| Message ID | 20210921110121.3783395-1-matthew.auld@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v4,01/14] drm/ttm: stop calling tt_swapin in vm_access | expand |
Am 21.09.21 um 13:01 schrieb Matthew Auld: > In commit: > > commit 09ac4fcb3f255e9225967c75f5893325c116cdbe > Author: Felix Kuehling <Felix.Kuehling@amd.com> > Date: Thu Jul 13 17:01:16 2017 -0400 > > drm/ttm: Implement vm_operations_struct.access v2 > > we added the vm_access hook, where we also directly call tt_swapin for > some reason. If something is swapped-out then the ttm_tt must also be > unpopulated, and since access_kmap should also call tt_populate, if > needed, then swapping-in will already be handled there. Sounds like you completely misunderstand what that is good for. This is for debugger attaching to a process and peek/poke into the VMA and completely unrelated to kmap. > > If anything, calling tt_swapin directly here would likely always fail > since the tt->pages won't yet be populated, or worse since the tt->pages > array is never actually cleared in unpopulate this might lead to a nasty > uaf. That's indeed true, but we just need to unconditionally call ttm_tt_populate() here instead. Regards, Christian. > > Fixes: 09ac4fcb3f25 ("drm/ttm: Implement vm_operations_struct.access v2") > Signed-off-by: Matthew Auld <matthew.auld@intel.com> > Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> > Cc: Christian König <christian.koenig@amd.com> > --- > drivers/gpu/drm/ttm/ttm_bo_vm.c | 5 ----- > 1 file changed, 5 deletions(-) > > diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c > index f56be5bc0861..5b9b7fd01a69 100644 > --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c > +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c > @@ -519,11 +519,6 @@ int ttm_bo_vm_access(struct vm_area_struct *vma, unsigned long addr, > > switch (bo->resource->mem_type) { > case TTM_PL_SYSTEM: > - if (unlikely(bo->ttm->page_flags & TTM_PAGE_FLAG_SWAPPED)) { > - ret = ttm_tt_swapin(bo->ttm); > - if (unlikely(ret != 0)) > - return ret; > - } > fallthrough; > case TTM_PL_TT: > ret = ttm_bo_vm_access_kmap(bo, offset, buf, len, write);
HI, Christian, On Tue, 2021-09-21 at 13:28 +0200, Christian König wrote: > Am 21.09.21 um 13:01 schrieb Matthew Auld: > > In commit: > > > > commit 09ac4fcb3f255e9225967c75f5893325c116cdbe > > Author: Felix Kuehling <Felix.Kuehling@amd.com> > > Date: Thu Jul 13 17:01:16 2017 -0400 > > > > drm/ttm: Implement vm_operations_struct.access v2 > > > > we added the vm_access hook, where we also directly call tt_swapin > > for > > some reason. If something is swapped-out then the ttm_tt must also > > be > > unpopulated, and since access_kmap should also call tt_populate, if > > needed, then swapping-in will already be handled there. > > Sounds like you completely misunderstand what that is good for. > > This is for debugger attaching to a process and peek/poke into the > VMA > and completely unrelated to kmap. I think what Matthew is saying is that there is a fallthrough to TTM_PL_TT which calls ttm_bo_vm_access_kmap which calls ttm_tt_populate(). So from my pow, unless there are other concerns, this is Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> > > > > > If anything, calling tt_swapin directly here would likely always > > fail > > since the tt->pages won't yet be populated, or worse since the tt- > > >pages > > array is never actually cleared in unpopulate this might lead to a > > nasty > > uaf. > > That's indeed true, but we just need to unconditionally call > ttm_tt_populate() here instead. > > Regards, > Christian. > > > > > Fixes: 09ac4fcb3f25 ("drm/ttm: Implement > > vm_operations_struct.access v2") > > Signed-off-by: Matthew Auld <matthew.auld@intel.com> > > Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> > > Cc: Christian König <christian.koenig@amd.com> > > --- > > drivers/gpu/drm/ttm/ttm_bo_vm.c | 5 ----- > > 1 file changed, 5 deletions(-) > > > > diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c > > b/drivers/gpu/drm/ttm/ttm_bo_vm.c > > index f56be5bc0861..5b9b7fd01a69 100644 > > --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c > > +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c > > @@ -519,11 +519,6 @@ int ttm_bo_vm_access(struct vm_area_struct > > *vma, unsigned long addr, > > > > switch (bo->resource->mem_type) { > > case TTM_PL_SYSTEM: > > - if (unlikely(bo->ttm->page_flags & > > TTM_PAGE_FLAG_SWAPPED)) { > > - ret = ttm_tt_swapin(bo->ttm); > > - if (unlikely(ret != 0)) > > - return ret; > > - } > > fallthrough; > > case TTM_PL_TT: > > ret = ttm_bo_vm_access_kmap(bo, offset, buf, len, > > write); >
Am 21.09.21 um 13:37 schrieb Thomas Hellström: > HI, Christian, > On Tue, 2021-09-21 at 13:28 +0200, Christian König wrote: >> Am 21.09.21 um 13:01 schrieb Matthew Auld: >>> In commit: >>> >>> commit 09ac4fcb3f255e9225967c75f5893325c116cdbe >>> Author: Felix Kuehling <Felix.Kuehling@amd.com> >>> Date: Thu Jul 13 17:01:16 2017 -0400 >>> >>> drm/ttm: Implement vm_operations_struct.access v2 >>> >>> we added the vm_access hook, where we also directly call tt_swapin >>> for >>> some reason. If something is swapped-out then the ttm_tt must also >>> be >>> unpopulated, and since access_kmap should also call tt_populate, if >>> needed, then swapping-in will already be handled there. >> Sounds like you completely misunderstand what that is good for. >> >> This is for debugger attaching to a process and peek/poke into the >> VMA >> and completely unrelated to kmap. > I think what Matthew is saying is that there is a fallthrough to > TTM_PL_TT which calls > > ttm_bo_vm_access_kmap Ah, good point. Now that makes much more sense. > > which calls > > ttm_tt_populate(). > > So from my pow, unless there are other concerns, this is > > Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com> In that case the patch is Reviewed-by: Christian König <christian.koenig@amd.com> as well. When this is gone we can also make ttm_tt_swapin() static since that here is the only user. And BTW replacing the switch/case with a check for use_tt in the resource_manager is probably a good idea as well. Regards, Christian. > > >>> If anything, calling tt_swapin directly here would likely always >>> fail >>> since the tt->pages won't yet be populated, or worse since the tt- >>>> pages >>> array is never actually cleared in unpopulate this might lead to a >>> nasty >>> uaf. >> That's indeed true, but we just need to unconditionally call >> ttm_tt_populate() here instead. >> >> Regards, >> Christian. >> >>> Fixes: 09ac4fcb3f25 ("drm/ttm: Implement >>> vm_operations_struct.access v2") >>> Signed-off-by: Matthew Auld <matthew.auld@intel.com> >>> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> >>> Cc: Christian König <christian.koenig@amd.com> >>> --- >>> drivers/gpu/drm/ttm/ttm_bo_vm.c | 5 ----- >>> 1 file changed, 5 deletions(-) >>> >>> diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c >>> b/drivers/gpu/drm/ttm/ttm_bo_vm.c >>> index f56be5bc0861..5b9b7fd01a69 100644 >>> --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c >>> +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c >>> @@ -519,11 +519,6 @@ int ttm_bo_vm_access(struct vm_area_struct >>> *vma, unsigned long addr, >>> >>> switch (bo->resource->mem_type) { >>> case TTM_PL_SYSTEM: >>> - if (unlikely(bo->ttm->page_flags & >>> TTM_PAGE_FLAG_SWAPPED)) { >>> - ret = ttm_tt_swapin(bo->ttm); >>> - if (unlikely(ret != 0)) >>> - return ret; >>> - } >>> fallthrough; >>> case TTM_PL_TT: >>> ret = ttm_bo_vm_access_kmap(bo, offset, buf, len, >>> write); >
diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c index f56be5bc0861..5b9b7fd01a69 100644 --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c @@ -519,11 +519,6 @@ int ttm_bo_vm_access(struct vm_area_struct *vma, unsigned long addr, switch (bo->resource->mem_type) { case TTM_PL_SYSTEM: - if (unlikely(bo->ttm->page_flags & TTM_PAGE_FLAG_SWAPPED)) { - ret = ttm_tt_swapin(bo->ttm); - if (unlikely(ret != 0)) - return ret; - } fallthrough; case TTM_PL_TT: ret = ttm_bo_vm_access_kmap(bo, offset, buf, len, write);
In commit: commit 09ac4fcb3f255e9225967c75f5893325c116cdbe Author: Felix Kuehling <Felix.Kuehling@amd.com> Date: Thu Jul 13 17:01:16 2017 -0400 drm/ttm: Implement vm_operations_struct.access v2 we added the vm_access hook, where we also directly call tt_swapin for some reason. If something is swapped-out then the ttm_tt must also be unpopulated, and since access_kmap should also call tt_populate, if needed, then swapping-in will already be handled there. If anything, calling tt_swapin directly here would likely always fail since the tt->pages won't yet be populated, or worse since the tt->pages array is never actually cleared in unpopulate this might lead to a nasty uaf. Fixes: 09ac4fcb3f25 ("drm/ttm: Implement vm_operations_struct.access v2") Signed-off-by: Matthew Auld <matthew.auld@intel.com> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com> Cc: Christian König <christian.koenig@amd.com> --- drivers/gpu/drm/ttm/ttm_bo_vm.c | 5 ----- 1 file changed, 5 deletions(-)