Re: [PATCH 1/2] drm/shmem-helper: Check for purged buffers in fault handler

From: Steven Price <steven.price@arm.com>
To: Neil Roberts <nroberts@igalia.com>,
	Rob Herring <robh+dt@kernel.org>,
	Tomeu Vizoso <tomeu@tomeuvizoso.net>,
	Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>,
	Robin Murphy <robin.murphy@arm.com>
Cc: dri-devel@lists.freedesktop.org, stable@vger.kernel.org
Subject: Re: [PATCH 1/2] drm/shmem-helper: Check for purged buffers in fault handler
Date: Wed, 24 Feb 2021 16:39:32 +0000	[thread overview]
Message-ID: <3b720672-d21d-dde5-4d7d-c2c8cd00c4b5@arm.com> (raw)
In-Reply-To: <20210223155125.199577-2-nroberts@igalia.com>

On 23/02/2021 15:51, Neil Roberts wrote:
> When a buffer is madvised as not needed and then purged, any attempts to
> access the buffer from user-space should cause a bus fault. This patch
> adds a check for that.
> 
> Cc: stable@vger.kernel.org
> Fixes: 17acb9f35ed7 ("drm/shmem: Add madvise state and purge helpers")
> Signed-off-by: Neil Roberts <nroberts@igalia.com>

Reviewed-by: Steven Price <steven.price@arm.com>

> ---
>   drivers/gpu/drm/drm_gem_shmem_helper.c | 18 ++++++++++++++----
>   1 file changed, 14 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c
> index 9825c378dfa6..b26139b1dc35 100644
> --- a/drivers/gpu/drm/drm_gem_shmem_helper.c
> +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
> @@ -525,14 +525,24 @@ static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf)
>   	struct drm_gem_object *obj = vma->vm_private_data;
>   	struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj);
>   	loff_t num_pages = obj->size >> PAGE_SHIFT;
> +	vm_fault_t ret;
>   	struct page *page;
>   
> -	if (vmf->pgoff >= num_pages || WARN_ON_ONCE(!shmem->pages))
> -		return VM_FAULT_SIGBUS;
> +	mutex_lock(&shmem->pages_lock);
> +
> +	if (vmf->pgoff >= num_pages ||
> +	    WARN_ON_ONCE(!shmem->pages) ||
> +	    shmem->madv < 0) {
> +		ret = VM_FAULT_SIGBUS;
> +	} else {
> +		page = shmem->pages[vmf->pgoff];
>   
> -	page = shmem->pages[vmf->pgoff];
> +		ret = vmf_insert_page(vma, vmf->address, page);
> +	}
>   
> -	return vmf_insert_page(vma, vmf->address, page);
> +	mutex_unlock(&shmem->pages_lock);
> +
> +	return ret;
>   }
>   
>   static void drm_gem_shmem_vm_open(struct vm_area_struct *vma)
>