From: Chris Wilson <chris@chris-wilson.co.uk> To: intel-gfx@lists.freedesktop.org Cc: "Chris Wilson" <chris@chris-wilson.co.uk>, "Tvrtko Ursulin" <tvrtko.ursulin@intel.com>, "Michał Winiarski" <michal.winiarski@intel.com>, stable@vger.kernel.org Subject: [PATCH v2 2/3] drm/i915/userptr: Hold mmref whilst calling get-user-pages Date: Tue, 5 Apr 2016 15:00:00 +0100 [thread overview] Message-ID: <1459864801-28606-2-git-send-email-chris@chris-wilson.co.uk> (raw) In-Reply-To: <1459864801-28606-1-git-send-email-chris@chris-wilson.co.uk> Holding a reference to the containing task_struct is not sufficient to prevent the mm_struct from being reaped under memory pressure. If this happens whilst we are calling get_user_pages(), explosions erupt - sometimes an immediate GPF, sometimes page flag corruption. To prevent the target mm from being reaped as we are reading from it, acquire a reference before we begin. Testcase: igt/gem_shrink/*userptr Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: Michał Winiarski <michal.winiarski@intel.com> Cc: stable@vger.kernel.org Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> --- drivers/gpu/drm/i915/i915_gem_userptr.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c index 92b39186b05a..960bb37f458f 100644 --- a/drivers/gpu/drm/i915/i915_gem_userptr.c +++ b/drivers/gpu/drm/i915/i915_gem_userptr.c @@ -547,19 +547,24 @@ __i915_gem_userptr_get_pages_worker(struct work_struct *_work) if (pvec != NULL) { struct mm_struct *mm = obj->userptr.mm->mm; - down_read(&mm->mmap_sem); - while (pinned < npages) { - ret = get_user_pages_remote(work->task, mm, - obj->userptr.ptr + pinned * PAGE_SIZE, - npages - pinned, - !obj->userptr.read_only, 0, - pvec + pinned, NULL); - if (ret < 0) - break; - - pinned += ret; + ret = -EFAULT; + if (atomic_inc_not_zero(&mm->mm_users)) { + down_read(&mm->mmap_sem); + while (pinned < npages) { + ret = get_user_pages_remote + (work->task, mm, + obj->userptr.ptr + pinned * PAGE_SIZE, + npages - pinned, + !obj->userptr.read_only, 0, + pvec + pinned, NULL); + if (ret < 0) + break; + + pinned += ret; + } + up_read(&mm->mmap_sem); + mmput(mm); } - up_read(&mm->mmap_sem); } mutex_lock(&dev->struct_mutex); -- 2.8.0.rc3
WARNING: multiple messages have this Message-ID (diff)
From: Chris Wilson <chris@chris-wilson.co.uk> To: intel-gfx@lists.freedesktop.org Cc: stable@vger.kernel.org Subject: [PATCH v2 2/3] drm/i915/userptr: Hold mmref whilst calling get-user-pages Date: Tue, 5 Apr 2016 15:00:00 +0100 [thread overview] Message-ID: <1459864801-28606-2-git-send-email-chris@chris-wilson.co.uk> (raw) In-Reply-To: <1459864801-28606-1-git-send-email-chris@chris-wilson.co.uk> Holding a reference to the containing task_struct is not sufficient to prevent the mm_struct from being reaped under memory pressure. If this happens whilst we are calling get_user_pages(), explosions erupt - sometimes an immediate GPF, sometimes page flag corruption. To prevent the target mm from being reaped as we are reading from it, acquire a reference before we begin. Testcase: igt/gem_shrink/*userptr Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com> Cc: Michał Winiarski <michal.winiarski@intel.com> Cc: stable@vger.kernel.org Reviewed-by: Michał Winiarski <michal.winiarski@intel.com> --- drivers/gpu/drm/i915/i915_gem_userptr.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c index 92b39186b05a..960bb37f458f 100644 --- a/drivers/gpu/drm/i915/i915_gem_userptr.c +++ b/drivers/gpu/drm/i915/i915_gem_userptr.c @@ -547,19 +547,24 @@ __i915_gem_userptr_get_pages_worker(struct work_struct *_work) if (pvec != NULL) { struct mm_struct *mm = obj->userptr.mm->mm; - down_read(&mm->mmap_sem); - while (pinned < npages) { - ret = get_user_pages_remote(work->task, mm, - obj->userptr.ptr + pinned * PAGE_SIZE, - npages - pinned, - !obj->userptr.read_only, 0, - pvec + pinned, NULL); - if (ret < 0) - break; - - pinned += ret; + ret = -EFAULT; + if (atomic_inc_not_zero(&mm->mm_users)) { + down_read(&mm->mmap_sem); + while (pinned < npages) { + ret = get_user_pages_remote + (work->task, mm, + obj->userptr.ptr + pinned * PAGE_SIZE, + npages - pinned, + !obj->userptr.read_only, 0, + pvec + pinned, NULL); + if (ret < 0) + break; + + pinned += ret; + } + up_read(&mm->mmap_sem); + mmput(mm); } - up_read(&mm->mmap_sem); } mutex_lock(&dev->struct_mutex); -- 2.8.0.rc3 _______________________________________________ Intel-gfx mailing list Intel-gfx@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/intel-gfx
next prev parent reply other threads:[~2016-04-05 14:00 UTC|newest] Thread overview: 16+ messages / expand[flat|nested] mbox.gz Atom feed top 2016-04-03 17:14 [PATCH 1/3] drm/i915/userptr: Flush cancellations before mmu-notifier invalidate returns Chris Wilson 2016-04-03 17:14 ` [PATCH 2/3] drm/i915/userptr: Hold mmref whilst calling get-user-pages Chris Wilson 2016-04-03 21:11 ` Michał Winiarski 2016-04-03 21:11 ` Michał Winiarski 2016-04-05 12:22 ` [Intel-gfx] " Tvrtko Ursulin 2016-04-03 17:14 ` [PATCH 3/3] drm/i915: Store i915 pointer for userptr i915_mm_struct Chris Wilson 2016-04-03 21:12 ` Michał Winiarski 2016-04-04 6:27 ` ✓ Fi.CI.BAT: success for series starting with [1/3] drm/i915/userptr: Flush cancellations before mmu-notifier invalidate returns Patchwork 2016-04-05 12:05 ` [PATCH 1/3] " Tvrtko Ursulin 2016-04-05 12:34 ` Chris Wilson 2016-04-05 13:59 ` [PATCH v2 " Chris Wilson 2016-04-05 14:00 ` Chris Wilson [this message] 2016-04-05 14:00 ` [PATCH v2 2/3] drm/i915/userptr: Hold mmref whilst calling get-user-pages Chris Wilson 2016-04-05 14:00 ` [PATCH v2 3/3] drm/i915/userptr: Store i915 backpointer for i915_mm_struct Chris Wilson 2016-04-05 15:27 ` [PATCH v2 1/3] drm/i915/userptr: Flush cancellations before mmu-notifier invalidate returns Tvrtko Ursulin 2016-04-05 16:57 ` ✗ Fi.CI.BAT: failure for series starting with [v2,3/3] drm/i915/userptr: Store i915 backpointer for i915_mm_struct (rev4) Patchwork
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1459864801-28606-2-git-send-email-chris@chris-wilson.co.uk \ --to=chris@chris-wilson.co.uk \ --cc=intel-gfx@lists.freedesktop.org \ --cc=michal.winiarski@intel.com \ --cc=stable@vger.kernel.org \ --cc=tvrtko.ursulin@intel.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.