From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f170.google.com (mail-pf1-f170.google.com [209.85.210.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 858E72652B0 for ; Sat, 2 May 2026 03:18:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.170 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777691882; cv=none; b=dIccEr9ur6ggah5nZuZ7WVaKtawdJFe0+1rsEMChHa7pqgmbf1LsImKd2jaKDM8CNj/eFxgrF72c4Dx6I2JfWaqrOvtJlbJCOd838bb/EBXDRm8T+Rxi42qqT3RCjSpz+I2qgY/uDqfdx4RE6AlaahjQiszcCUFZmt9+AzA2uD8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777691882; c=relaxed/simple; bh=psZQ8A+tcTHC7upX2JVBkwi2WV4/iyZpD0PUxxxqJy8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=CIYjPYyoafEpfw//eIPNnLZFosOEIuZxjg2o5ohY49b2AJjeT7vce4wtfWCAu6LSvxTErO1wJTdF7mM+JS3a9cG0A9M3yNigWmf2uc+O72nMKgsNktchT6d1vpU7GQYz3/dvMGVdpHCiC/Euw3WrqHWEAB1v/2DqsaBpGrTUjAY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=l4Sm7Pvf; arc=none smtp.client-ip=209.85.210.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="l4Sm7Pvf" Received: by mail-pf1-f170.google.com with SMTP id d2e1a72fcca58-82748257f5fso2605741b3a.1 for ; Fri, 01 May 2026 20:18:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1777691881; x=1778296681; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=3e6vluYW3fo6JWb+C8AXsi9rzlLtgDWHGIF2Au/3q08=; b=l4Sm7Pvf2UKrW6O83+RJSOdp3y5IMghpfVyRduNBYJkedXS48rT553TwyWZSrdZTYI O0HpVEaTpbf4zu39li4Miu4F6sGTVK/Bx59Q/DlHFB7yPowxvKWaIF+T3WzjX86txS6M 9JQ3HKPtZd5wZyud/XvvvrajRyQsv2S3mkzG/cdtsncoB3Xq3f8KsXCTZCJBuCwj43iy Q7Huhlc/3bt7IoSIeZI1zKUcueUHVsvU+2Xk2PPvbSqKw6/D2Nm9zNh0xJhY0z4dOQW3 r634fynX+4BVBAnvbuJEuy+4H//MU7r9l+T/xcxayPQULMZq8qgINikWqZYknaZwILDG bmYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777691881; x=1778296681; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=3e6vluYW3fo6JWb+C8AXsi9rzlLtgDWHGIF2Au/3q08=; b=bMQURft74Q2DTrleWs1qdRMihZYhKfiHqP7iB0lOkEMHtmI6DL7+5nlgz18K87E66U +RyWzoVarMMGfjrxfRdytPOKwcPOUqrDtArFOaKOSFpm5IXc103Shxt2DD05zfC+bnUU yTUkp4mLUjKNX/1/ahaWPfmAwezesgkXrCah5lUhiujDblA4qzlr/JldsmaHrFxDZDhz ZnAJ3i+1UhNU0F9qSmMDZ+00veVqgMyaFpEvVdGM/Ds4rNhiwnZaiyQbA5tAqefVamvq MznVqZE0w96ECLUq/lm9JUXMH76CaMwmiew/+7ORhR9O7Z5ZKIvcmarDEN+6DLlnJTra 5BoA== X-Forwarded-Encrypted: i=1; AFNElJ8DnRZxE3JWPkQr49RN52k88HM8+3Lm2MwwToqPRyvyPWft1J2Tca/oo1jbDopIwJEGAXgglvVrMy5YElA=@vger.kernel.org X-Gm-Message-State: AOJu0Ywjpd+g7omhY8yA+T+0ND4Z8JMhaiYpt2NQ95TjQQj70blkgT91 IoAJwvbC9OZusGWMI53iDUoq+IEei1Kq3GDZq19/vz2aUKEmP2hhKfsM X-Gm-Gg: AeBDieuG6Sj6ItdJDH7gtGY3c1K5XmGoIpFk1gH7LmIVR57eKXrRoiLVTmvyjkTfjNv Om4LFVmLpJ8le2t6juOdfQLAsfLuzGUXfbzhYKMM7oBQy+JqjQXwuGSUGIClDf3H18F+0l65pJZ 3uWA//F3pxA9LOeDtwX+OUdJfwqNHO7iXH8uQ74ZWOyDKjZnw8gszTV24ZTRsAB8LiFApi/8n8+ wfIIIgFQJ4htC3H8SfkHXK9Eq+1Ic3YDIOPkD4eFzErkoDfpqw0TuTO0GKMl1ivPRpo8HQY+JLP p5FEq8tK+astlgBZ8ZmosSNBA7f6B6LYenka0UB7CfxI5HQY10mtXjPJNB91J2A2L5DJZVAt25s bH8HCa5l8WkKXTz38J28ro/IUn4z6xbiBi9ehHqwvKaptWXIUPmUp2eaOoZvS27NB40LlvJRL27 fm8WeEyuG+US15f+xgnQUb/UgWNroov/kTR1WQxfs= X-Received: by 2002:a05:6a20:734e:b0:3a3:1f78:2025 with SMTP id adf61e73a8af0-3a3d214bc9fmr8972254637.27.1777691880874; Fri, 01 May 2026 20:18:00 -0700 (PDT) Received: from vini ([2401:4900:8fcb:edbd:7155:edb6:dac:107e]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c7ffbbaac5bsm3263849a12.6.2026.05.01.20.17.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 01 May 2026 20:18:00 -0700 (PDT) From: Vineet Agarwal To: mamin506@gmail.com, lizhi.hou@amd.com, ogabbay@kernel.org Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Vineet Agarwal Subject: [PATCH] drm/amdxdna: fix pinned_vm accounting and rlimit rollback Date: Sat, 2 May 2026 08:47:46 +0530 Message-ID: <20260502031746.621606-1-agarwal.vineet2006@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit amdxdna_get_ubuf() incorrectly accounted mm->pinned_vm using the requested number of pages instead of the actual number of pages successfully pinned by pin_user_pages_fast(). Since pin_user_pages_fast() can return partial success, this led to incorrect mm pinned page tracking and potential imbalance between pinned and unpinned memory state. Fix this by: - tracking the actual number of successfully pinned pages (pinned_total) - updating mm->pinned_vm only after successful pinning completes - adding proper rollback on rlimit failure path to maintain symmetry This ensures mm pinned_vm always reflects actual pinned memory usage and keeps accounting consistent with other kernel subsystems such as RDMA, vdpa, and iommufd. Signed-off-by: Vineet Agarwal --- drivers/accel/amdxdna/amdxdna_ubuf.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/drivers/accel/amdxdna/amdxdna_ubuf.c b/drivers/accel/amdxdna/amdxdna_ubuf.c index fb999aa25318..ad609846ea30 100644 --- a/drivers/accel/amdxdna/amdxdna_ubuf.c +++ b/drivers/accel/amdxdna/amdxdna_ubuf.c @@ -132,7 +132,7 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev, unsigned long lock_limit, new_pinned; struct amdxdna_drm_va_entry *va_ent; struct amdxdna_ubuf_priv *ubuf; - u32 npages, start = 0; + u32 npages, start = 0, pinned_total = 0; struct dma_buf *dbuf; int i, ret; DEFINE_DMA_BUF_EXPORT_INFO(exp_info); @@ -176,13 +176,6 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev, ubuf->nr_pages = exp_info.size >> PAGE_SHIFT; lock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; - new_pinned = atomic64_add_return(ubuf->nr_pages, &ubuf->mm->pinned_vm); - if (new_pinned > lock_limit && !capable(CAP_IPC_LOCK)) { - XDNA_DBG(xdna, "New pin %ld, limit %ld, cap %d", - new_pinned, lock_limit, capable(CAP_IPC_LOCK)); - ret = -ENOMEM; - goto sub_pin_cnt; - } ubuf->pages = kvmalloc_objs(*ubuf->pages, ubuf->nr_pages); if (!ubuf->pages) { @@ -203,6 +196,16 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev, } start += ret; + pinned_total += ret; + } + + new_pinned = atomic64_add_return(pinned_total, + &ubuf->mm->pinned_vm); + + if (new_pinned > lock_limit && !capable(CAP_IPC_LOCK)) { + atomic64_sub(pinned_total, &ubuf->mm->pinned_vm); + ret = -ENOMEM; + goto destroy_pages; } exp_info.ops = &amdxdna_ubuf_dmabuf_ops; -- 2.54.0