From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 486DC2F6910 for ; Sun, 3 May 2026 04:43:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777783416; cv=none; b=k5ZFT/bGShFrD7T3djXqiAEAC6ZJ/5U9R0/m9lI8vhIn2PwIs4Km0bK1s4F2KLNG25ATYf3sVDj1bKpfTdbH3I/5exAx0JaQ5YWxodqIoWn+wO0Pz1StX1U7WKRHQ5+dymdYNLtp3T6qEocKwoqHXA2dTpUIFRZM7CdELJ/dKjs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777783416; c=relaxed/simple; bh=pqOoZjA8doybAQKh6W0MHKlUXySrdkA3t/fl4LG79NQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=UlQaf2UdVRIHIinLpfqN45ZZkcb3Vg8Syhrjhba/kN4eQ5cC/Tdd1muHzHq160BpTgodNztP+i0k+v05qFSK+V+0XtPpbIUI3ZdAZg5Co+99xjWSJuPDxAwG+nzSK3LEglmmSmSNvvfKdskH4cSAa7qI0yYnsN88kmaz20kRMSk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=bV7SMB0s; arc=none smtp.client-ip=209.85.216.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="bV7SMB0s" Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-365212191f6so357210a91.3 for ; Sat, 02 May 2026 21:43:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1777783415; x=1778388215; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=ZrHQKdnz194dJR6cw9s2lksjM+dXghqleIL2qZmETl8=; b=bV7SMB0s1JWxAwBZf5Do5Iw+vuVifOtuZ5s4W4rEWL9Un7Q5DwUB89oalycwCQhxeG sfeFhed2LHem71xGaGTjHKyw1MV5w7Ck60XjulZo66/REo1H0saB2Azzqf8EChBUQtx+ vYecjOmIkiHbJadYtV3fSNlHaP5f6YTRm8P6KCpA9H3zPjvmVOjlcZwa7u3Bl5MrOh7g 7Im05cTon/jfUeunk0VKh8w9aichzNrfxDBNIZbA4/wGQR7G2AF4Akpsz0meBWBxQYrs yw+HRBPfteXrMFN5lsgD3VAK4KnkDD0ctTRayTXrBAoB8on7TRHLe/kEo9rZrI9WPySC WCTQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777783415; x=1778388215; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=ZrHQKdnz194dJR6cw9s2lksjM+dXghqleIL2qZmETl8=; b=rxqvK8MsUfgx7yYotxsQI4A41OAh5SyEQbzqkPG+b0HrUv4PdT+aETkTwyU37hBH/+ pS6Pvwpy01o3giy7WXXWErSHxXMRSKW5FYUYkJ6owTrV07pCeiSHxs1ZEFub1b9vwzJE i7lkqo0jTMqlmeGeF0DJqdbcs4pcFalRGcxUUySwI2e0FX6LVrsJRyMA59uHYojPJ1I9 FhCSP94OCZKRxU9NNd0cVTkD2QUy/DgUMJmNqV+OZS7H1cDrnn95XgEnYsknlBp/i9go wex5iK/rOcG9oaY1J+NLSowxo74+Gkzy7V6xVlrlGf+m5IRMBL45dgvjleFfFjPzM9j1 kfxA== X-Forwarded-Encrypted: i=1; AFNElJ+1jK49KQzXeIn/roXNZ1Qo0THAwZ8OyRanHtN58SVYcFVksnzKBZHoaF37Aodl3AV84UeV0Oc+crYZj7U=@vger.kernel.org X-Gm-Message-State: AOJu0Yy5mfnLzPpO5ouhRNMBR/PB7hp7QJofjfJLJhQzSHAxq9Wef9VT nPxrPJN647zjR00HtDdqyS5BAv88BXhVH8wp6KQTROdMk5jQ2IAM1sXC X-Gm-Gg: AeBDiesN2u15N2xSdsxPg1Qn2iiDDpkGgiKJLEYhHeghQZtv6INgixiU8LqGhvqAcED dyk4xOWRzy0pbvNXb+t6UKtnm6XlA7Z4T7Hutb0QDjHmlH7ecnQTcvITpIdZmon4ZhNcfYks/PV odVDKk1jxn4CY8D/KOGd0kp3tGN9D9NZx2yDRlHb3bKHMXHMeoc1Nt/Hi/mNvrY194p4uHn2ZaP F/Sy/Sg0uOZ8hE8MXbEdPtTSBuESfRd8svcfpfpmjRNN/xlH+JSjBm/M9WMw9qhBjYN/06SzSNn TnchLUbxIx2l2E4R8FAJf9wW2EfA1Nbfb/Bmk3WUX31ukntNd2Qkkd6BPhGjY2wU5BJDeVAfcJ5 flUNxSXlnMd1ZGLfZYG10hGh4+wo7XFJNCyopCP2hu+BMuFsIh8ZoYivNbo0W1SYTgzcnMW/COL Qqh1MKJH+b2ofuZ89E4WYoZD5cq5qsn4tBj5WZ71M= X-Received: by 2002:a17:903:2f4f:b0:2ae:504c:ae8a with SMTP id d9443c01a7336-2b9f25886e9mr47829725ad.16.1777783414557; Sat, 02 May 2026 21:43:34 -0700 (PDT) Received: from vini ([2401:4900:8fcb:edbd:7155:edb6:dac:107e]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2b9caaaf0e5sm64532745ad.18.2026.05.02.21.43.32 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 02 May 2026 21:43:34 -0700 (PDT) From: Vineet Agarwal To: mamin506@gmail.com, lizhi.hou@amd.com, ogabbay@kernel.org Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Vineet Agarwal Subject: [PATCH] drm/amdxdna: fix pinned_vm accounting and error handling in user buffer pinning Date: Sun, 3 May 2026 10:10:30 +0530 Message-ID: <20260503044321.633137-1-agarwal.vineet2006@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit amdxdna_get_ubuf() incorrectly accounted mm->pinned_vm using the requested number of pages before pin_user_pages_fast() completed. Additionally, the RLIMIT_MEMLOCK check was performed after pinning, and error handling for partial pinning could lead to inconsistent cleanup. Fix this by: - checking RLIMIT_MEMLOCK before attempting to pin pages - ensuring partially pinned pages are properly tracked and released - accounting mm->pinned_vm only after successful pinning - removing incorrect error-path accounting and double-subtraction The RLIMIT_MEMLOCK check is performed conservatively against the requested number of pages to prevent excessive pinning attempts. This ensures mm->pinned_vm remains consistent and aligns the driver with expected GUP and memory accounting semantics. Signed-off-by: Vineet Agarwal Changes in v2: - Move RLIMIT_MEMLOCK check before pinning - Fix partial pin handling and cleanup paths - Remove incorrect pinned_vm accounting in error paths - Ensure symmetric accounting between pin and release - Drop unused pinned_total variable --- drivers/accel/amdxdna/amdxdna_ubuf.c | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/drivers/accel/amdxdna/amdxdna_ubuf.c b/drivers/accel/amdxdna/amdxdna_ubuf.c index fb999aa25318..571708f78cfe 100644 --- a/drivers/accel/amdxdna/amdxdna_ubuf.c +++ b/drivers/accel/amdxdna/amdxdna_ubuf.c @@ -129,7 +129,7 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev, u32 num_entries, void __user *va_entries) { struct amdxdna_dev *xdna = to_xdna_dev(dev); - unsigned long lock_limit, new_pinned; + unsigned long lock_limit; struct amdxdna_drm_va_entry *va_ent; struct amdxdna_ubuf_priv *ubuf; u32 npages, start = 0; @@ -176,18 +176,17 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev, ubuf->nr_pages = exp_info.size >> PAGE_SHIFT; lock_limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; - new_pinned = atomic64_add_return(ubuf->nr_pages, &ubuf->mm->pinned_vm); - if (new_pinned > lock_limit && !capable(CAP_IPC_LOCK)) { - XDNA_DBG(xdna, "New pin %ld, limit %ld, cap %d", - new_pinned, lock_limit, capable(CAP_IPC_LOCK)); + + if (ubuf->nr_pages + atomic64_read(&ubuf->mm->pinned_vm) > lock_limit && + !capable(CAP_IPC_LOCK)) { ret = -ENOMEM; - goto sub_pin_cnt; + goto free_ent; } ubuf->pages = kvmalloc_objs(*ubuf->pages, ubuf->nr_pages); if (!ubuf->pages) { ret = -ENOMEM; - goto sub_pin_cnt; + goto free_ent; } for (i = 0; i < num_entries; i++) { @@ -196,15 +195,17 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev, ret = pin_user_pages_fast(va_ent[i].vaddr, npages, FOLL_WRITE | FOLL_LONGTERM, &ubuf->pages[start]); - if (ret < 0 || ret != npages) { + if (ret < 0) + goto destroy_pages; + start += ret; + if (ret != npages) { ret = -ENOMEM; - XDNA_ERR(xdna, "Failed to pin pages ret %d", ret); goto destroy_pages; } - - start += ret; } + atomic64_add(ubuf->nr_pages, &ubuf->mm->pinned_vm); + exp_info.ops = &amdxdna_ubuf_dmabuf_ops; exp_info.priv = ubuf; exp_info.flags = O_RDWR | O_CLOEXEC; @@ -222,8 +223,6 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev, if (start) unpin_user_pages(ubuf->pages, start); kvfree(ubuf->pages); -sub_pin_cnt: - atomic64_sub(ubuf->nr_pages, &ubuf->mm->pinned_vm); free_ent: kvfree(va_ent); free_ubuf: -- 2.54.0