From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793214349; b=oDbiwmvk7Z7hq90Gnho8cUDQLqnWsmO2m3qimhcnmFGrlNaAcHZtRZLUOsWZz9YOy2Sm q5yu1AorgbpsXp48UsTctY3VWkaCILq528AuCDhoFtd0WPjykRI8Opwk0c+nOLUksgmdp lisPvf0NcbAU9MmIwPOYUZ4VWDtWYJxVRY4MUqzFkI2FiDw2ikIKw+d1e9Ii6EqsvOmC0 tLWgy+1k0MTG988Ob1emhvQN0oYxZ5JOpm1mXhar3C2aXuFb+QGjlVGJapIjNU0cbk+4I VZC4q/5UiKg1eJjVSidSOK2VG6X0REWyFhQP+ngZizjN/8dwxZ/AsSZ0mHl8OZwE3yA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793214349; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=XwnfSqs9lPFq2gaWcBFSuKba8kzgjLBZNidySGkgqPo=; b=xxXB1ltXTsOScezLQPUVFn6zCuP5OhHvnv2Fcg55XJpxfWCQBhouypBrbRkQNqztDq6/ nVfCIc/tmwX7oToqb7+wnY88yU2wWrslPzXyon/YuAKgS+UFP0Y2eRGyM5jZ+g2XAXQ43 AfyX/Ihvf7Uy/6uPbQm9jAJxjzyB2QAsC9N5BAtn4ZU47vl/pgASgDkx2Q5jcBvDE6Tot 9DRmc9j3miIpAwhmX4OccPJuy0dPNu5Ychee4qKtIqk2tj7p4n4sMLXOG8740GxfR1Q/O aZuRc2ebii5q6Vimgat+f4GvCfK0zzJtjL5Lh+Hqaqzh7XsQ3fKSo1rQiEcqZjHwi0A== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Ys7WT1cw; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D1B66606A326; Wed, 28 Oct 2026 19:05:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=Ys7WT1cw Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2C3501F01828; Wed, 28 Oct 2026 19:05:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793214348; bh=XwnfSqs9lPFq2gaWcBFSuKba8kzgjLBZNidySGkgqPo=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Ys7WT1cwSpOUFh2pVbob3ZTevK3FUv3nwz3zK2g/AjSXObgQhA8KROqzmyMA/RZwC zVpfFjbL6KGO5iIk5yagtA82mmo5Cz0Z8wVNPDGBF4S9DpVs5pxpsoBOhLnYQ5qZRh Xj04RqQvOt7i301aBwdR3JhMhhtYCElp4knVbzdc= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Ohad Sharabi , Oded Gabbay , Sasha Levin Subject: [PATCH 6.1 0827/1887] habanalabs: remove support to export dmabuf from handle Date: Wed, 28 Oct 2026 17:48:43 +0100 Message-ID: <20261028170518.244284596@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028170459.200466217@linuxfoundation.org> References: <20261028170459.200466217@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ohad Sharabi [ Upstream commit 303dad15ed8ccbb1702f3476642d8a43680f97b5 ] The API to the user which allows exporting DMA buffer from handle is deprecated here. It was never used as it is relevant only for Gaudi2, and the user stack has yet to add support for dmabuf in Gaudi2. Looking forward, a modified API to export DMA buffer for ASICs that supports virtual memory will be added. Until the new API will be ready- exporting DMA buffer will not be supported for ASICs with virtual memory. Signed-off-by: Ohad Sharabi Reviewed-by: Oded Gabbay Signed-off-by: Oded Gabbay Stable-dep-of: 33927f3d0ecd ("habanalabs: fix UAF in export_dmabuf()") Signed-off-by: Sasha Levin --- drivers/misc/habanalabs/common/habanalabs.h | 5 - drivers/misc/habanalabs/common/memory.c | 143 ++------------------ 2 files changed, 9 insertions(+), 139 deletions(-) diff --git a/drivers/misc/habanalabs/common/habanalabs.h b/drivers/misc/habanalabs/common/habanalabs.h index e6eabcdda1c5c..ca4b5ce5e6f8e 100644 --- a/drivers/misc/habanalabs/common/habanalabs.h +++ b/drivers/misc/habanalabs/common/habanalabs.h @@ -1732,8 +1732,6 @@ struct hl_cs_counters_atomic { * struct hl_dmabuf_priv - a dma-buf private object. * @dmabuf: pointer to dma-buf object. * @ctx: pointer to the dma-buf owner's context. - * @phys_pg_pack: pointer to physical page pack if the dma-buf was exported for - * memory allocation handle. * @device_address: physical address of the device's memory. Relevant only * if phys_pg_pack is NULL (dma-buf was exported from address). * The total size can be taken from the dmabuf object. @@ -1741,7 +1739,6 @@ struct hl_cs_counters_atomic { struct hl_dmabuf_priv { struct dma_buf *dmabuf; struct hl_ctx *ctx; - struct hl_vm_phys_pg_pack *phys_pg_pack; uint64_t device_address; }; @@ -2105,7 +2102,6 @@ struct hl_vm_hw_block_list_node { * @node: used to attach to deletion list that is used when all the allocations are cleared * at the teardown of the context. * @mapping_cnt: number of shared mappings. - * @exporting_cnt: number of dma-buf exporting. * @asid: the context related to this list. * @page_size: size of each page in the pack. * @flags: HL_MEM_* flags related to this list. @@ -2121,7 +2117,6 @@ struct hl_vm_phys_pg_pack { u64 total_size; struct list_head node; atomic_t mapping_cnt; - u32 exporting_cnt; u32 asid; u32 page_size; u32 flags; diff --git a/drivers/misc/habanalabs/common/memory.c b/drivers/misc/habanalabs/common/memory.c index a49038da3f6d0..7ae0779fbf072 100644 --- a/drivers/misc/habanalabs/common/memory.c +++ b/drivers/misc/habanalabs/common/memory.c @@ -371,12 +371,6 @@ static int free_device_memory(struct hl_ctx *ctx, struct hl_mem_in *args) return -EINVAL; } - if (phys_pg_pack->exporting_cnt) { - spin_unlock(&vm->idr_lock); - dev_dbg(hdev->dev, "handle %u is exported, cannot free\n", handle); - return -EINVAL; - } - /* must remove from idr before the freeing of the physical pages as the refcount of the pool * is also the trigger of the idr destroy */ @@ -1700,29 +1694,19 @@ static struct sg_table *hl_map_dmabuf(struct dma_buf_attachment *attachment, enum dma_data_direction dir) { struct dma_buf *dma_buf = attachment->dmabuf; - struct hl_vm_phys_pg_pack *phys_pg_pack; struct hl_dmabuf_priv *hl_dmabuf; struct hl_device *hdev; struct sg_table *sgt; hl_dmabuf = dma_buf->priv; hdev = hl_dmabuf->ctx->hdev; - phys_pg_pack = hl_dmabuf->phys_pg_pack; if (!attachment->peer2peer) { dev_dbg(hdev->dev, "Failed to map dmabuf because p2p is disabled\n"); return ERR_PTR(-EPERM); } - if (phys_pg_pack) - sgt = alloc_sgt_from_device_pages(hdev, - phys_pg_pack->pages, - phys_pg_pack->npages, - phys_pg_pack->page_size, - attachment->dev, - dir); - else - sgt = alloc_sgt_from_device_pages(hdev, + sgt = alloc_sgt_from_device_pages(hdev, &hl_dmabuf->device_address, 1, hl_dmabuf->dmabuf->size, @@ -1763,18 +1747,8 @@ static void hl_unmap_dmabuf(struct dma_buf_attachment *attachment, static void hl_release_dmabuf(struct dma_buf *dmabuf) { struct hl_dmabuf_priv *hl_dmabuf = dmabuf->priv; - struct hl_ctx *ctx = hl_dmabuf->ctx; - struct hl_device *hdev = ctx->hdev; - struct hl_vm *vm = &hdev->vm; - - if (hl_dmabuf->phys_pg_pack) { - spin_lock(&vm->idr_lock); - hl_dmabuf->phys_pg_pack->exporting_cnt--; - spin_unlock(&vm->idr_lock); - } hl_ctx_put(hl_dmabuf->ctx); - kfree(hl_dmabuf); } @@ -1785,7 +1759,7 @@ static const struct dma_buf_ops habanalabs_dmabuf_ops = { .release = hl_release_dmabuf, }; -static int export_dmabuf_common(struct hl_ctx *ctx, +static int export_dmabuf(struct hl_ctx *ctx, struct hl_dmabuf_priv *hl_dmabuf, u64 total_size, int flags, int *dmabuf_fd) { @@ -1849,6 +1823,11 @@ static int export_dmabuf_from_addr(struct hl_ctx *ctx, u64 device_addr, prop = &hdev->asic_prop; + if (prop->dram_supports_virtual_memory) { + dev_dbg(hdev->dev, "Export not supported for devices with virtual memory\n"); + return -EOPNOTSUPP; + } + if (!IS_ALIGNED(device_addr, PAGE_SIZE)) { dev_dbg(hdev->dev, "exported device memory address 0x%llx should be aligned to 0x%lx\n", @@ -1890,99 +1869,7 @@ static int export_dmabuf_from_addr(struct hl_ctx *ctx, u64 device_addr, hl_dmabuf->device_address = device_addr; - rc = export_dmabuf_common(ctx, hl_dmabuf, size, flags, dmabuf_fd); - if (rc) - goto err_free_dmabuf_wrapper; - - return 0; - -err_free_dmabuf_wrapper: - kfree(hl_dmabuf); - return rc; -} - -/** - * export_dmabuf_from_handle() - export a dma-buf object for the given memory - * handle. - * @ctx: pointer to the context structure. - * @handle: device memory allocation handle. - * @flags: DMA-BUF file/FD flags. - * @dmabuf_fd: pointer to result FD that represents the dma-buf object. - * - * Create and export a dma-buf object for an existing memory allocation inside - * the device memory, and return a FD which is associated with the dma-buf - * object. - * - * Return: 0 on success, non-zero for failure. - */ -static int export_dmabuf_from_handle(struct hl_ctx *ctx, u64 handle, int flags, - int *dmabuf_fd) -{ - struct hl_vm_phys_pg_pack *phys_pg_pack; - struct hl_dmabuf_priv *hl_dmabuf; - struct hl_device *hdev = ctx->hdev; - struct asic_fixed_properties *prop; - struct hl_vm *vm = &hdev->vm; - u64 bar_address; - int rc, i; - - prop = &hdev->asic_prop; - - if (upper_32_bits(handle)) { - dev_dbg(hdev->dev, "no match for handle 0x%llx\n", handle); - return -EINVAL; - } - - spin_lock(&vm->idr_lock); - - phys_pg_pack = idr_find(&vm->phys_pg_pack_handles, (u32) handle); - if (!phys_pg_pack) { - spin_unlock(&vm->idr_lock); - dev_dbg(hdev->dev, "no match for handle 0x%x\n", (u32) handle); - return -EINVAL; - } - - /* increment now to avoid freeing device memory while exporting */ - phys_pg_pack->exporting_cnt++; - - spin_unlock(&vm->idr_lock); - - if (phys_pg_pack->vm_type != VM_TYPE_PHYS_PACK) { - dev_dbg(hdev->dev, "handle 0x%llx does not represent DRAM memory\n", handle); - rc = -EINVAL; - goto err_dec_exporting_cnt; - } - - for (i = 0 ; i < phys_pg_pack->npages ; i++) { - - bar_address = hdev->dram_pci_bar_start + - (phys_pg_pack->pages[i] - - prop->dram_base_address); - - if (bar_address + phys_pg_pack->page_size > - hdev->dram_pci_bar_start + prop->dram_pci_bar_size || - bar_address + phys_pg_pack->page_size < bar_address) { - - dev_dbg(hdev->dev, - "DRAM memory range 0x%llx (+0x%x) is outside of PCI BAR boundaries\n", - phys_pg_pack->pages[i], - phys_pg_pack->page_size); - - rc = -EINVAL; - goto err_dec_exporting_cnt; - } - } - - hl_dmabuf = kzalloc(sizeof(*hl_dmabuf), GFP_KERNEL); - if (!hl_dmabuf) { - rc = -ENOMEM; - goto err_dec_exporting_cnt; - } - - hl_dmabuf->phys_pg_pack = phys_pg_pack; - - rc = export_dmabuf_common(ctx, hl_dmabuf, phys_pg_pack->total_size, - flags, dmabuf_fd); + rc = export_dmabuf(ctx, hl_dmabuf, size, flags, dmabuf_fd); if (rc) goto err_free_dmabuf_wrapper; @@ -1990,12 +1877,6 @@ static int export_dmabuf_from_handle(struct hl_ctx *ctx, u64 handle, int flags, err_free_dmabuf_wrapper: kfree(hl_dmabuf); - -err_dec_exporting_cnt: - spin_lock(&vm->idr_lock); - phys_pg_pack->exporting_cnt--; - spin_unlock(&vm->idr_lock); - return rc; } @@ -2270,13 +2151,7 @@ int hl_mem_ioctl(struct hl_fpriv *hpriv, void *data) break; case HL_MEM_OP_EXPORT_DMABUF_FD: - if (hdev->asic_prop.dram_supports_virtual_memory) - rc = export_dmabuf_from_handle(ctx, - args->in.export_dmabuf_fd.handle, - args->in.flags, - &dmabuf_fd); - else - rc = export_dmabuf_from_addr(ctx, + rc = export_dmabuf_from_addr(ctx, args->in.export_dmabuf_fd.handle, args->in.export_dmabuf_fd.mem_size, args->in.flags, -- 2.53.0