From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.5 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3568AC433DB for ; Mon, 22 Feb 2021 16:21:48 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id E1C6364E2F for ; Mon, 22 Feb 2021 16:21:47 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E1C6364E2F Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=ffwll.ch Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 56B436E56A; Mon, 22 Feb 2021 16:21:47 +0000 (UTC) Received: from mail-wr1-x42a.google.com (mail-wr1-x42a.google.com [IPv6:2a00:1450:4864:20::42a]) by gabe.freedesktop.org (Postfix) with ESMTPS id 7FFE86E56A for ; Mon, 22 Feb 2021 16:21:46 +0000 (UTC) Received: by mail-wr1-x42a.google.com with SMTP id v15so19717473wrx.4 for ; Mon, 22 Feb 2021 08:21:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:content-transfer-encoding:in-reply-to; bh=4mQ9GAsz9Yz8HOTAKFDmDSdVZkxoH9s3m94s7cqHoDM=; b=jVSuyDLnGNmgl65vf/QLVlvy9dhtnh469nDCfcUpAIAsCc7V/rm9rhU8Cuml6qDhqO vRb02ed5h6NiVAlzwbPWzQ9S6KRV7+pn5E3P6ImNGDmx0G/vwMyN2hHp/trvMGcCsjzn wGd14SttIPsMBOYYjhkRTl7rwKNNuLd6Z4FPQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to; bh=4mQ9GAsz9Yz8HOTAKFDmDSdVZkxoH9s3m94s7cqHoDM=; b=QYEYGSEZdbc0HvlCsjz3zaGMP2EnBiG43Cx12tQQRpMlRc+SpyOL7TKyo6phl00YJp /RP2/ssmEPEg/BocuqlwGBcZbSftxcgFpDmcMf/2DxDhaIlX6d7+yQJ1f9Gfd75UzFu5 LfKzA4F9L6+Q97NtAAsQXj+lbN7Lx/ccMlItFhJOJfMQiiWowFGdGXAtVCVBCTprD6ZF r5g99v3P9sDEToht4L3T0GcPu9SyekdkWL+Utmw0w6aRqSZj6y4BgwWNnO6G+lx+Wze9 W5zpr2kA2UQsJOf2hQHr9pXT2YFkXUlos6tHUTvK+2jwTMPG3Zy3wOK6IG3rwzEdPIAN zgeQ== X-Gm-Message-State: AOAM533AcI/F6v9Baa05qWAlBv7pX7rv9YJTggRhacPbcx3rw/CsCOMQ G7FUI0E7959rXZYbg7psgrCAnfDP5MJzSA== X-Google-Smtp-Source: ABdhPJy4jIVtSRNvns/I1XgheLFS4UBrjfcND28jyB/HEbAE1Vq7TlNEGZLxKUpzG72DhdA7eti9yg== X-Received: by 2002:a05:6000:1081:: with SMTP id y1mr8262097wrw.177.1614010905211; Mon, 22 Feb 2021 08:21:45 -0800 (PST) Received: from phenom.ffwll.local ([2a02:168:57f4:0:efd0:b9e5:5ae6:c2fa]) by smtp.gmail.com with ESMTPSA id d20sm31336447wrc.12.2021.02.22.08.21.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 22 Feb 2021 08:21:44 -0800 (PST) Date: Mon, 22 Feb 2021 17:21:42 +0100 From: Daniel Vetter To: Thomas Zimmermann Subject: Re: [PATCH] drm/shmem-helper: Don't remove the offset in vm_area_struct pgoff Message-ID: References: <20210217165910.3820374-1-nroberts@igalia.com> <8f3ea5bb-4bfa-a3de-2d45-ec7110338587@suse.de> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <8f3ea5bb-4bfa-a3de-2d45-ec7110338587@suse.de> X-Operating-System: Linux phenom 5.7.0-1-amd64 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: dri-devel@lists.freedesktop.org, Steven Price , Neil Roberts , Rob Herring , Alyssa Rosenzweig Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" On Mon, Feb 22, 2021 at 03:24:17PM +0100, Thomas Zimmermann wrote: > Hi > = > Am 17.02.21 um 17:59 schrieb Neil Roberts: > > When mmapping the shmem, it would previously adjust the pgoff in the > > vm_area_struct to remove the fake offset that is added to be able to > > identify the buffer. This patch removes the adjustment and makes the > > fault handler use the vm_fault address to calculate the page offset > > instead. Although using this address is apparently discouraged, several > > DRM drivers seem to be doing it anyway. > > = > > The problem with removing the pgoff is that it prevents > > drm_vma_node_unmap from working because that searches the mapping tree > > by address. That doesn't work because all of the mappings are at offset > > 0. drm_vma_node_unmap is being used by the shmem helpers when purging > > the buffer. > = > I just want to ask if this is how the mmap callbacks are supposed to work > now? > = > I have a number of patches in here that convert several drivers to the GEM > object's mmap callback. They might not be affected by the vm_pgoff bug, b= ut > I'd like to submit something that could work in the longer term. Yeah we pretty much require the uniq vm_pgoff for runtime unmapping. Especially with more dynamic memory managers like ttm that move buffers around - for more static ones (most of the armsoc ones) it's just a bit a security issue since you can potentially access memory after it's gone. -Daniel > Best regards > Thomas > = > > = > > It looks like panfrost is using drm_gem_shmem_purge so this might fix a > > potential bug there. > > = > > Signed-off-by: Neil Roberts > > --- > > drivers/gpu/drm/drm_gem_shmem_helper.c | 12 +++++++----- > > 1 file changed, 7 insertions(+), 5 deletions(-) > > = > > diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/d= rm_gem_shmem_helper.c > > index 9825c378dfa6..4b14157f1962 100644 > > --- a/drivers/gpu/drm/drm_gem_shmem_helper.c > > +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c > > @@ -526,11 +526,16 @@ static vm_fault_t drm_gem_shmem_fault(struct vm_f= ault *vmf) > > struct drm_gem_shmem_object *shmem =3D to_drm_gem_shmem_obj(obj); > > loff_t num_pages =3D obj->size >> PAGE_SHIFT; > > struct page *page; > > + pgoff_t page_offset; > > - if (vmf->pgoff >=3D num_pages || WARN_ON_ONCE(!shmem->pages)) > > + /* We don't use vmf->pgoff since that has the fake offset */ > > + page_offset =3D (vmf->address - vma->vm_start) >> PAGE_SHIFT; > > + > > + if (page_offset < 0 || page_offset >=3D num_pages || > > + WARN_ON_ONCE(!shmem->pages)) > > return VM_FAULT_SIGBUS; > > - page =3D shmem->pages[vmf->pgoff]; > > + page =3D shmem->pages[page_offset]; > > return vmf_insert_page(vma, vmf->address, page); > > } > > @@ -581,9 +586,6 @@ int drm_gem_shmem_mmap(struct drm_gem_object *obj, = struct vm_area_struct *vma) > > struct drm_gem_shmem_object *shmem; > > int ret; > > - /* Remove the fake offset */ > > - vma->vm_pgoff -=3D drm_vma_node_start(&obj->vma_node); > > - > > if (obj->import_attach) { > > /* Drop the reference drm_gem_mmap_obj() acquired.*/ > > drm_gem_object_put(obj); > > = > = > -- = > Thomas Zimmermann > Graphics Driver Developer > SUSE Software Solutions Germany GmbH > Maxfeldstr. 5, 90409 N=FCrnberg, Germany > (HRB 36809, AG N=FCrnberg) > Gesch=E4ftsf=FChrer: Felix Imend=F6rffer > = > _______________________________________________ > dri-devel mailing list > dri-devel@lists.freedesktop.org > https://lists.freedesktop.org/mailman/listinfo/dri-devel -- = Daniel Vetter Software Engineer, Intel Corporation http://blog.ffwll.ch _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel