public inbox for intel-gfx@lists.freedesktop.org
 help / color / mirror / Atom feed
* [Intel-gfx] [PATCH 1/2] drm/i915/ttm: fix uaf with lmem_userfault_list handling
@ 2022-11-07 16:54 Matthew Auld
  2022-11-07 16:54 ` [Intel-gfx] [PATCH 2/2] drm/i915/ttm: add some sanity checks for lmem_userfault_list Matthew Auld
                   ` (4 more replies)
  0 siblings, 5 replies; 9+ messages in thread
From: Matthew Auld @ 2022-11-07 16:54 UTC (permalink / raw)
  To: intel-gfx; +Cc: Nirmoy Das, Andrzej Hajda, Rodrigo Vivi

In the fault handler, make sure we check if the BO maps lmem after
we schedule the migration, since the current resource might change from
lmem to smem, if the pages are in the non-cpu visible portion of lmem.
This then leads to adding the object to the lmem_userfault_list even
though the current resource is no longer lmem. If we then destroy the
object, the list might still contain a link to the now free object, since
we only remove it if the object is still in lmem.

Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/7469
Fixes: ad74457a6b5a ("drm/i915/dgfx: Release mmap on rpm suspend")
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Anshuman Gupta <anshuman.gupta@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Andrzej Hajda <andrzej.hajda@intel.com>
Cc: Nirmoy Das <nirmoy.das@intel.com>
---
 drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
index 25129af70f70..9421dc4dc98f 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
@@ -1048,9 +1048,6 @@ static vm_fault_t vm_fault_ttm(struct vm_fault *vmf)
 		return VM_FAULT_SIGBUS;
 	}
 
-	if (i915_ttm_cpu_maps_iomem(bo->resource))
-		wakeref = intel_runtime_pm_get(&to_i915(obj->base.dev)->runtime_pm);
-
 	if (!i915_ttm_resource_mappable(bo->resource)) {
 		int err = -ENODEV;
 		int i;
@@ -1078,6 +1075,9 @@ static vm_fault_t vm_fault_ttm(struct vm_fault *vmf)
 		}
 	}
 
+	if (i915_ttm_cpu_maps_iomem(bo->resource))
+		wakeref = intel_runtime_pm_get(&to_i915(obj->base.dev)->runtime_pm);
+
 	if (drm_dev_enter(dev, &idx)) {
 		ret = ttm_bo_vm_fault_reserved(vmf, vmf->vma->vm_page_prot,
 					       TTM_BO_VM_NUM_PREFAULT);
-- 
2.38.1


^ permalink raw reply related	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2022-11-08 15:24 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-11-07 16:54 [Intel-gfx] [PATCH 1/2] drm/i915/ttm: fix uaf with lmem_userfault_list handling Matthew Auld
2022-11-07 16:54 ` [Intel-gfx] [PATCH 2/2] drm/i915/ttm: add some sanity checks for lmem_userfault_list Matthew Auld
2022-11-08  7:36   ` Andrzej Hajda
2022-11-07 19:31 ` [Intel-gfx] ✓ Fi.CI.BAT: success for series starting with [1/2] drm/i915/ttm: fix uaf with lmem_userfault_list handling Patchwork
2022-11-08  0:09 ` [Intel-gfx] ✗ Fi.CI.IGT: failure " Patchwork
2022-11-08  9:40   ` Matthew Auld
2022-11-08 15:19     ` Vudum, Lakshminarayana
2022-11-08  7:33 ` [Intel-gfx] [PATCH 1/2] " Andrzej Hajda
2022-11-08 14:53 ` [Intel-gfx] ✓ Fi.CI.IGT: success for series starting with [1/2] " Patchwork

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox