tests/gem_userptr_blits: Race between object creation and multi-threaded mm ops

Userptr v23 was not thread safe against memory map operations and object
creation from separate threads. MMU notifier callback would get triggered
on a partially constructed object causing a NULL pointer dereference.

This test excercises that path a bit. In my testing it would trigger it
every time and easily, but unfortunately a test pass here does not guarantee
the absence of the race.

v2: Added explicit cancellation point and removed the stop flag.
    Use only igt_assert().

Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

1 files changed, 51 insertions, 0 deletions

diff --git a/tests/gem_userptr_blits.c b/tests/gem_userptr_blits.c
index 2eb127f7..f80b4679 100644
--- a/tests/gem_userptr_blits.c
+++ b/tests/gem_userptr_blits.c
@@ -47,6 +47,7 @@
 #include <sys/time.h>
 #include <sys/mman.h>
 #include <signal.h>
+#include <pthread.h>
 
 #include "drm.h"
 #include "i915_drm.h"
@@ -1107,6 +1108,53 @@ static int test_unmap_cycles(int fd, int expected)
 	return 0;
 }
 
+static void *mm_stress_thread(void *data)
+{
+        void *ptr;
+        int ret;
+
+	for (;;) {
+		ptr = mmap(NULL, PAGE_SIZE, PROT_READ | PROT_WRITE,
+				MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
+		igt_assert(ptr != MAP_FAILED);
+		ret = munmap(ptr, PAGE_SIZE);
+		igt_assert(ret == 0);
+		pthread_testcancel();
+        }
+
+        return NULL;
+}
+
+static int test_stress_mm(int fd)
+{
+	int ret;
+	pthread_t t;
+	unsigned int loops = 100000;
+	uint32_t handle;
+	void *ptr;
+
+	igt_assert(posix_memalign(&ptr, PAGE_SIZE, PAGE_SIZE) == 0);
+
+	ret = pthread_create(&t, NULL, mm_stress_thread, NULL);
+	igt_assert(ret == 0);
+
+	while (loops--) {
+		ret = gem_userptr(fd, ptr, PAGE_SIZE, 0, &handle);
+		igt_assert(ret == 0);
+
+		gem_close(fd, handle);
+	}
+
+	free(ptr);
+
+	ret = pthread_cancel(t);
+	igt_assert(ret == 0);
+	ret = pthread_join(t, NULL);
+	igt_assert(ret == 0);
+
+	return 0;
+}
+
 unsigned int total_ram;
 uint64_t aperture_size;
 int fd, count;
@@ -1261,6 +1309,9 @@ int main(int argc, char **argv)
 	igt_subtest("sync-unmap-after-close")
 		test_unmap_after_close(fd);
 
+	igt_subtest("stress-mm")
+	        test_stress_mm(fd);
+
 	igt_subtest("coherency-sync")
 		test_coherency(fd, count);