| Message ID | 20210223155125.199577-2-nroberts@igalia.com |
|---|---|
| State | Accepted |
| Commit | d611b4a0907cece060699f2fd347c492451cd2aa |
| Headers | show |
| Series | [1/2] drm/shmem-helper: Check for purged buffers in fault handler | expand |
On 23/02/2021 15:51, Neil Roberts wrote: > When a buffer is madvised as not needed and then purged, any attempts to > access the buffer from user-space should cause a bus fault. This patch > adds a check for that. > > Cc: stable@vger.kernel.org > Fixes: 17acb9f35ed7 ("drm/shmem: Add madvise state and purge helpers") > Signed-off-by: Neil Roberts <nroberts@igalia.com> Reviewed-by: Steven Price <steven.price@arm.com> > --- > drivers/gpu/drm/drm_gem_shmem_helper.c | 18 ++++++++++++++---- > 1 file changed, 14 insertions(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c > index 9825c378dfa6..b26139b1dc35 100644 > --- a/drivers/gpu/drm/drm_gem_shmem_helper.c > +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c > @@ -525,14 +525,24 @@ static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf) > struct drm_gem_object *obj = vma->vm_private_data; > struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj); > loff_t num_pages = obj->size >> PAGE_SHIFT; > + vm_fault_t ret; > struct page *page; > > - if (vmf->pgoff >= num_pages || WARN_ON_ONCE(!shmem->pages)) > - return VM_FAULT_SIGBUS; > + mutex_lock(&shmem->pages_lock); > + > + if (vmf->pgoff >= num_pages || > + WARN_ON_ONCE(!shmem->pages) || > + shmem->madv < 0) { > + ret = VM_FAULT_SIGBUS; > + } else { > + page = shmem->pages[vmf->pgoff]; > > - page = shmem->pages[vmf->pgoff]; > + ret = vmf_insert_page(vma, vmf->address, page); > + } > > - return vmf_insert_page(vma, vmf->address, page); > + mutex_unlock(&shmem->pages_lock); > + > + return ret; > } > > static void drm_gem_shmem_vm_open(struct vm_area_struct *vma) >
diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c index 9825c378dfa6..b26139b1dc35 100644 --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -525,14 +525,24 @@ static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf) struct drm_gem_object *obj = vma->vm_private_data; struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj); loff_t num_pages = obj->size >> PAGE_SHIFT; + vm_fault_t ret; struct page *page; - if (vmf->pgoff >= num_pages || WARN_ON_ONCE(!shmem->pages)) - return VM_FAULT_SIGBUS; + mutex_lock(&shmem->pages_lock); + + if (vmf->pgoff >= num_pages || + WARN_ON_ONCE(!shmem->pages) || + shmem->madv < 0) { + ret = VM_FAULT_SIGBUS; + } else { + page = shmem->pages[vmf->pgoff]; - page = shmem->pages[vmf->pgoff]; + ret = vmf_insert_page(vma, vmf->address, page); + } - return vmf_insert_page(vma, vmf->address, page); + mutex_unlock(&shmem->pages_lock); + + return ret; } static void drm_gem_shmem_vm_open(struct vm_area_struct *vma)
When a buffer is madvised as not needed and then purged, any attempts to access the buffer from user-space should cause a bus fault. This patch adds a check for that. Cc: stable@vger.kernel.org Fixes: 17acb9f35ed7 ("drm/shmem: Add madvise state and purge helpers") Signed-off-by: Neil Roberts <nroberts@igalia.com> --- drivers/gpu/drm/drm_gem_shmem_helper.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)