > }
> > > > >
> > > > > +static void drm_exec_test_exit(struct kunit *test)
> > > > > +{
> > > > > + struct drm_exec_priv *priv = test->priv;
> > > > > +
> > > > > + drm_kunit_helper_free_device(test, priv->dev);
> > > > > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, priv->dev);
> > > >
> > > > This shouldn't be necessary at all since 4f2b0b583baa.
> > >
> > >
> > > Reading this suggested patch I see only references to
> > > platform_driver_unregister, platform_device_put, and
> > > platform_device_del, not the ones used in this patch.
> >
> > I mean, what is drm_kunit_helper_free_device calling?
>
> That seems to be triggering any registered release
> action immediately, so it calls platform_device_del,
> followed by platform_device_put, followed by
> platform_driver_unregister.
Please test with:
https://lore.kernel.org/all/20230907135339.7971-2-thomas.hellstrom@linux.intel.com/
Maxime
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] drm/tests: provide exit function
2023-09-14 12:00 ` Maxime Ripard
@ 2023-09-14 14:24 ` José Pekkarinen
0 siblings, 0 replies; 9+ messages in thread
From: José Pekkarinen @ 2023-09-14 14:24 UTC (permalink / raw)
To: Maxime Ripard
Cc: airlied, daniel, christian.koenig, dakr, boris.brezillon,
alexander.deucher, arthurgrillo, dri-devel, linux-kernel,
linux-kernel-mentees
On 2023-09-14 15:00, Maxime Ripard wrote:
> On Wed, Sep 13, 2023 at 07:35:57PM +0300, José Pekkarinen wrote:
>> On 2023-09-13 17:41, mripard@kernel.org wrote:
>> > On Wed, Sep 13, 2023 at 05:01:40PM +0300, José Pekkarinen wrote:
>> > > On 2023-09-13 12:50, Maxime Ripard wrote:
>> > > > Hi,
>> > > >
>> > > > On Wed, Sep 13, 2023 at 11:32:23AM +0300, José Pekkarinen wrote:
>> > > > > Running drm_exec_test by modprobing the module I
>> > > > > observe the following output:
>> > > > >
>> > > > > [ 424.471936] KTAP version 1
>> > > > > [ 424.471942] 1..1
>> > > > > [ 424.472446] KTAP version 1
>> > > > > [ 424.472450] # Subtest: drm_exec
>> > > > > [ 424.472453] # module: drm_exec_test
>> > > > > [ 424.472459] 1..7
>> > > > > [ 424.479082]
>> > > > > ==================================================================
>> > > > > [ 424.479095] BUG: KASAN: slab-use-after-free in
>> > > > > drm_dev_put.part.0+0x4b/0x90 [drm]
>> > > > > [ 424.479426] Read of size 8 at addr ffff888132d3e028 by task
>> > > > > kunit_try_catch/1866
>> > > > > [ 424.479436]
>> > > > > [ 424.479442] CPU: 1 PID: 1866 Comm: kunit_try_catch Tainted: G
>> > > > > N 6.6.0-rc1-dirty #2
>> > > >
>> > > > That's suspicious
>> > > >
>> > > > > [ 424.479446] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009),
>> > > > > BIOS 0.0.0 02/06/2015
>> > > > > [ 424.479446] Call Trace:
>> > > > > [ 424.479446] <TASK>
>> > > > > [ 424.479446] dump_stack_lvl+0x43/0x60
>> > > > > [ 424.479446] print_report+0xcf/0x660
>> > > > > [ 424.479446] ? __virt_addr_valid+0xd9/0x160
>> > > > > [ 424.479446] ? drm_dev_put.part.0+0x4b/0x90 [drm]
>> > > > > [ 424.479446] kasan_report+0xda/0x110
>> > > > > [ 424.479446] ? drm_dev_put.part.0+0x4b/0x90 [drm]
>> > > > > [ 424.479446] drm_dev_put.part.0+0x4b/0x90 [drm]
>> > > > > [ 424.479446] release_nodes+0x83/0x160
>> > > > > [ 424.479446] devres_release_all+0xe6/0x130
>> > > > > [ 424.479446] ? __pfx_devres_release_all+0x10/0x10
>> > > > > [ 424.479446] ? mutex_unlock+0x80/0xd0
>> > > > > [ 424.479446] ? __pfx_mutex_unlock+0x10/0x10
>> > > > > [ 424.479446] device_unbind_cleanup+0x16/0xc0
>> > > > > [ 424.479446] device_release_driver_internal+0x28b/0x2e0
>> > > > > [ 424.479446] bus_remove_device+0x124/0x1d0
>> > > > > [ 424.479446] device_del+0x23d/0x580
>> > > > > [ 424.479446] ? __pfx_device_del+0x10/0x10
>> > > > > [ 424.479446] ? kasan_set_track+0x21/0x30
>> > > > > [ 424.479446] ? _raw_spin_lock_irqsave+0x98/0xf0
>> > > > > [ 424.479446] platform_device_del.part.0+0x19/0xe0
>> > > > > [ 424.479446] kunit_remove_resource+0xfa/0x140 [kunit]
>> > > > > [ 424.479446] kunit_cleanup+0x47/0xa0 [kunit]
>> > > > > [ 424.479446] ? __pfx_kunit_try_run_case_cleanup+0x10/0x10 [kunit]
>> > > > > [ 424.479446] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
>> > > > > [kunit]
>> > > > > [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
>> > > > > [ 424.479446] kthread+0x184/0x1c0
>> > > > > [ 424.479446] ? __pfx_kthread+0x10/0x10
>> > > > > [ 424.479446] ret_from_fork+0x30/0x50
>> > > > > [ 424.479446] ? __pfx_kthread+0x10/0x10
>> > > > > [ 424.479446] ret_from_fork_asm+0x1b/0x30
>> > > > > [ 424.479446] </TASK>
>> > > > > [ 424.479446]
>> > > > > [ 424.479446] Allocated by task 1865:
>> > > > > [ 424.479446] kasan_save_stack+0x2f/0x50
>> > > > > [ 424.479446] kasan_set_track+0x21/0x30
>> > > > > [ 424.479446] __kasan_kmalloc+0xa6/0xb0
>> > > > > [ 424.479446] __kmalloc+0x5d/0x160
>> > > > > [ 424.479446] kunit_kmalloc_array+0x1c/0x50 [kunit]
>> > > > > [ 424.479446] drm_exec_test_init+0xef/0x260 [drm_exec_test]
>> > > > > [ 424.479446] kunit_try_run_case+0x6e/0x100 [kunit]
>> > > > > [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
>> > > > > [ 424.479446] kthread+0x184/0x1c0
>> > > > > [ 424.479446] ret_from_fork+0x30/0x50
>> > > > > [ 424.479446] ret_from_fork_asm+0x1b/0x30
>> > > > > [ 424.479446]
>> > > > > [ 424.479446] Freed by task 1866:
>> > > > > [ 424.479446] kasan_save_stack+0x2f/0x50
>> > > > > [ 424.479446] kasan_set_track+0x21/0x30
>> > > > > [ 424.479446] kasan_save_free_info+0x27/0x40
>> > > > > [ 424.479446] ____kasan_slab_free+0x166/0x1c0
>> > > > > [ 424.479446] slab_free_freelist_hook+0x9f/0x1e0
>> > > > > [ 424.479446] __kmem_cache_free+0x187/0x2d0
>> > > > > [ 424.479446] kunit_remove_resource+0xfa/0x140 [kunit]
>> > > > > [ 424.479446] kunit_cleanup+0x47/0xa0 [kunit]
>> > > > > [ 424.479446] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
>> > > > > [ 424.479446] kthread+0x184/0x1c0
>> > > > > [ 424.479446] ret_from_fork+0x30/0x50
>> > > > > [ 424.479446] ret_from_fork_asm+0x1b/0x30
>> > > > > [ 424.479446]
>> > > > > [ 424.479446] The buggy address belongs to the object at
>> > > > > ffff888132d3e000
>> > > > > [ 424.479446] which belongs to the cache kmalloc-256 of size 256
>> > > > > [ 424.479446] The buggy address is located 40 bytes inside of
>> > > > > [ 424.479446] freed 256-byte region [ffff888132d3e000,
>> > > > > ffff888132d3e100)
>> > > > > [ 424.479446]
>> > > > > [ 424.479446] The buggy address belongs to the physical page:
>> > > > > [ 424.479446] page:0000000092ff6551 refcount:1 mapcount:0
>> > > > > mapping:0000000000000000 index:0xffff888132d3f600 pfn:0x132d3c
>> > > > > [ 424.479446] head:0000000092ff6551 order:2 entire_mapcount:0
>> > > > > nr_pages_mapped:0 pincount:0
>> > > > > [ 424.479446] ksm flags:
>> > > > > 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
>> > > > > [ 424.479446] page_type: 0xffffffff()
>> > > > > [ 424.479446] raw: 0017ffffc0000840 ffff888100042b40
>> > > > > ffffea00042c8000 dead000000000003
>> > > > > [ 424.479446] raw: ffff888132d3f600 000000008020001f
>> > > > > 00000001ffffffff 0000000000000000
>> > > > > [ 424.479446] page dumped because: kasan: bad access detected
>> > > > > [ 424.479446]
>> > > > > [ 424.479446] Memory state around the buggy address:
>> > > > > [ 424.479446] ffff888132d3df00: fc fc fc fc fc fc fc fc fc fc fc
>> > > > > fc fc fc fc fc
>> > > > > [ 424.479446] ffff888132d3df80: fc fc fc fc fc fc fc fc fc fc fc
>> > > > > fc fc fc fc fc
>> > > > > [ 424.479446] >ffff888132d3e000: fa fb fb fb fb fb fb fb fb fb fb
>> > > > > fb fb fb fb fb
>> > > > > [ 424.479446] ^
>> > > > > [ 424.479446] ffff888132d3e080: fb fb fb fb fb fb fb fb fb fb fb
>> > > > > fb fb fb fb fb
>> > > > > [ 424.479446] ffff888132d3e100: fc fc fc fc fc fc fc fc fc fc fc
>> > > > > fc fc fc fc fc
>> > > > > [ 424.479446]
>> > > > > ==================================================================
>> > > > > [ 424.481686] Disabling lock debugging due to kernel taint
>> > > > > [ 424.484124] not ok 1 sanitycheck
>> > > > > [ 424.492981] ok 2 test_lock
>> > > > > [ 424.503610] ok 3 test_lock_unlock
>> > > > > [ 424.515058] ok 4 test_duplicates
>> > > > > [ 424.530453] ok 5 test_prepare
>> > > > > [ 424.539099] ok 6 test_prepare_array
>> > > > > [ 424.550730] ok 7 test_multiple_loops
>> > > > > [ 424.550743] # drm_exec: pass:6 fail:1 skip:0 total:7
>> > > > > [ 424.550750] # Totals: pass:6 fail:1 skip:0 total:7
>> > > > > [ 424.550756] not ok 5 drm_exec
>> > > > >
>> > > > > The ouptut suggest the init function is allocating a drm_device
>> > > > > that is not being freed. This patch provides the function and
>> > > > > add it to the kunit_suite to produce the following result of
>> > > > > the test:
>> > > > >
>> > > > > [ 3363.342560] KTAP version 1
>> > > > > [ 3363.342571] 1..1
>> > > > > [ 3363.343090] KTAP version 1
>> > > > > [ 3363.343095] # Subtest: drm_exec
>> > > > > [ 3363.343098] # module: drm_exec_test
>> > > > > [ 3363.343103] 1..7
>> > > > > [ 3363.353659] ok 1 sanitycheck
>> > > > > [ 3363.364281] ok 2 test_lock
>> > > > > [ 3363.375616] ok 3 test_lock_unlock
>> > > > > [ 3363.388741] ok 4 test_duplicates
>> > > > > [ 3363.402544] ok 5 test_prepare
>> > > > > [ 3363.413163] ok 6 test_prepare_array
>> > > > > [ 3363.424614] ok 7 test_multiple_loops
>> > > > > [ 3363.424630] # drm_exec: pass:7 fail:0 skip:0 total:7
>> > > > > [ 3363.424637] # Totals: pass:7 fail:0 skip:0 total:7
>> > > > > [ 3363.424643] ok 1 drm_exec
>> > > > >
>> > > > > Signed-off-by: José Pekkarinen <jose.pekkarinen@foxhound.fi>
>> > > > > ---
>> > > > > drivers/gpu/drm/tests/drm_exec_test.c | 14 ++++++++++++++
>> > > > > 1 file changed, 14 insertions(+)
>> > > > >
>> > > > > diff --git a/drivers/gpu/drm/tests/drm_exec_test.c
>> > > > > b/drivers/gpu/drm/tests/drm_exec_test.c
>> > > > > index 563949d777dd..7ff6bc6467d4 100644
>> > > > > --- a/drivers/gpu/drm/tests/drm_exec_test.c
>> > > > > +++ b/drivers/gpu/drm/tests/drm_exec_test.c
>> > > > > @@ -42,6 +42,19 @@ static int drm_exec_test_init(struct kunit *test)
>> > > > > return 0;
>> > > > > }
>> > > > >
>> > > > > +static void drm_exec_test_exit(struct kunit *test)
>> > > > > +{
>> > > > > + struct drm_exec_priv *priv = test->priv;
>> > > > > +
>> > > > > + drm_kunit_helper_free_device(test, priv->dev);
>> > > > > + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, priv->dev);
>> > > >
>> > > > This shouldn't be necessary at all since 4f2b0b583baa.
>> > >
>> > >
>> > > Reading this suggested patch I see only references to
>> > > platform_driver_unregister, platform_device_put, and
>> > > platform_device_del, not the ones used in this patch.
>> >
>> > I mean, what is drm_kunit_helper_free_device calling?
>>
>> That seems to be triggering any registered release
>> action immediately, so it calls platform_device_del,
>> followed by platform_device_put, followed by
>> platform_driver_unregister.
>
>
> Please test with:
> https://lore.kernel.org/all/20230907135339.7971-2-thomas.hellstrom@linux.intel.com/
>
> Maxime
Hi,
Yes, I was looking into that road, but Thomas
was faster, here is the output of my tests after
applying Thomas patch:
[ 874.063255] KTAP version 1
[ 874.063262] 1..1
[ 874.064550] KTAP version 1
[ 874.064555] # Subtest: drm_modes_analog_tv
[ 874.064559] # module: drm_modes_test
[ 874.064565] 1..4
[ 874.076778] ok 1 drm_test_modes_analog_tv_ntsc_480i
[ 874.091584] ok 2 drm_test_modes_analog_tv_ntsc_480i_inlined
[ 874.104682] ok 3 drm_test_modes_analog_tv_pal_576i
[ 874.116266] ok 4 drm_test_modes_analog_tv_pal_576i_inlined
[ 874.116285] # drm_modes_analog_tv: pass:4 fail:0 skip:0 total:4
[ 874.116297] # Totals: pass:4 fail:0 skip:0 total:4
[ 874.116305] ok 1 drm_modes_analog_tv
[ 888.785690] KTAP version 1
[ 888.785697] 1..1
[ 888.786186] KTAP version 1
[ 888.786192] # Subtest: drm_exec
[ 888.786196] # module: drm_exec_test
[ 888.786202] 1..7
[ 888.796416] ok 1 sanitycheck
[ 888.807215] ok 2 test_lock
[ 888.820305] ok 3 test_lock_unlock
[ 888.829242] ok 4 test_duplicates
[ 888.840362] ok 5 test_prepare
[ 888.851022] ok 6 test_prepare_array
[ 888.865011] ok 7 test_multiple_loops
[ 888.865034] # drm_exec: pass:7 fail:0 skip:0 total:7
[ 888.865044] # Totals: pass:7 fail:0 skip:0 total:7
[ 888.865053] ok 2 drm_exec
Tested-by: José Pekkarinen<jose.pekkarinen@foxhound.fi>
Thanks!
José.
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH] drm/tests: provide exit function
@ 2023-09-13 12:19 José Pekkarinen
2023-09-13 14:44 ` Maxime Ripard
0 siblings, 1 reply; 9+ messages in thread
From: José Pekkarinen @ 2023-09-13 12:19 UTC (permalink / raw)
To: airlied, daniel, skhan
Cc: José Pekkarinen, mripard, mairacanal, javierm, dri-devel,
linux-kernel, linux-kernel-mentees
Similarly to the drm_exec_test module, the drm_modes_test
shows the following output on dmesg on load:
[ 5556.674834] KTAP version 1
[ 5556.674841] 1..1
[ 5556.675317] KTAP version 1
[ 5556.675321] # Subtest: drm_modes_analog_tv
[ 5556.675323] # module: drm_modes_test
[ 5556.675327] 1..4
[ 5556.683731] ==================================================================
[ 5556.683777] BUG: KASAN: slab-use-after-free in drm_dev_put.part.0+0x4b/0x90 [drm]
[ 5556.683882] Read of size 8 at addr ffff88812db30428 by task kunit_try_catch/75921
[ 5556.683882]
[ 5556.683882] CPU: 1 PID: 75921 Comm: kunit_try_catch Tainted: G W N 6.6.0-rc1-dirty #2
[ 5556.683882] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
[ 5556.683882] Call Trace:
[ 5556.683882] <TASK>
[ 5556.683882] dump_stack_lvl+0x43/0x60
[ 5556.683882] print_report+0xcf/0x660
[ 5556.683882] ? __virt_addr_valid+0xd9/0x160
[ 5556.683882] ? drm_dev_put.part.0+0x4b/0x90 [drm]
[ 5556.683882] kasan_report+0xda/0x110
[ 5556.683882] ? drm_dev_put.part.0+0x4b/0x90 [drm]
[ 5556.683882] drm_dev_put.part.0+0x4b/0x90 [drm]
[ 5556.683882] release_nodes+0x83/0x160
[ 5556.683882] devres_release_all+0xe6/0x130
[ 5556.683882] ? __pfx_devres_release_all+0x10/0x10
[ 5556.683882] ? mutex_unlock+0x80/0xd0
[ 5556.683882] ? __pfx_mutex_unlock+0x10/0x10
[ 5556.683882] device_unbind_cleanup+0x16/0xc0
[ 5556.683882] device_release_driver_internal+0x28b/0x2e0
[ 5556.683882] bus_remove_device+0x124/0x1d0
[ 5556.683882] device_del+0x23d/0x580
[ 5556.683882] ? __pfx_device_del+0x10/0x10
[ 5556.683882] ? kasan_set_track+0x21/0x30
[ 5556.683882] ? _raw_spin_lock_irqsave+0x98/0xf0
[ 5556.683882] platform_device_del.part.0+0x19/0xe0
[ 5556.683882] kunit_remove_resource+0xfa/0x140 [kunit]
[ 5556.683882] kunit_cleanup+0x47/0xa0 [kunit]
[ 5556.683882] ? __pfx_kunit_try_run_case_cleanup+0x10/0x10 [kunit]
[ 5556.683882] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [kunit]
[ 5556.683882] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
[ 5556.683882] kthread+0x184/0x1c0
[ 5556.683882] ? __pfx_kthread+0x10/0x10
[ 5556.683882] ret_from_fork+0x30/0x50
[ 5556.683882] ? __pfx_kthread+0x10/0x10
[ 5556.683882] ret_from_fork_asm+0x1b/0x30
[ 5556.683882] </TASK>
[ 5556.683882]
[ 5556.683882] Allocated by task 75920:
[ 5556.683882] kasan_save_stack+0x2f/0x50
[ 5556.683882] kasan_set_track+0x21/0x30
[ 5556.683882] __kasan_kmalloc+0xa6/0xb0
[ 5556.683882] __kmalloc+0x5d/0x160
[ 5556.683882] kunit_kmalloc_array+0x1c/0x50 [kunit]
[ 5556.683882] drm_test_modes_init+0xda/0x260 [drm_modes_test]
[ 5556.683882] kunit_try_run_case+0x6e/0x100 [kunit]
[ 5556.683882] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
[ 5556.683882] kthread+0x184/0x1c0
[ 5556.683882] ret_from_fork+0x30/0x50
[ 5556.683882] ret_from_fork_asm+0x1b/0x30
[ 5556.683882]
[ 5556.683882] Freed by task 75921:
[ 5556.683882] kasan_save_stack+0x2f/0x50
[ 5556.683882] kasan_set_track+0x21/0x30
[ 5556.683882] kasan_save_free_info+0x27/0x40
[ 5556.683882] ____kasan_slab_free+0x166/0x1c0
[ 5556.683882] slab_free_freelist_hook+0x9f/0x1e0
[ 5556.683882] __kmem_cache_free+0x187/0x2d0
[ 5556.683882] kunit_remove_resource+0xfa/0x140 [kunit]
[ 5556.683882] kunit_cleanup+0x47/0xa0 [kunit]
[ 5556.683882] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
[ 5556.683882] kthread+0x184/0x1c0
[ 5556.683882] ret_from_fork+0x30/0x50
[ 5556.683882] ret_from_fork_asm+0x1b/0x30
[ 5556.683882]
[ 5556.683882] The buggy address belongs to the object at ffff88812db30400
[ 5556.683882] which belongs to the cache kmalloc-256 of size 256
[ 5556.683882] The buggy address is located 40 bytes inside of
[ 5556.683882] freed 256-byte region [ffff88812db30400, ffff88812db30500)
[ 5556.683882]
[ 5556.683882] The buggy address belongs to the physical page:
[ 5556.683882] page:00000000b3a5f157 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12db30
[ 5556.683882] head:00000000b3a5f157 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 5556.683882] ksm flags: 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
[ 5556.683882] page_type: 0xffffffff()
[ 5556.683882] raw: 0017ffffc0000840 ffff888100042b40 ffffea00053e2000 dead000000000003
[ 5556.683882] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
[ 5556.683882] page dumped because: kasan: bad access detected
[ 5556.683882]
[ 5556.683882] Memory state around the buggy address:
[ 5556.683882] ffff88812db30300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 5556.683882] ffff88812db30380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 5556.683882] >ffff88812db30400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 5556.683882] ^
[ 5556.683882] ffff88812db30480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 5556.683882] ffff88812db30500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 5556.683882] ==================================================================
[ 5556.687191] Disabling lock debugging due to kernel taint
[ 5556.689341] not ok 1 drm_test_modes_analog_tv_ntsc_480i
[ 5556.700913] ok 2 drm_test_modes_analog_tv_ntsc_480i_inlined
[ 5556.713501] ok 3 drm_test_modes_analog_tv_pal_576i
[ 5556.724240] ok 4 drm_test_modes_analog_tv_pal_576i_inlined
[ 5556.724260] # drm_modes_analog_tv: pass:3 fail:1 skip:0 total:4
[ 5556.724270] # Totals: pass:3 fail:1 skip:0 total:4
[ 5556.724279] not ok 8 drm_modes_analog_tv
Unlike the drm_exec_test, this time it is required
to guarantee that de drm mode is destroyed on the
test that is created, otherwise it will trigger the
following output:
[ 876.491050] KTAP version 1
[ 876.491057] 1..1
[ 876.491467] KTAP version 1
[ 876.491469] # Subtest: drm_modes_analog_tv
[ 876.491473] # module: drm_modes_test
[ 876.491477] 1..4
[ 876.502373] ==================================================================
[ 876.502386] BUG: KASAN: slab-use-after-free in drm_dev_put.part.0+0x1b/0x90 [drm]
[ 876.502531] Write of size 4 at addr ffff8881330b8004 by task kunit_try_catch/13563
[ 876.502536]
[ 876.502539] CPU: 6 PID: 13563 Comm: kunit_try_catch Tainted: G N 6.6.0-rc1+ #3
[ 876.502546] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
[ 876.502550] Call Trace:
[ 876.502554] <TASK>
[ 876.502557] dump_stack_lvl+0x43/0x60
[ 876.502568] print_report+0xcf/0x660
[ 876.502577] ? __virt_addr_valid+0xd9/0x160
[ 876.502586] ? drm_dev_put.part.0+0x1b/0x90 [drm]
[ 876.502737] kasan_report+0xda/0x110
[ 876.502744] ? drm_dev_put.part.0+0x1b/0x90 [drm]
[ 876.502831] kasan_check_range+0xfc/0x1b0
[ 876.502831] drm_dev_put.part.0+0x1b/0x90 [drm]
[ 876.502831] drm_test_modes_exit+0xa8/0x160 [drm_modes_test]
[ 876.502831] ? __pfx_drm_test_modes_exit+0x10/0x10 [drm_modes_test]
[ 876.502831] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[ 876.502831] ? __pfx_set_cpus_allowed_ptr+0x10/0x10
[ 876.502831] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [kunit]
[ 876.502831] kunit_try_run_case_cleanup+0x5f/0x70 [kunit]
[ 876.502831] ? __pfx_kunit_try_run_case_cleanup+0x10/0x10 [kunit]
[ 876.502831] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
[ 876.502831] kthread+0x184/0x1c0
[ 876.502831] ? __pfx_kthread+0x10/0x10
[ 876.502831] ret_from_fork+0x30/0x50
[ 876.502831] ? __pfx_kthread+0x10/0x10
[ 876.502831] ret_from_fork_asm+0x1b/0x30
[ 876.502831] </TASK>
[ 876.502831]
[ 876.502831] Allocated by task 13562:
[ 876.502831] kasan_save_stack+0x2f/0x50
[ 876.502831] kasan_set_track+0x21/0x30
[ 876.502831] __kasan_kmalloc+0xa6/0xb0
[ 876.502831] __kmalloc+0x5d/0x160
[ 876.502831] __devm_drm_dev_alloc+0x21/0xb0 [drm]
[ 876.502831] __drm_kunit_helper_alloc_drm_device_with_driver+0x15/0x60 [drm_kunit_helpers]
[ 876.502831] drm_test_modes_init+0x112/0x260 [drm_modes_test]
[ 876.502831] kunit_try_run_case+0x6e/0x100 [kunit]
[ 876.502831] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
[ 876.502831] kthread+0x184/0x1c0
[ 876.502831] ret_from_fork+0x30/0x50
[ 876.502831] ret_from_fork_asm+0x1b/0x30
[ 876.502831]
[ 876.502831] Freed by task 13563:
[ 876.502831] kasan_save_stack+0x2f/0x50
[ 876.502831] kasan_set_track+0x21/0x30
[ 876.502831] kasan_save_free_info+0x27/0x40
[ 876.502831] ____kasan_slab_free+0x166/0x1c0
[ 876.502831] slab_free_freelist_hook+0x9f/0x1e0
[ 876.502831] __kmem_cache_free+0x187/0x2d0
[ 876.502831] release_nodes+0x83/0x160
[ 876.502831] devres_release_all+0xe6/0x130
[ 876.502831] device_unbind_cleanup+0x16/0xc0
[ 876.502831] device_release_driver_internal+0x28b/0x2e0
[ 876.502831] bus_remove_device+0x124/0x1d0
[ 876.502831] device_del+0x23d/0x580
[ 876.502831] platform_device_del.part.0+0x19/0xe0
[ 876.502831] kunit_release_action+0x1d7/0x230 [kunit]
[ 876.502831] drm_kunit_helper_free_device+0x1d/0x50 [drm_kunit_helpers]
[ 876.502831] drm_test_modes_exit+0x7f/0x160 [drm_modes_test]
[ 876.502831] kunit_try_run_case_cleanup+0x5f/0x70 [kunit]
[ 876.502831] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
[ 876.502831] kthread+0x184/0x1c0
[ 876.502831] ret_from_fork+0x30/0x50
[ 876.502831] ret_from_fork_asm+0x1b/0x30
[ 876.502831]
[ 876.502831] Last potentially related work creation:
[ 876.502831] kasan_save_stack+0x2f/0x50
[ 876.502831] __kasan_record_aux_stack+0xaf/0xc0
[ 876.502831] __call_rcu_common.constprop.0+0x9b/0x990
[ 876.502831] netlink_release+0x6d3/0xb70
[ 876.502831] __sock_release+0x66/0x120
[ 876.502831] sock_close+0x11/0x20
[ 876.502831] __fput+0x1db/0x450
[ 876.502831] __x64_sys_close+0x51/0x90
[ 876.502831] do_syscall_64+0x5b/0xc0
[ 876.502831] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 876.502831]
[ 876.502831] The buggy address belongs to the object at ffff8881330b8000
[ 876.502831] which belongs to the cache kmalloc-2k of size 2048
[ 876.502831] The buggy address is located 4 bytes inside of
[ 876.502831] freed 2048-byte region [ffff8881330b8000, ffff8881330b8800)
[ 876.502831]
[ 876.502831] The buggy address belongs to the physical page:
[ 876.502831] page:000000007d194834 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8881330bf000 pfn:0x1330b8
[ 876.502831] head:000000007d194834 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 876.502831] flags: 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
[ 876.502831] page_type: 0xffffffff()
[ 876.502831] raw: 0017ffffc0000840 ffff888100042f00 dead000000000100 dead000000000122
[ 876.502831] raw: ffff8881330bf000 0000000080080007 00000001ffffffff 0000000000000000
[ 876.502831] page dumped because: kasan: bad access detected
[ 876.502831]
[ 876.502831] Memory state around the buggy address:
[ 876.502831] ffff8881330b7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 876.502831] ffff8881330b7f80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
[ 876.502831] >ffff8881330b8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 876.502831] ^
[ 876.502831] ffff8881330b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 876.502831] ffff8881330b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 876.502831] ==================================================================
[ 876.503733] Disabling lock debugging due to kernel taint
Applying the patch, the output will look like:
[ 1098.895487] KTAP version 1
[ 1098.895499] 1..1
[ 1098.896132] KTAP version 1
[ 1098.896139] # Subtest: drm_modes_analog_tv
[ 1098.896144] # module: drm_modes_test
[ 1098.896150] 1..4
[ 1098.906634] ok 1 drm_test_modes_analog_tv_ntsc_480i
[ 1098.920305] ok 2 drm_test_modes_analog_tv_ntsc_480i_inlined
[ 1098.931438] ok 3 drm_test_modes_analog_tv_pal_576i
[ 1098.941509] ok 4 drm_test_modes_analog_tv_pal_576i_inlined
[ 1098.941533] # drm_modes_analog_tv: pass:4 fail:0 skip:0 total:4
[ 1098.941546] # Totals: pass:4 fail:0 skip:0 total:4
[ 1098.941556] ok 1 drm_modes_analog_tv
Signed-off-by: José Pekkarinen <jose.pekkarinen@foxhound.fi>
---
drivers/gpu/drm/tests/drm_modes_test.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/gpu/drm/tests/drm_modes_test.c b/drivers/gpu/drm/tests/drm_modes_test.c
index 1e9f63fbfead..059c790810d6 100644
--- a/drivers/gpu/drm/tests/drm_modes_test.c
+++ b/drivers/gpu/drm/tests/drm_modes_test.c
@@ -36,6 +36,19 @@ static int drm_test_modes_init(struct kunit *test)
return 0;
}
+static void drm_test_modes_exit(struct kunit *test)
+{
+ struct drm_test_modes_priv *priv = test->priv;
+
+ drm_kunit_helper_free_device(test, priv->dev);
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, priv->dev);
+
+ drm_dev_put(priv->drm);
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, priv->drm);
+
+ kunit_kfree(test, priv);
+}
+
static void drm_test_modes_analog_tv_ntsc_480i(struct kunit *test)
{
struct drm_test_modes_priv *priv = test->priv;
@@ -64,6 +77,7 @@ static void drm_test_modes_analog_tv_ntsc_480i(struct kunit *test)
KUNIT_EXPECT_EQ(test, mode->vdisplay, 480);
KUNIT_EXPECT_EQ(test, mode->vtotal, 525);
+ drm_mode_destroy(priv->drm, mode);
}
static void drm_test_modes_analog_tv_ntsc_480i_inlined(struct kunit *test)
@@ -141,6 +155,7 @@ static struct kunit_case drm_modes_analog_tv_tests[] = {
static struct kunit_suite drm_modes_analog_tv_test_suite = {
.name = "drm_modes_analog_tv",
.init = drm_test_modes_init,
+ .exit = drm_test_modes_exit,
.test_cases = drm_modes_analog_tv_tests,
};
--
2.39.2
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] drm/tests: provide exit function
2023-09-13 12:19 José Pekkarinen
@ 2023-09-13 14:44 ` Maxime Ripard
0 siblings, 0 replies; 9+ messages in thread
From: Maxime Ripard @ 2023-09-13 14:44 UTC (permalink / raw)
To: José Pekkarinen
Cc: airlied, daniel, skhan, mairacanal, javierm, dri-devel,
linux-kernel, linux-kernel-mentees
[-- Attachment #1: Type: text/plain, Size: 14258 bytes --]
On Wed, Sep 13, 2023 at 03:19:00PM +0300, José Pekkarinen wrote:
> Similarly to the drm_exec_test module, the drm_modes_test
> shows the following output on dmesg on load:
>
> [ 5556.674834] KTAP version 1
> [ 5556.674841] 1..1
> [ 5556.675317] KTAP version 1
> [ 5556.675321] # Subtest: drm_modes_analog_tv
> [ 5556.675323] # module: drm_modes_test
> [ 5556.675327] 1..4
> [ 5556.683731] ==================================================================
> [ 5556.683777] BUG: KASAN: slab-use-after-free in drm_dev_put.part.0+0x4b/0x90 [drm]
> [ 5556.683882] Read of size 8 at addr ffff88812db30428 by task kunit_try_catch/75921
> [ 5556.683882]
> [ 5556.683882] CPU: 1 PID: 75921 Comm: kunit_try_catch Tainted: G W N 6.6.0-rc1-dirty #2
> [ 5556.683882] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
> [ 5556.683882] Call Trace:
> [ 5556.683882] <TASK>
> [ 5556.683882] dump_stack_lvl+0x43/0x60
> [ 5556.683882] print_report+0xcf/0x660
> [ 5556.683882] ? __virt_addr_valid+0xd9/0x160
> [ 5556.683882] ? drm_dev_put.part.0+0x4b/0x90 [drm]
> [ 5556.683882] kasan_report+0xda/0x110
> [ 5556.683882] ? drm_dev_put.part.0+0x4b/0x90 [drm]
> [ 5556.683882] drm_dev_put.part.0+0x4b/0x90 [drm]
> [ 5556.683882] release_nodes+0x83/0x160
> [ 5556.683882] devres_release_all+0xe6/0x130
> [ 5556.683882] ? __pfx_devres_release_all+0x10/0x10
> [ 5556.683882] ? mutex_unlock+0x80/0xd0
> [ 5556.683882] ? __pfx_mutex_unlock+0x10/0x10
> [ 5556.683882] device_unbind_cleanup+0x16/0xc0
> [ 5556.683882] device_release_driver_internal+0x28b/0x2e0
> [ 5556.683882] bus_remove_device+0x124/0x1d0
> [ 5556.683882] device_del+0x23d/0x580
> [ 5556.683882] ? __pfx_device_del+0x10/0x10
> [ 5556.683882] ? kasan_set_track+0x21/0x30
> [ 5556.683882] ? _raw_spin_lock_irqsave+0x98/0xf0
> [ 5556.683882] platform_device_del.part.0+0x19/0xe0
> [ 5556.683882] kunit_remove_resource+0xfa/0x140 [kunit]
> [ 5556.683882] kunit_cleanup+0x47/0xa0 [kunit]
> [ 5556.683882] ? __pfx_kunit_try_run_case_cleanup+0x10/0x10 [kunit]
> [ 5556.683882] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [kunit]
> [ 5556.683882] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
> [ 5556.683882] kthread+0x184/0x1c0
> [ 5556.683882] ? __pfx_kthread+0x10/0x10
> [ 5556.683882] ret_from_fork+0x30/0x50
> [ 5556.683882] ? __pfx_kthread+0x10/0x10
> [ 5556.683882] ret_from_fork_asm+0x1b/0x30
> [ 5556.683882] </TASK>
> [ 5556.683882]
> [ 5556.683882] Allocated by task 75920:
> [ 5556.683882] kasan_save_stack+0x2f/0x50
> [ 5556.683882] kasan_set_track+0x21/0x30
> [ 5556.683882] __kasan_kmalloc+0xa6/0xb0
> [ 5556.683882] __kmalloc+0x5d/0x160
> [ 5556.683882] kunit_kmalloc_array+0x1c/0x50 [kunit]
> [ 5556.683882] drm_test_modes_init+0xda/0x260 [drm_modes_test]
> [ 5556.683882] kunit_try_run_case+0x6e/0x100 [kunit]
> [ 5556.683882] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
> [ 5556.683882] kthread+0x184/0x1c0
> [ 5556.683882] ret_from_fork+0x30/0x50
> [ 5556.683882] ret_from_fork_asm+0x1b/0x30
> [ 5556.683882]
> [ 5556.683882] Freed by task 75921:
> [ 5556.683882] kasan_save_stack+0x2f/0x50
> [ 5556.683882] kasan_set_track+0x21/0x30
> [ 5556.683882] kasan_save_free_info+0x27/0x40
> [ 5556.683882] ____kasan_slab_free+0x166/0x1c0
> [ 5556.683882] slab_free_freelist_hook+0x9f/0x1e0
> [ 5556.683882] __kmem_cache_free+0x187/0x2d0
> [ 5556.683882] kunit_remove_resource+0xfa/0x140 [kunit]
> [ 5556.683882] kunit_cleanup+0x47/0xa0 [kunit]
> [ 5556.683882] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
> [ 5556.683882] kthread+0x184/0x1c0
> [ 5556.683882] ret_from_fork+0x30/0x50
> [ 5556.683882] ret_from_fork_asm+0x1b/0x30
> [ 5556.683882]
> [ 5556.683882] The buggy address belongs to the object at ffff88812db30400
> [ 5556.683882] which belongs to the cache kmalloc-256 of size 256
> [ 5556.683882] The buggy address is located 40 bytes inside of
> [ 5556.683882] freed 256-byte region [ffff88812db30400, ffff88812db30500)
> [ 5556.683882]
> [ 5556.683882] The buggy address belongs to the physical page:
> [ 5556.683882] page:00000000b3a5f157 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12db30
> [ 5556.683882] head:00000000b3a5f157 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> [ 5556.683882] ksm flags: 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
> [ 5556.683882] page_type: 0xffffffff()
> [ 5556.683882] raw: 0017ffffc0000840 ffff888100042b40 ffffea00053e2000 dead000000000003
> [ 5556.683882] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
> [ 5556.683882] page dumped because: kasan: bad access detected
> [ 5556.683882]
> [ 5556.683882] Memory state around the buggy address:
> [ 5556.683882] ffff88812db30300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 5556.683882] ffff88812db30380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 5556.683882] >ffff88812db30400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 5556.683882] ^
> [ 5556.683882] ffff88812db30480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 5556.683882] ffff88812db30500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 5556.683882] ==================================================================
> [ 5556.687191] Disabling lock debugging due to kernel taint
> [ 5556.689341] not ok 1 drm_test_modes_analog_tv_ntsc_480i
> [ 5556.700913] ok 2 drm_test_modes_analog_tv_ntsc_480i_inlined
> [ 5556.713501] ok 3 drm_test_modes_analog_tv_pal_576i
> [ 5556.724240] ok 4 drm_test_modes_analog_tv_pal_576i_inlined
> [ 5556.724260] # drm_modes_analog_tv: pass:3 fail:1 skip:0 total:4
> [ 5556.724270] # Totals: pass:3 fail:1 skip:0 total:4
> [ 5556.724279] not ok 8 drm_modes_analog_tv
>
> Unlike the drm_exec_test, this time it is required
> to guarantee that de drm mode is destroyed on the
> test that is created, otherwise it will trigger the
> following output:
>
> [ 876.491050] KTAP version 1
> [ 876.491057] 1..1
> [ 876.491467] KTAP version 1
> [ 876.491469] # Subtest: drm_modes_analog_tv
> [ 876.491473] # module: drm_modes_test
> [ 876.491477] 1..4
> [ 876.502373] ==================================================================
> [ 876.502386] BUG: KASAN: slab-use-after-free in drm_dev_put.part.0+0x1b/0x90 [drm]
> [ 876.502531] Write of size 4 at addr ffff8881330b8004 by task kunit_try_catch/13563
> [ 876.502536]
> [ 876.502539] CPU: 6 PID: 13563 Comm: kunit_try_catch Tainted: G N 6.6.0-rc1+ #3
> [ 876.502546] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
> [ 876.502550] Call Trace:
> [ 876.502554] <TASK>
> [ 876.502557] dump_stack_lvl+0x43/0x60
> [ 876.502568] print_report+0xcf/0x660
> [ 876.502577] ? __virt_addr_valid+0xd9/0x160
> [ 876.502586] ? drm_dev_put.part.0+0x1b/0x90 [drm]
> [ 876.502737] kasan_report+0xda/0x110
> [ 876.502744] ? drm_dev_put.part.0+0x1b/0x90 [drm]
> [ 876.502831] kasan_check_range+0xfc/0x1b0
> [ 876.502831] drm_dev_put.part.0+0x1b/0x90 [drm]
> [ 876.502831] drm_test_modes_exit+0xa8/0x160 [drm_modes_test]
> [ 876.502831] ? __pfx_drm_test_modes_exit+0x10/0x10 [drm_modes_test]
> [ 876.502831] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
> [ 876.502831] ? __pfx_set_cpus_allowed_ptr+0x10/0x10
> [ 876.502831] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10 [kunit]
> [ 876.502831] kunit_try_run_case_cleanup+0x5f/0x70 [kunit]
> [ 876.502831] ? __pfx_kunit_try_run_case_cleanup+0x10/0x10 [kunit]
> [ 876.502831] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
> [ 876.502831] kthread+0x184/0x1c0
> [ 876.502831] ? __pfx_kthread+0x10/0x10
> [ 876.502831] ret_from_fork+0x30/0x50
> [ 876.502831] ? __pfx_kthread+0x10/0x10
> [ 876.502831] ret_from_fork_asm+0x1b/0x30
> [ 876.502831] </TASK>
> [ 876.502831]
> [ 876.502831] Allocated by task 13562:
> [ 876.502831] kasan_save_stack+0x2f/0x50
> [ 876.502831] kasan_set_track+0x21/0x30
> [ 876.502831] __kasan_kmalloc+0xa6/0xb0
> [ 876.502831] __kmalloc+0x5d/0x160
> [ 876.502831] __devm_drm_dev_alloc+0x21/0xb0 [drm]
> [ 876.502831] __drm_kunit_helper_alloc_drm_device_with_driver+0x15/0x60 [drm_kunit_helpers]
> [ 876.502831] drm_test_modes_init+0x112/0x260 [drm_modes_test]
> [ 876.502831] kunit_try_run_case+0x6e/0x100 [kunit]
> [ 876.502831] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
> [ 876.502831] kthread+0x184/0x1c0
> [ 876.502831] ret_from_fork+0x30/0x50
> [ 876.502831] ret_from_fork_asm+0x1b/0x30
> [ 876.502831]
> [ 876.502831] Freed by task 13563:
> [ 876.502831] kasan_save_stack+0x2f/0x50
> [ 876.502831] kasan_set_track+0x21/0x30
> [ 876.502831] kasan_save_free_info+0x27/0x40
> [ 876.502831] ____kasan_slab_free+0x166/0x1c0
> [ 876.502831] slab_free_freelist_hook+0x9f/0x1e0
> [ 876.502831] __kmem_cache_free+0x187/0x2d0
> [ 876.502831] release_nodes+0x83/0x160
> [ 876.502831] devres_release_all+0xe6/0x130
> [ 876.502831] device_unbind_cleanup+0x16/0xc0
> [ 876.502831] device_release_driver_internal+0x28b/0x2e0
> [ 876.502831] bus_remove_device+0x124/0x1d0
> [ 876.502831] device_del+0x23d/0x580
> [ 876.502831] platform_device_del.part.0+0x19/0xe0
> [ 876.502831] kunit_release_action+0x1d7/0x230 [kunit]
> [ 876.502831] drm_kunit_helper_free_device+0x1d/0x50 [drm_kunit_helpers]
> [ 876.502831] drm_test_modes_exit+0x7f/0x160 [drm_modes_test]
> [ 876.502831] kunit_try_run_case_cleanup+0x5f/0x70 [kunit]
> [ 876.502831] kunit_generic_run_threadfn_adapter+0x29/0x50 [kunit]
> [ 876.502831] kthread+0x184/0x1c0
> [ 876.502831] ret_from_fork+0x30/0x50
> [ 876.502831] ret_from_fork_asm+0x1b/0x30
> [ 876.502831]
> [ 876.502831] Last potentially related work creation:
> [ 876.502831] kasan_save_stack+0x2f/0x50
> [ 876.502831] __kasan_record_aux_stack+0xaf/0xc0
> [ 876.502831] __call_rcu_common.constprop.0+0x9b/0x990
> [ 876.502831] netlink_release+0x6d3/0xb70
> [ 876.502831] __sock_release+0x66/0x120
> [ 876.502831] sock_close+0x11/0x20
> [ 876.502831] __fput+0x1db/0x450
> [ 876.502831] __x64_sys_close+0x51/0x90
> [ 876.502831] do_syscall_64+0x5b/0xc0
> [ 876.502831] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
> [ 876.502831]
> [ 876.502831] The buggy address belongs to the object at ffff8881330b8000
> [ 876.502831] which belongs to the cache kmalloc-2k of size 2048
> [ 876.502831] The buggy address is located 4 bytes inside of
> [ 876.502831] freed 2048-byte region [ffff8881330b8000, ffff8881330b8800)
> [ 876.502831]
> [ 876.502831] The buggy address belongs to the physical page:
> [ 876.502831] page:000000007d194834 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8881330bf000 pfn:0x1330b8
> [ 876.502831] head:000000007d194834 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> [ 876.502831] flags: 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff)
> [ 876.502831] page_type: 0xffffffff()
> [ 876.502831] raw: 0017ffffc0000840 ffff888100042f00 dead000000000100 dead000000000122
> [ 876.502831] raw: ffff8881330bf000 0000000080080007 00000001ffffffff 0000000000000000
> [ 876.502831] page dumped because: kasan: bad access detected
> [ 876.502831]
> [ 876.502831] Memory state around the buggy address:
> [ 876.502831] ffff8881330b7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 876.502831] ffff8881330b7f80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
> [ 876.502831] >ffff8881330b8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 876.502831] ^
> [ 876.502831] ffff8881330b8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 876.502831] ffff8881330b8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 876.502831] ==================================================================
> [ 876.503733] Disabling lock debugging due to kernel taint
>
> Applying the patch, the output will look like:
>
> [ 1098.895487] KTAP version 1
> [ 1098.895499] 1..1
> [ 1098.896132] KTAP version 1
> [ 1098.896139] # Subtest: drm_modes_analog_tv
> [ 1098.896144] # module: drm_modes_test
> [ 1098.896150] 1..4
> [ 1098.906634] ok 1 drm_test_modes_analog_tv_ntsc_480i
> [ 1098.920305] ok 2 drm_test_modes_analog_tv_ntsc_480i_inlined
> [ 1098.931438] ok 3 drm_test_modes_analog_tv_pal_576i
> [ 1098.941509] ok 4 drm_test_modes_analog_tv_pal_576i_inlined
> [ 1098.941533] # drm_modes_analog_tv: pass:4 fail:0 skip:0 total:4
> [ 1098.941546] # Totals: pass:4 fail:0 skip:0 total:4
> [ 1098.941556] ok 1 drm_modes_analog_tv
>
> Signed-off-by: José Pekkarinen <jose.pekkarinen@foxhound.fi>
> ---
> drivers/gpu/drm/tests/drm_modes_test.c | 15 +++++++++++++++
> 1 file changed, 15 insertions(+)
>
> diff --git a/drivers/gpu/drm/tests/drm_modes_test.c b/drivers/gpu/drm/tests/drm_modes_test.c
> index 1e9f63fbfead..059c790810d6 100644
> --- a/drivers/gpu/drm/tests/drm_modes_test.c
> +++ b/drivers/gpu/drm/tests/drm_modes_test.c
> @@ -36,6 +36,19 @@ static int drm_test_modes_init(struct kunit *test)
> return 0;
> }
>
> +static void drm_test_modes_exit(struct kunit *test)
> +{
> + struct drm_test_modes_priv *priv = test->priv;
> +
> + drm_kunit_helper_free_device(test, priv->dev);
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, priv->dev);
> +
> + drm_dev_put(priv->drm);
> + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, priv->drm);
> +
> + kunit_kfree(test, priv);
> +}
Again, this isn't necessary.
> static void drm_test_modes_analog_tv_ntsc_480i(struct kunit *test)
> {
> struct drm_test_modes_priv *priv = test->priv;
> @@ -64,6 +77,7 @@ static void drm_test_modes_analog_tv_ntsc_480i(struct kunit *test)
>
> KUNIT_EXPECT_EQ(test, mode->vdisplay, 480);
> KUNIT_EXPECT_EQ(test, mode->vtotal, 525);
> + drm_mode_destroy(priv->drm, mode);
> }
Any call to drm_analog_tv_mode should have it, not only this test. And
please make it a DRM managed action.
Maxime
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2023-09-14 14:40 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-09-13 8:32 [PATCH] drm/tests: provide exit function José Pekkarinen
2023-09-13 9:50 ` Maxime Ripard
2023-09-13 14:01 ` José Pekkarinen
2023-09-13 14:41 ` mripard
2023-09-13 16:35 ` José Pekkarinen
2023-09-14 12:00 ` Maxime Ripard
2023-09-14 14:24 ` José Pekkarinen
2023-09-13 12:19 José Pekkarinen
2023-09-13 14:44 ` Maxime Ripard
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®