Re: [PATCH V1 2/2] accel/amdxdna: use drm_gpusvm_pages for user mapping tracking

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] accel/amdxdna: incorrect mm usage in amdxdna_hmm_register()
  [1]
--

commit c54d5e6dbf44961e3d8dc3f2a76a49df30f7a6ae
Author: Matthew Brost <matthew.brost@intel.com>

accel/amdxdna: use drm_gpusvm_pages for user mapping tracking

This commit replaces the open-coded HMM range and invalidation tracking for
user BO mappings in amdxdna with drm_gpusvm and drm_gpusvm_pages in
pages-only mode.

> diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c
> index 09e48c794e1b0..57d87fa98d671 100644
> --- a/drivers/accel/amdxdna/amdxdna_gem.c
> +++ b/drivers/accel/amdxdna/amdxdna_gem.c

[ ... ]

> @@ -441,38 +473,34 @@ static int amdxdna_hmm_register(struct amdxdna_gem_obj *abo,
>  		return 0;
>  	}
>  
> -	down_read(&xdna->notifier_lock);
> +	down_read(&xdna->gpusvm.notifier_lock);
>  	list_for_each_entry(mapp, &abo->mem.umap_list, node) {
> -		if (compare_range(mapp, current->mm, addr, addr + len)) {
> -			up_read(&xdna->notifier_lock);
> +		if (amdxdna_umap_match(mapp, current->mm, addr, addr + len)) {
> +			up_read(&xdna->gpusvm.notifier_lock);
>  			return 0;
>  		}
>  	}
> -	up_read(&xdna->notifier_lock);
> +	up_read(&xdna->gpusvm.notifier_lock);

[Severity: Critical]
This problem wasn't introduced by this patch [1], but should
amdxdna_hmm_register() use vma->vm_mm instead of current->mm here and in
mmu_interval_notifier_insert_locked() below?

When mmap() runs from a worker on behalf of another task (such as via
io_uring), current->mm does not match vma->vm_mm. Attaching mapp->notifier
to current->mm misses invalidations in the target address space, allowing
the device to access freed or migrated pages, and prevents
amdxdna_hmm_unregister() (which checks vma->vm_mm) from finding and
unregistering mapp on teardown.

[1] https://sashiko.dev/#/bug/linux-aad73166-1806-490b-9ad1-d63c62db536d

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106184217.2720718-1-lizhi.hou@amd.com?part=2