Re: [Intel-gfx] [PATCH v4 01/14] drm/ttm: stop calling tt_swapin in vm_access

Christian König
2021-09-21T11:28:47Z

Am 21.09.21 um 13:01 schrieb Matthew Auld:
> In commit:
>
> commit 09ac4fcb3f255e9225967c75f5893325c116cdbe
> Author: Felix Kuehling <Felix.Kuehling@amd.com>
> Date: Thu Jul 13 17:01:16 2017 -0400
>
> drm/ttm: Implement vm_operations_struct.access v2
>
> we added the vm_access hook, where we also directly call tt_swapin for
> some reason. If something is swapped-out then the ttm_tt must also be
> unpopulated, and since access_kmap should also call tt_populate, if
> needed, then swapping-in will already be handled there.

Sounds like you completely misunderstand what that is good for.

This is for debugger attaching to a process and peek/poke into the VMA
and completely unrelated to kmap.

>
> If anything, calling tt_swapin directly here would likely always fail
> since the tt->pages won't yet be populated, or worse since the tt->pages
> array is never actually cleared in unpopulate this might lead to a nasty
> uaf.

That's indeed true, but we just need to unconditionally call
ttm_tt_populate() here instead.

Regards,
Christian.

>
> Fixes: 09ac4fcb3f25 ("drm/ttm: Implement vm_operations_struct.access v2")
> Signed-off-by: Matthew Auld <matthew.auld@intel.com>
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Cc: Christian König <christian.koenig@amd.com>
> ---
> drivers/gpu/drm/ttm/ttm_bo_vm.c | 5 -----
> 1 file changed, 5 deletions(-)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> index f56be5bc0861..5b9b7fd01a69 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
> @@ -519,11 +519,6 @@ int ttm_bo_vm_access(struct vm_area_struct *vma, unsigned long addr,
>
> switch (bo->resource->mem_type) {
> case TTM_PL_SYSTEM:
> - if (unlikely(bo->ttm->page_flags & TTM_PAGE_FLAG_SWAPPED)) {
> - ret = ttm_tt_swapin(bo->ttm);
> - if (unlikely(ret != 0))
> - return ret;
> - }
> fallthrough;
> case TTM_PL_TT:
> ret = ttm_bo_vm_access_kmap(bo, offset, buf, len, write);