| Message ID | 20221107165414.56970-2-matthew.auld@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [1/2] drm/i915/ttm: fix uaf with lmem_userfault_list handling | expand |
On 07.11.2022 17:54, Matthew Auld wrote: > Rather than getting some hard to debug uaf, add some warns to hopefully > catch issues with userfault_count being non-zero when destroying the > object. Also if we somehow add an object to lmem_userfault_list that > somehow doesn't map lmem. > > References: https://gitlab.freedesktop.org/drm/intel/-/issues/7469 > Signed-off-by: Matthew Auld <matthew.auld@intel.com> > Cc: Anshuman Gupta <anshuman.gupta@intel.com> > Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> > Cc: Andrzej Hajda <andrzej.hajda@intel.com> > Cc: Nirmoy Das <nirmoy.das@intel.com> Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com> Regards Andrzej > --- > drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c > index 9421dc4dc98f..2c8b2d5ae903 100644 > --- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c > +++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c > @@ -1098,6 +1098,8 @@ static vm_fault_t vm_fault_ttm(struct vm_fault *vmf) > spin_lock(&to_i915(obj->base.dev)->runtime_pm.lmem_userfault_lock); > list_add(&obj->userfault_link, &to_i915(obj->base.dev)->runtime_pm.lmem_userfault_list); > spin_unlock(&to_i915(obj->base.dev)->runtime_pm.lmem_userfault_lock); > + > + GEM_WARN_ON(!i915_ttm_cpu_maps_iomem(bo->resource)); > } > > if (wakeref & CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND) > @@ -1180,6 +1182,8 @@ static void i915_ttm_unmap_virtual(struct drm_i915_gem_object *obj) > } > } > > + GEM_WARN_ON(obj->userfault_count); > + > ttm_bo_unmap_virtual(i915_gem_to_ttm(obj)); > > if (wakeref)
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c index 9421dc4dc98f..2c8b2d5ae903 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c @@ -1098,6 +1098,8 @@ static vm_fault_t vm_fault_ttm(struct vm_fault *vmf) spin_lock(&to_i915(obj->base.dev)->runtime_pm.lmem_userfault_lock); list_add(&obj->userfault_link, &to_i915(obj->base.dev)->runtime_pm.lmem_userfault_list); spin_unlock(&to_i915(obj->base.dev)->runtime_pm.lmem_userfault_lock); + + GEM_WARN_ON(!i915_ttm_cpu_maps_iomem(bo->resource)); } if (wakeref & CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND) @@ -1180,6 +1182,8 @@ static void i915_ttm_unmap_virtual(struct drm_i915_gem_object *obj) } } + GEM_WARN_ON(obj->userfault_count); + ttm_bo_unmap_virtual(i915_gem_to_ttm(obj)); if (wakeref)
Rather than getting some hard to debug uaf, add some warns to hopefully catch issues with userfault_count being non-zero when destroying the object. Also if we somehow add an object to lmem_userfault_list that somehow doesn't map lmem. References: https://gitlab.freedesktop.org/drm/intel/-/issues/7469 Signed-off-by: Matthew Auld <matthew.auld@intel.com> Cc: Anshuman Gupta <anshuman.gupta@intel.com> Cc: Rodrigo Vivi <rodrigo.vivi@intel.com> Cc: Andrzej Hajda <andrzej.hajda@intel.com> Cc: Nirmoy Das <nirmoy.das@intel.com> --- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 4 ++++ 1 file changed, 4 insertions(+)