From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.2 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_2 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A6047C388F7 for ; Wed, 28 Oct 2020 08:44:23 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 1FAD82465D for ; Wed, 28 Oct 2020 08:44:22 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 1FAD82465D Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=collabora.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 308EA6E4AA; Wed, 28 Oct 2020 08:44:22 +0000 (UTC) Received: from bhuna.collabora.co.uk (bhuna.collabora.co.uk [IPv6:2a00:1098:0:82:1000:25:2eeb:e3e3]) by gabe.freedesktop.org (Postfix) with ESMTPS id 0A1EF6E4AA for ; Wed, 28 Oct 2020 08:44:21 +0000 (UTC) Received: from localhost (unknown [IPv6:2a01:e0a:2c:6930:5cf4:84a1:2763:fe0d]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: bbrezillon) by bhuna.collabora.co.uk (Postfix) with ESMTPSA id AC78B1F447F5; Wed, 28 Oct 2020 08:44:18 +0000 (GMT) Date: Wed, 28 Oct 2020 09:44:15 +0100 From: Boris Brezillon To: Daniel Vetter Subject: Re: [PATCH] drm/shme-helpers: Fix dma_buf_mmap forwarding bug Message-ID: <20201028094415.7a7782b8@collabora.com> In-Reply-To: <20201027214922.3566743-1-daniel.vetter@ffwll.ch> References: <20201027214922.3566743-1-daniel.vetter@ffwll.ch> Organization: Collabora X-Mailer: Claws Mail 3.17.7 (GTK+ 2.24.32; x86_64-redhat-linux-gnu) MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Joonyoung Shim , piotr.oniszczuk@gmail.com, Daniel Vetter , Seung-Woo Kim , Kyungmin Park , DRI Development , Gerd Hoffmann , Thomas Zimmermann , Russell King , stable@vger.kernel.org, linux-media@vger.kernel.org, linaro-mm-sig@lists.linaro.org, Christian =?UTF-8?B?S8O2bmln?= Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" T24gVHVlLCAyNyBPY3QgMjAyMCAyMjo0OToyMiArMDEwMApEYW5pZWwgVmV0dGVyIDxkYW5pZWwu dmV0dGVyQGZmd2xsLmNoPiB3cm90ZToKCj4gV2hlbiB3ZSBmb3J3YXJkIGFuIG1tYXAgdG8gdGhl IGRtYV9idWYgZXhwb3J0ZXIsIHRoZXkgZ2V0IHRvIG93bgo+IGV2ZXJ5dGhpbmcuIFVuZm9ydHVu YXRlbHkgZHJtX2dlbV9tbWFwX29iaigpIG92ZXJ3cm90ZQo+IHZtYS0+dm1fcHJpdmF0ZV9kYXRh IGFmdGVyIHRoZSBkcml2ZXIgY2FsbGJhY2ssIHdyZWFraW5nIHRoZQo+IGV4cG9ydGVyIGNvbXBs ZXRlLiBUaGlzIHdhcyBub3RpY2VkIGJlY2F1c2UgdmIyX2NvbW1vbl92bV9jbG9zZSBibGV3Cj4g dXAgb24gbWFsaSBncHUgd2l0aCBwYW5mcm9zdCBhZnRlciBjb21taXQgMjZkM2FjM2NiMDRkCj4g KCJkcm0vc2htZW0taGVscGVyczogUmVkaXJlY3QgbW1hcCBmb3IgaW1wb3J0ZWQgZG1hLWJ1ZiIp Lgo+IAo+IFVuZm9ydHVuYXRlbHkgZHJtX2dlbV9tbWFwX29iaiBhbHNvIGFjcXVpcmVzIGEgc3Vy cGx1cyByZWZlcmVuY2UgdGhhdAo+IHdlIG5lZWQgdG8gZHJvcCBpbiBzaG1lbSBoZWxwZXJzLCB3 aGljaCBpcyBhIGJpdCBvZiBhIG1pc2xheWVyCj4gc2l0dWF0aW9uLiBNYXliZSB0aGUgZW50aXJl IGRtYV9idWZfbW1hcCBmb3J3YXJkaW5nIHNob3VsZCBiZSBwdWxsZWQKPiBpbnRvIGNvcmUgZ2Vt IGNvZGUuCj4gCj4gTm90ZSB0aGF0IHRoZSBvbmx5IHR3byBvdGhlciBkcml2ZXJzIHdoaWNoIGZv cndhcmQgbW1hcCBpbiB0aGVpciBvd24KPiBjb2RlIChldG5hdml2IGFuZCBleHlub3MpIGdldCB0 aGlzIHNvbWV3aGF0IHJpZ2h0IGJ5IG92ZXJ3cml0aW5nIHRoZQo+IGdlbSBtbWFwIGNvZGUuIEJ1 dCB0aGV5IHNlZW0gdG8gc3RpbGwgaGF2ZSB0aGUgbGVhay4gVGhpcyBtaWdodCBiZSBhCj4gZ29v ZCBleGN1c2UgdG8gbW92ZSB0aGVzZSBkcml2ZXJzIG92ZXIgdG8gc2htZW0gaGVscGVycyBjb21w bGV0ZWx5Lgo+IAo+IE5vdGUgdG8gc3RhYmxlIHRlYW06IFRoZXJlJ3MgYSB0cml2aWFsIGNvbnRl eHQgY29uZmxpY3Qgd2l0aAo+IGQ2OTNkZWY0ZmQxYyAoImRybTogUmVtb3ZlIG9ic29sZXRlIEdF TSBhbmQgUFJJTUUgY2FsbGJhY2tzIGZyb20KPiBzdHJ1Y3QgZHJtX2RyaXZlciIpLiBJJ20gYXNz dW1pbmcgaXQncyBjbGVhciB3aGVyZSB0byBwdXQgdGhlIGZpcnN0Cj4gaHVuaywgb3RoZXJ3aXNl IEkgY2FuIHNlbmQgYSA1LjkgdmVyc2lvbiBvZiB0aGlzLgo+IAo+IENjOiBDaHJpc3RpYW4gS8O2 bmlnIDxjaHJpc3RpYW4ua29lbmlnQGFtZC5jb20+Cj4gQ2M6IFN1bWl0IFNlbXdhbCA8c3VtaXQu c2Vtd2FsQGxpbmFyby5vcmc+Cj4gQ2M6IEx1Y2FzIFN0YWNoIDxsLnN0YWNoQHBlbmd1dHJvbml4 LmRlPgo+IENjOiBSdXNzZWxsIEtpbmcgPGxpbnV4K2V0bmF2aXZAYXJtbGludXgub3JnLnVrPgo+ IENjOiBDaHJpc3RpYW4gR21laW5lciA8Y2hyaXN0aWFuLmdtZWluZXJAZ21haWwuY29tPgo+IENj OiBJbmtpIERhZSA8aW5raS5kYWVAc2Ftc3VuZy5jb20+Cj4gQ2M6IEpvb255b3VuZyBTaGltIDxq eTA5MjIuc2hpbUBzYW1zdW5nLmNvbT4KPiBDYzogU2V1bmctV29vIEtpbSA8c3cwMzEyLmtpbUBz YW1zdW5nLmNvbT4KPiBDYzogS3l1bmdtaW4gUGFyayA8a3l1bmdtaW4ucGFya0BzYW1zdW5nLmNv bT4KPiBGaXhlczogMjZkM2FjM2NiMDRkICgiZHJtL3NobWVtLWhlbHBlcnM6IFJlZGlyZWN0IG1t YXAgZm9yIGltcG9ydGVkIGRtYS1idWYiKQo+IENjOiBCb3JpcyBCcmV6aWxsb24gPGJvcmlzLmJy ZXppbGxvbkBjb2xsYWJvcmEuY29tPgoKUmV2aWV3ZWQtYnk6IEJvcmlzIEJyZXppbGxvbiA8Ym9y aXMuYnJlemlsbG9uQGNvbGxhYm9yYS5jb20+Cgo+IENjOiBUaG9tYXMgWmltbWVybWFubiA8dHpp bW1lcm1hbm5Ac3VzZS5kZT4KPiBDYzogR2VyZCBIb2ZmbWFubiA8a3JheGVsQHJlZGhhdC5jb20+ Cj4gQ2M6IFJvYiBIZXJyaW5nIDxyb2JoQGtlcm5lbC5vcmc+Cj4gQ2M6IGRyaS1kZXZlbEBsaXN0 cy5mcmVlZGVza3RvcC5vcmcKPiBDYzogbGludXgtbWVkaWFAdmdlci5rZXJuZWwub3JnCj4gQ2M6 IGxpbmFyby1tbS1zaWdAbGlzdHMubGluYXJvLm9yZwo+IENjOiA8c3RhYmxlQHZnZXIua2VybmVs Lm9yZz4gIyB2NS45Kwo+IFJlcG9ydGVkLWFuZC10ZXN0ZWQtYnk6IHBpb3RyLm9uaXN6Y3p1a0Bn bWFpbC5jb20KPiBDYzogcGlvdHIub25pc3pjenVrQGdtYWlsLmNvbQo+IFNpZ25lZC1vZmYtYnk6 IERhbmllbCBWZXR0ZXIgPGRhbmllbC52ZXR0ZXJAaW50ZWwuY29tPgo+IC0tLQo+ICBkcml2ZXJz L2dwdS9kcm0vZHJtX2dlbS5jICAgICAgICAgICAgICB8IDQgKystLQo+ICBkcml2ZXJzL2dwdS9k cm0vZHJtX2dlbV9zaG1lbV9oZWxwZXIuYyB8IDcgKysrKysrLQo+ICAyIGZpbGVzIGNoYW5nZWQs IDggaW5zZXJ0aW9ucygrKSwgMyBkZWxldGlvbnMoLSkKPiAKPiBkaWZmIC0tZ2l0IGEvZHJpdmVy cy9ncHUvZHJtL2RybV9nZW0uYyBiL2RyaXZlcnMvZ3B1L2RybS9kcm1fZ2VtLmMKPiBpbmRleCAx ZGE2N2QzNGU1NWQuLmQ1ODYwNjhmNTUwOSAxMDA2NDQKPiAtLS0gYS9kcml2ZXJzL2dwdS9kcm0v ZHJtX2dlbS5jCj4gKysrIGIvZHJpdmVycy9ncHUvZHJtL2RybV9nZW0uYwo+IEBAIC0xMDc2LDYg KzEwNzYsOCBAQCBpbnQgZHJtX2dlbV9tbWFwX29iaihzdHJ1Y3QgZHJtX2dlbV9vYmplY3QgKm9i aiwgdW5zaWduZWQgbG9uZyBvYmpfc2l6ZSwKPiAgCSAqLwo+ICAJZHJtX2dlbV9vYmplY3RfZ2V0 KG9iaik7Cj4gIAo+ICsJdm1hLT52bV9wcml2YXRlX2RhdGEgPSBvYmo7Cj4gKwo+ICAJaWYgKG9i ai0+ZnVuY3MtPm1tYXApIHsKPiAgCQlyZXQgPSBvYmotPmZ1bmNzLT5tbWFwKG9iaiwgdm1hKTsK PiAgCQlpZiAocmV0KSB7Cj4gQEAgLTEwOTYsOCArMTA5OCw2IEBAIGludCBkcm1fZ2VtX21tYXBf b2JqKHN0cnVjdCBkcm1fZ2VtX29iamVjdCAqb2JqLCB1bnNpZ25lZCBsb25nIG9ial9zaXplLAo+ ICAJCXZtYS0+dm1fcGFnZV9wcm90ID0gcGdwcm90X2RlY3J5cHRlZCh2bWEtPnZtX3BhZ2VfcHJv dCk7Cj4gIAl9Cj4gIAo+IC0Jdm1hLT52bV9wcml2YXRlX2RhdGEgPSBvYmo7Cj4gLQo+ICAJcmV0 dXJuIDA7Cj4gIH0KPiAgRVhQT1JUX1NZTUJPTChkcm1fZ2VtX21tYXBfb2JqKTsKPiBkaWZmIC0t Z2l0IGEvZHJpdmVycy9ncHUvZHJtL2RybV9nZW1fc2htZW1faGVscGVyLmMgYi9kcml2ZXJzL2dw dS9kcm0vZHJtX2dlbV9zaG1lbV9oZWxwZXIuYwo+IGluZGV4IGZiMTFkZjdhY2VkNS4uODIzM2Jk YTQ2OTJmIDEwMDY0NAo+IC0tLSBhL2RyaXZlcnMvZ3B1L2RybS9kcm1fZ2VtX3NobWVtX2hlbHBl ci5jCj4gKysrIGIvZHJpdmVycy9ncHUvZHJtL2RybV9nZW1fc2htZW1faGVscGVyLmMKPiBAQCAt NTk4LDggKzU5OCwxMyBAQCBpbnQgZHJtX2dlbV9zaG1lbV9tbWFwKHN0cnVjdCBkcm1fZ2VtX29i amVjdCAqb2JqLCBzdHJ1Y3Qgdm1fYXJlYV9zdHJ1Y3QgKnZtYSkKPiAgCS8qIFJlbW92ZSB0aGUg ZmFrZSBvZmZzZXQgKi8KPiAgCXZtYS0+dm1fcGdvZmYgLT0gZHJtX3ZtYV9ub2RlX3N0YXJ0KCZv YmotPnZtYV9ub2RlKTsKPiAgCj4gLQlpZiAob2JqLT5pbXBvcnRfYXR0YWNoKQo+ICsJaWYgKG9i ai0+aW1wb3J0X2F0dGFjaCkgewo+ICsJCS8qIERyb3AgdGhlIHJlZmVyZW5jZSBkcm1fZ2VtX21t YXBfb2JqKCkgYWNxdWlyZWQuKi8KPiArCQlkcm1fZ2VtX29iamVjdF9wdXQob2JqKTsKPiArCQl2 bWEtPnZtX3ByaXZhdGVfZGF0YSA9IE5VTEw7Cj4gKwo+ICAJCXJldHVybiBkbWFfYnVmX21tYXAo b2JqLT5kbWFfYnVmLCB2bWEsIDApOwo+ICsJfQo+ICAKPiAgCXNobWVtID0gdG9fZHJtX2dlbV9z aG1lbV9vYmoob2JqKTsKPiAgCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fXwpkcmktZGV2ZWwgbWFpbGluZyBsaXN0CmRyaS1kZXZlbEBsaXN0cy5mcmVlZGVz a3RvcC5vcmcKaHR0cHM6Ly9saXN0cy5mcmVlZGVza3RvcC5vcmcvbWFpbG1hbi9saXN0aW5mby9k cmktZGV2ZWwK From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.2 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_2 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8933CC56201 for ; Wed, 28 Oct 2020 21:40:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4EBE7246AB for ; Wed, 28 Oct 2020 21:40:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727203AbgJ1VkX convert rfc822-to-8bit (ORCPT ); Wed, 28 Oct 2020 17:40:23 -0400 Received: from bhuna.collabora.co.uk ([46.235.227.227]:35134 "EHLO bhuna.collabora.co.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727150AbgJ1VkW (ORCPT ); Wed, 28 Oct 2020 17:40:22 -0400 Received: from localhost (unknown [IPv6:2a01:e0a:2c:6930:5cf4:84a1:2763:fe0d]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) (Authenticated sender: bbrezillon) by bhuna.collabora.co.uk (Postfix) with ESMTPSA id AC78B1F447F5; Wed, 28 Oct 2020 08:44:18 +0000 (GMT) Date: Wed, 28 Oct 2020 09:44:15 +0100 From: Boris Brezillon To: Daniel Vetter Cc: DRI Development , Christian =?UTF-8?B?S8O2bmln?= , Sumit Semwal , Lucas Stach , Russell King , Christian Gmeiner , Inki Dae , Joonyoung Shim , Seung-Woo Kim , Kyungmin Park , Thomas Zimmermann , Gerd Hoffmann , Rob Herring , linux-media@vger.kernel.org, linaro-mm-sig@lists.linaro.org, stable@vger.kernel.org, piotr.oniszczuk@gmail.com, Daniel Vetter Subject: Re: [PATCH] drm/shme-helpers: Fix dma_buf_mmap forwarding bug Message-ID: <20201028094415.7a7782b8@collabora.com> In-Reply-To: <20201027214922.3566743-1-daniel.vetter@ffwll.ch> References: <20201027214922.3566743-1-daniel.vetter@ffwll.ch> Organization: Collabora X-Mailer: Claws Mail 3.17.7 (GTK+ 2.24.32; x86_64-redhat-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8BIT Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org On Tue, 27 Oct 2020 22:49:22 +0100 Daniel Vetter wrote: > When we forward an mmap to the dma_buf exporter, they get to own > everything. Unfortunately drm_gem_mmap_obj() overwrote > vma->vm_private_data after the driver callback, wreaking the > exporter complete. This was noticed because vb2_common_vm_close blew > up on mali gpu with panfrost after commit 26d3ac3cb04d > ("drm/shmem-helpers: Redirect mmap for imported dma-buf"). > > Unfortunately drm_gem_mmap_obj also acquires a surplus reference that > we need to drop in shmem helpers, which is a bit of a mislayer > situation. Maybe the entire dma_buf_mmap forwarding should be pulled > into core gem code. > > Note that the only two other drivers which forward mmap in their own > code (etnaviv and exynos) get this somewhat right by overwriting the > gem mmap code. But they seem to still have the leak. This might be a > good excuse to move these drivers over to shmem helpers completely. > > Note to stable team: There's a trivial context conflict with > d693def4fd1c ("drm: Remove obsolete GEM and PRIME callbacks from > struct drm_driver"). I'm assuming it's clear where to put the first > hunk, otherwise I can send a 5.9 version of this. > > Cc: Christian König > Cc: Sumit Semwal > Cc: Lucas Stach > Cc: Russell King > Cc: Christian Gmeiner > Cc: Inki Dae > Cc: Joonyoung Shim > Cc: Seung-Woo Kim > Cc: Kyungmin Park > Fixes: 26d3ac3cb04d ("drm/shmem-helpers: Redirect mmap for imported dma-buf") > Cc: Boris Brezillon Reviewed-by: Boris Brezillon > Cc: Thomas Zimmermann > Cc: Gerd Hoffmann > Cc: Rob Herring > Cc: dri-devel@lists.freedesktop.org > Cc: linux-media@vger.kernel.org > Cc: linaro-mm-sig@lists.linaro.org > Cc: # v5.9+ > Reported-and-tested-by: piotr.oniszczuk@gmail.com > Cc: piotr.oniszczuk@gmail.com > Signed-off-by: Daniel Vetter > --- > drivers/gpu/drm/drm_gem.c | 4 ++-- > drivers/gpu/drm/drm_gem_shmem_helper.c | 7 ++++++- > 2 files changed, 8 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c > index 1da67d34e55d..d586068f5509 100644 > --- a/drivers/gpu/drm/drm_gem.c > +++ b/drivers/gpu/drm/drm_gem.c > @@ -1076,6 +1076,8 @@ int drm_gem_mmap_obj(struct drm_gem_object *obj, unsigned long obj_size, > */ > drm_gem_object_get(obj); > > + vma->vm_private_data = obj; > + > if (obj->funcs->mmap) { > ret = obj->funcs->mmap(obj, vma); > if (ret) { > @@ -1096,8 +1098,6 @@ int drm_gem_mmap_obj(struct drm_gem_object *obj, unsigned long obj_size, > vma->vm_page_prot = pgprot_decrypted(vma->vm_page_prot); > } > > - vma->vm_private_data = obj; > - > return 0; > } > EXPORT_SYMBOL(drm_gem_mmap_obj); > diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c > index fb11df7aced5..8233bda4692f 100644 > --- a/drivers/gpu/drm/drm_gem_shmem_helper.c > +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c > @@ -598,8 +598,13 @@ int drm_gem_shmem_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma) > /* Remove the fake offset */ > vma->vm_pgoff -= drm_vma_node_start(&obj->vma_node); > > - if (obj->import_attach) > + if (obj->import_attach) { > + /* Drop the reference drm_gem_mmap_obj() acquired.*/ > + drm_gem_object_put(obj); > + vma->vm_private_data = NULL; > + > return dma_buf_mmap(obj->dma_buf, vma, 0); > + } > > shmem = to_drm_gem_shmem_obj(obj); >