From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EA18A26AC6 for ; Tue, 13 Aug 2024 17:09:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.19 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723568989; cv=none; b=MUAJ+nTiA5jeD4Xo4AA2hMGuIdQ50Kr/MAifaU8gKwTrbmUZjRIueHp1PfDG6PdIU39REybTAcEBuar4Yi+0OfufECusLWBl7thBeDXuYgP89WChLt+rNI01pB7z+3L4S2+FtQGsMAPui/IrqLwhENPCxv00oOu22dXSn8fxE5g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1723568989; c=relaxed/simple; bh=A8aorxU2ldzeh6vZgDB/h5NIi8W+07cm8HALCjPBgaA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eBj/rf/keFyvA6J3WKNK/RCw2TAnJotvlndbiNbFdWAdUPKGav60Wrq5Wfq/JZwMcw/UwULZvYLtizZOmHrAK+KjdCk+ZeBom4BtlL+spKS9jy628JyWIDtrjEFFkNT7kkUt/iIZ3Njg/DV/stafFhHIdfD3DA7AJyUo/9LPrHE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=GgOAAjBk; arc=none smtp.client-ip=192.198.163.19 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="GgOAAjBk" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1723568988; x=1755104988; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=A8aorxU2ldzeh6vZgDB/h5NIi8W+07cm8HALCjPBgaA=; b=GgOAAjBkuTOggU6XHfisGBJ7PNFm1B+qEFq6cyYQymb40Sdvw8S2kNbs mfWSbE8C0IRtQtlz8vk2ap7QQa4XeBVEh0pGibatkcVvm4XxStxggBoGZ Z3VU5W94jQY/I6cSf2C69pwu/XyMHK9DtevwFHlreuk/G/2IXDIHKK4df yyUiuTSXl7OVmPFK3K8nqZUq0y3jWEJdRwjL+dZ1G9FzeHdTJUlTrKfL/ WQOtKDb0HYSM5OHqXHQy7a6ZDNX1xu2/5cvzzvZI6n1S8bRUgSfN9apzD CZ+y6ruhSVtN/LxTLf+QBpRpgX4jX+/OYmws/e4BXeYcvj5whMWNDjAWQ g==; X-CSE-ConnectionGUID: zYrokfuFSiaG1DknQCiq+Q== X-CSE-MsgGUID: 8EObCh4BQ/atfaqRWOKRdw== X-IronPort-AV: E=McAfee;i="6700,10204,11163"; a="21395772" X-IronPort-AV: E=Sophos;i="6.09,286,1716274800"; d="scan'208";a="21395772" Received: from orviesa008.jf.intel.com ([10.64.159.148]) by fmvoesa113.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 13 Aug 2024 10:09:47 -0700 X-CSE-ConnectionGUID: XZHhy80jQFW8EoF07Lk2/w== X-CSE-MsgGUID: Oj3ZPZmrTLGgdTsQhE6uiQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.09,286,1716274800"; d="scan'208";a="59499289" Received: from mwiniars-desk2.ger.corp.intel.com (HELO intel.com) ([10.245.246.4]) by orviesa008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 13 Aug 2024 10:09:45 -0700 From: Andi Shyti To: stable@vger.kernel.org Cc: Andi Shyti , Jann Horn , Chris Wilson , Joonas Lahtinen , Matthew Auld , Rodrigo Vivi , Jonathan Cavitt Subject: [PATCH 4.19.y v2] drm/i915/gem: Fix Virtual Memory mapping boundaries calculation Date: Tue, 13 Aug 2024 19:09:30 +0200 Message-ID: <20240813170930.75663-1-andi.shyti@linux.intel.com> X-Mailer: git-send-email 2.45.2 In-Reply-To: <2024081222-process-suspect-d983@gregkh> References: <2024081222-process-suspect-d983@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Commit 8bdd9ef7e9b1b2a73e394712b72b22055e0e26c3 upstream. Calculating the size of the mapped area as the lesser value between the requested size and the actual size does not consider the partial mapping offset. This can cause page fault access. Fix the calculation of the starting and ending addresses, the total size is now deduced from the difference between the end and start addresses. Additionally, the calculations have been rewritten in a clearer and more understandable form. Fixes: c58305af1835 ("drm/i915: Use remap_io_mapping() to prefault all PTE in a single pass") Reported-by: Jann Horn Co-developed-by: Chris Wilson Signed-off-by: Chris Wilson Signed-off-by: Andi Shyti Cc: Joonas Lahtinen Cc: Matthew Auld Cc: Rodrigo Vivi Cc: # v4.9+ Reviewed-by: Jann Horn Reviewed-by: Jonathan Cavitt [Joonas: Add Requires: tag] Requires: 60a2066c5005 ("drm/i915/gem: Adjust vma offset for framebuffer mmap offset") Signed-off-by: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20240802083850.103694-3-andi.shyti@linux.intel.com (cherry picked from commit 97b6784753da06d9d40232328efc5c5367e53417) Signed-off-by: Joonas Lahtinen --- Hi, sorry for sending this v2 after I submitted a patch with a compilation error. It slipped off a variable (obj_offset) that was removed for kernel 4.19. Thanks, Andi drivers/gpu/drm/i915/i915_gem.c | 47 +++++++++++++++++++++++++++++---- 1 file changed, 42 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index 5b0d6d8b3ab8..478d989a2369 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -2009,6 +2009,39 @@ compute_partial_view(struct drm_i915_gem_object *obj, return view; } +static void set_address_limits(struct vm_area_struct *area, + struct i915_vma *vma, + unsigned long *start_vaddr, + unsigned long *end_vaddr) +{ + unsigned long vm_start, vm_end, vma_size; /* user's memory parameters */ + long start, end; /* memory boundaries */ + + /* + * Let's move into the ">> PAGE_SHIFT" + * domain to be sure not to lose bits + */ + vm_start = area->vm_start >> PAGE_SHIFT; + vm_end = area->vm_end >> PAGE_SHIFT; + vma_size = vma->size >> PAGE_SHIFT; + + /* + * Calculate the memory boundaries by considering the offset + * provided by the user during memory mapping and the offset + * provided for the partial mapping. + */ + start = vm_start; + start += vma->ggtt_view.partial.offset; + end = start + vma_size; + + start = max_t(long, start, vm_start); + end = min_t(long, end, vm_end); + + /* Let's move back into the "<< PAGE_SHIFT" domain */ + *start_vaddr = (unsigned long)start << PAGE_SHIFT; + *end_vaddr = (unsigned long)end << PAGE_SHIFT; +} + /** * i915_gem_fault - fault a page into the GTT * @vmf: fault info @@ -2036,8 +2069,10 @@ vm_fault_t i915_gem_fault(struct vm_fault *vmf) struct drm_i915_private *dev_priv = to_i915(dev); struct i915_ggtt *ggtt = &dev_priv->ggtt; bool write = !!(vmf->flags & FAULT_FLAG_WRITE); + unsigned long start, end; /* memory boundaries */ struct i915_vma *vma; pgoff_t page_offset; + unsigned long pfn; int ret; /* Sanity check that we allow writing into this object */ @@ -2119,12 +2154,14 @@ vm_fault_t i915_gem_fault(struct vm_fault *vmf) if (ret) goto err_unpin; + set_address_limits(area, vma, &start, &end); + + pfn = (ggtt->gmadr.start + i915_ggtt_offset(vma)) >> PAGE_SHIFT; + pfn += (start - area->vm_start) >> PAGE_SHIFT; + pfn -= vma->ggtt_view.partial.offset; + /* Finally, remap it using the new GTT offset */ - ret = remap_io_mapping(area, - area->vm_start + (vma->ggtt_view.partial.offset << PAGE_SHIFT), - (ggtt->gmadr.start + vma->node.start) >> PAGE_SHIFT, - min_t(u64, vma->size, area->vm_end - area->vm_start), - &ggtt->iomap); + ret = remap_io_mapping(area, start, pfn, end - start, &ggtt->iomap); if (ret) goto err_fence; -- 2.45.2