From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 45EA4C282C2 for ; Thu, 7 Feb 2019 13:39:04 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 12A202147C for ; Thu, 7 Feb 2019 13:39:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726786AbfBGNjD convert rfc822-to-8bit (ORCPT ); Thu, 7 Feb 2019 08:39:03 -0500 Received: from mga18.intel.com ([134.134.136.126]:18752 "EHLO mga18.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726750AbfBGNjD (ORCPT ); Thu, 7 Feb 2019 08:39:03 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by orsmga106.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 07 Feb 2019 05:39:02 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.58,344,1544515200"; d="scan'208";a="131789311" Received: from jlahtine-desk.ger.corp.intel.com (HELO localhost) ([10.252.9.245]) by FMSMGA003.fm.intel.com with ESMTP; 07 Feb 2019 05:39:00 -0800 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8BIT To: Intel graphics driver community testing & development From: Joonas Lahtinen Organization: Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo In-Reply-To: <20190107085656.22521-1-joonas.lahtinen@linux.intel.com> Cc: stable@vger.kernel.org, Akash Goel , Chris Wilson , Tvrtko Ursulin , Adam Zabrocki References: <20190107085656.22521-1-joonas.lahtinen@linux.intel.com> Message-ID: <154954673968.26993.15151863099731651436@jlahtine-desk.ger.corp.intel.com> User-Agent: alot/0.7 Subject: Re: [PATCH 1/2] drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set Date: Thu, 07 Feb 2019 15:38:59 +0200 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org Quoting Joonas Lahtinen (2019-01-07 10:56:55) > Make sure the underlying VMA in the process address space is the > same as it was during vm_mmap to avoid applying WC to wrong VMA. > > A more long-term solution would be to have vm_mmap_locked variant > in linux/mmap.h for when caller wants to hold mmap_sem for an > extended duration. These are now merged to drm-tip, and will head to 5.1 and then to stable kernels. Thanks for the report and reviews! Regards, Joonas > Fixes: 1816f9236303 ("drm/i915: Support creation of unbound wc user mappings for objects") > Reported-by: Adam Zabrocki > Suggested-by: Linus Torvalds > Signed-off-by: Joonas Lahtinen > Cc: # v4.0+ > Cc: Akash Goel > Cc: Chris Wilson > Cc: Tvrtko Ursulin > Cc: Adam Zabrocki > --- > drivers/gpu/drm/i915/i915_gem.c | 11 ++++++++++- > 1 file changed, 10 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c > index 062c8395557c..f1d594a53978 100644 > --- a/drivers/gpu/drm/i915/i915_gem.c > +++ b/drivers/gpu/drm/i915/i915_gem.c > @@ -1680,6 +1680,15 @@ i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data, > return 0; > } > > +static inline bool > +match_gem_vma(struct vm_area_struct *vma, struct file *filp, > + unsigned long addr, unsigned long size) > +{ > + return vma && vma->vm_file == filp && > + vma->vm_start == addr && > + (vma->vm_end - vma->vm_start) == size; > +} > + > /** > * i915_gem_mmap_ioctl - Maps the contents of an object, returning the address > * it is mapped to. > @@ -1738,7 +1747,7 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data, > return -EINTR; > } > vma = find_vma(mm, addr); > - if (vma) > + if (match_gem_vma(vma, obj->base.filp, addr, args->size)) > vma->vm_page_prot = > pgprot_writecombine(vm_get_page_prot(vma->vm_flags)); > else > -- > 2.17.2 > From mboxrd@z Thu Jan 1 00:00:00 1970 From: Joonas Lahtinen Subject: Re: [PATCH 1/2] drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set Date: Thu, 07 Feb 2019 15:38:59 +0200 Message-ID: <154954673968.26993.15151863099731651436@jlahtine-desk.ger.corp.intel.com> References: <20190107085656.22521-1-joonas.lahtinen@linux.intel.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8BIT Return-path: In-Reply-To: <20190107085656.22521-1-joonas.lahtinen@linux.intel.com> Sender: stable-owner@vger.kernel.org To: Intel graphics driver community testing & development Cc: stable@vger.kernel.org, Akash Goel , Chris Wilson , Tvrtko Ursulin , Adam Zabrocki List-Id: intel-gfx@lists.freedesktop.org Quoting Joonas Lahtinen (2019-01-07 10:56:55) > Make sure the underlying VMA in the process address space is the > same as it was during vm_mmap to avoid applying WC to wrong VMA. > > A more long-term solution would be to have vm_mmap_locked variant > in linux/mmap.h for when caller wants to hold mmap_sem for an > extended duration. These are now merged to drm-tip, and will head to 5.1 and then to stable kernels. Thanks for the report and reviews! Regards, Joonas > Fixes: 1816f9236303 ("drm/i915: Support creation of unbound wc user mappings for objects") > Reported-by: Adam Zabrocki > Suggested-by: Linus Torvalds > Signed-off-by: Joonas Lahtinen > Cc: # v4.0+ > Cc: Akash Goel > Cc: Chris Wilson > Cc: Tvrtko Ursulin > Cc: Adam Zabrocki > --- > drivers/gpu/drm/i915/i915_gem.c | 11 ++++++++++- > 1 file changed, 10 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c > index 062c8395557c..f1d594a53978 100644 > --- a/drivers/gpu/drm/i915/i915_gem.c > +++ b/drivers/gpu/drm/i915/i915_gem.c > @@ -1680,6 +1680,15 @@ i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data, > return 0; > } > > +static inline bool > +match_gem_vma(struct vm_area_struct *vma, struct file *filp, > + unsigned long addr, unsigned long size) > +{ > + return vma && vma->vm_file == filp && > + vma->vm_start == addr && > + (vma->vm_end - vma->vm_start) == size; > +} > + > /** > * i915_gem_mmap_ioctl - Maps the contents of an object, returning the address > * it is mapped to. > @@ -1738,7 +1747,7 @@ i915_gem_mmap_ioctl(struct drm_device *dev, void *data, > return -EINTR; > } > vma = find_vma(mm, addr); > - if (vma) > + if (match_gem_vma(vma, obj->base.filp, addr, args->size)) > vma->vm_page_prot = > pgprot_writecombine(vm_get_page_prot(vma->vm_flags)); > else > -- > 2.17.2 >