All of lore.kernel.org
 help / color / mirror / Atom feed
From: Zhenyu Wang <zhenyuw@linux.intel.com>
To: Zheng Wang <zyytlz.wz@163.com>
Cc: zhi.a.wang@intel.com, alex000young@gmail.com,
	security@kernel.org, intel-gvt-dev@lists.freedesktop.org,
	tvrtko.ursulin@linux.intel.com, airlied@linux.ie,
	gregkh@linuxfoundation.org, intel-gfx@lists.freedesktop.org,
	joonas.lahtinen@linux.intel.com, hackerzheng666@gmail.com,
	dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
	1002992920@qq.com, zhenyuw@linux.intel.com, airlied@gmail.com
Subject: Re: [PATCH v5] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
Date: Wed, 21 Dec 2022 10:58:57 +0800	[thread overview]
Message-ID: <20221221025857.GG30028@zhen-hp.sh.intel.com> (raw)
In-Reply-To: <20221220094014.1128207-1-zyytlz.wz@163.com>

[-- Attachment #1: Type: text/plain, Size: 2875 bytes --]

On 2022.12.20 17:40:14 +0800, Zheng Wang wrote:
> If intel_gvt_dma_map_guest_page failed, it will call
>  ppgtt_invalidate_spt, which will finally free the spt. But the
>  caller function ppgtt_populate_spt_by_guest_entry does not notice
>  that, it will free spt again in its error path.

indent

> 
> Fix this by undoing the mapping of DMA address and freeing sub_spt.
> Besides, leave the handle of spt destroy to caller function instead of
> callee function when error occurs.
> 
> Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support")
> Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
> ---
> v5:
> - remove unnecessary switch-case code for there is only one particular case,
> correct the unmap target from parent_spt to sub_spt.add more details in
> commit message. All suggested by Zhenyu
> 
> v4:
> - fix by undo the mapping of DMA address and free sub_spt suggested by Zhi
> 
> v3:
> - correct spelling mistake and remove unused variable suggested by Greg
> 
> v2: https://lore.kernel.org/all/20221006165845.1735393-1-zyytlz.wz@163.com/
> 
> v1: https://lore.kernel.org/all/20220928033340.1063949-1-zyytlz.wz@163.com/
> ---
>  drivers/gpu/drm/i915/gvt/gtt.c | 18 ++++++++++++++----
>  1 file changed, 14 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
> index 51e5e8fb505b..4d478a59eb7d 100644
> --- a/drivers/gpu/drm/i915/gvt/gtt.c
> +++ b/drivers/gpu/drm/i915/gvt/gtt.c
> @@ -1209,10 +1209,8 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu,
>  	for_each_shadow_entry(sub_spt, &sub_se, sub_index) {
>  		ret = intel_gvt_dma_map_guest_page(vgpu, start_gfn + sub_index,
>  						   PAGE_SIZE, &dma_addr);
> -		if (ret) {
> -			ppgtt_invalidate_spt(spt);
> -			return ret;
> -		}
> +		if (ret)
> +			goto err;
>  		sub_se.val64 = se->val64;
>  
>  		/* Copy the PAT field from PDE. */
> @@ -1231,6 +1229,18 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu,
>  	ops->set_pfn(se, sub_spt->shadow_page.mfn);
>  	ppgtt_set_shadow_entry(spt, se, index);
>  	return 0;
> +err:
> +	/* Undone the existing mappings of DMA addr. */

We need a verb here for Undo.

> +	for_each_present_shadow_entry(sub_spt, &sub_se, sub_index) {
> +		gvt_vdbg_mm("invalidate 4K entry\n");
> +		ppgtt_invalidate_pte(sub_spt, &sub_se);
> +	}
> +	/* Release the new allocated spt. */
> +	trace_spt_change(sub_spt->vgpu->id, "release", sub_spt,
> +		sub_spt->guest_page.gfn, sub_spt->shadow_page.type);
> +	ppgtt_free_spt(sub_spt);
> +	sub_spt = NULL;

Not need to reset local variable that has no use then.

I'll handle these trivial fixes during the merge.

Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>

thanks

> +	return ret;
>  }
>  
>  static int split_64KB_gtt_entry(struct intel_vgpu *vgpu,
> -- 
> 2.25.1
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

WARNING: multiple messages have this Message-ID (diff)
From: Zhenyu Wang <zhenyuw@linux.intel.com>
To: Zheng Wang <zyytlz.wz@163.com>
Cc: alex000young@gmail.com, security@kernel.org,
	tvrtko.ursulin@linux.intel.com, airlied@linux.ie,
	gregkh@linuxfoundation.org, intel-gfx@lists.freedesktop.org,
	hackerzheng666@gmail.com, dri-devel@lists.freedesktop.org,
	linux-kernel@vger.kernel.org, 1002992920@qq.com,
	intel-gvt-dev@lists.freedesktop.org, zhi.a.wang@intel.com
Subject: Re: [PATCH v5] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
Date: Wed, 21 Dec 2022 10:58:57 +0800	[thread overview]
Message-ID: <20221221025857.GG30028@zhen-hp.sh.intel.com> (raw)
In-Reply-To: <20221220094014.1128207-1-zyytlz.wz@163.com>

[-- Attachment #1: Type: text/plain, Size: 2875 bytes --]

On 2022.12.20 17:40:14 +0800, Zheng Wang wrote:
> If intel_gvt_dma_map_guest_page failed, it will call
>  ppgtt_invalidate_spt, which will finally free the spt. But the
>  caller function ppgtt_populate_spt_by_guest_entry does not notice
>  that, it will free spt again in its error path.

indent

> 
> Fix this by undoing the mapping of DMA address and freeing sub_spt.
> Besides, leave the handle of spt destroy to caller function instead of
> callee function when error occurs.
> 
> Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support")
> Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
> ---
> v5:
> - remove unnecessary switch-case code for there is only one particular case,
> correct the unmap target from parent_spt to sub_spt.add more details in
> commit message. All suggested by Zhenyu
> 
> v4:
> - fix by undo the mapping of DMA address and free sub_spt suggested by Zhi
> 
> v3:
> - correct spelling mistake and remove unused variable suggested by Greg
> 
> v2: https://lore.kernel.org/all/20221006165845.1735393-1-zyytlz.wz@163.com/
> 
> v1: https://lore.kernel.org/all/20220928033340.1063949-1-zyytlz.wz@163.com/
> ---
>  drivers/gpu/drm/i915/gvt/gtt.c | 18 ++++++++++++++----
>  1 file changed, 14 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
> index 51e5e8fb505b..4d478a59eb7d 100644
> --- a/drivers/gpu/drm/i915/gvt/gtt.c
> +++ b/drivers/gpu/drm/i915/gvt/gtt.c
> @@ -1209,10 +1209,8 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu,
>  	for_each_shadow_entry(sub_spt, &sub_se, sub_index) {
>  		ret = intel_gvt_dma_map_guest_page(vgpu, start_gfn + sub_index,
>  						   PAGE_SIZE, &dma_addr);
> -		if (ret) {
> -			ppgtt_invalidate_spt(spt);
> -			return ret;
> -		}
> +		if (ret)
> +			goto err;
>  		sub_se.val64 = se->val64;
>  
>  		/* Copy the PAT field from PDE. */
> @@ -1231,6 +1229,18 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu,
>  	ops->set_pfn(se, sub_spt->shadow_page.mfn);
>  	ppgtt_set_shadow_entry(spt, se, index);
>  	return 0;
> +err:
> +	/* Undone the existing mappings of DMA addr. */

We need a verb here for Undo.

> +	for_each_present_shadow_entry(sub_spt, &sub_se, sub_index) {
> +		gvt_vdbg_mm("invalidate 4K entry\n");
> +		ppgtt_invalidate_pte(sub_spt, &sub_se);
> +	}
> +	/* Release the new allocated spt. */
> +	trace_spt_change(sub_spt->vgpu->id, "release", sub_spt,
> +		sub_spt->guest_page.gfn, sub_spt->shadow_page.type);
> +	ppgtt_free_spt(sub_spt);
> +	sub_spt = NULL;

Not need to reset local variable that has no use then.

I'll handle these trivial fixes during the merge.

Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>

thanks

> +	return ret;
>  }
>  
>  static int split_64KB_gtt_entry(struct intel_vgpu *vgpu,
> -- 
> 2.25.1
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

WARNING: multiple messages have this Message-ID (diff)
From: Zhenyu Wang <zhenyuw@linux.intel.com>
To: Zheng Wang <zyytlz.wz@163.com>
Cc: alex000young@gmail.com, security@kernel.org, airlied@linux.ie,
	gregkh@linuxfoundation.org, intel-gfx@lists.freedesktop.org,
	hackerzheng666@gmail.com, dri-devel@lists.freedesktop.org,
	linux-kernel@vger.kernel.org, 1002992920@qq.com,
	airlied@gmail.com, intel-gvt-dev@lists.freedesktop.org
Subject: Re: [Intel-gfx] [PATCH v5] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
Date: Wed, 21 Dec 2022 10:58:57 +0800	[thread overview]
Message-ID: <20221221025857.GG30028@zhen-hp.sh.intel.com> (raw)
In-Reply-To: <20221220094014.1128207-1-zyytlz.wz@163.com>

[-- Attachment #1: Type: text/plain, Size: 2875 bytes --]

On 2022.12.20 17:40:14 +0800, Zheng Wang wrote:
> If intel_gvt_dma_map_guest_page failed, it will call
>  ppgtt_invalidate_spt, which will finally free the spt. But the
>  caller function ppgtt_populate_spt_by_guest_entry does not notice
>  that, it will free spt again in its error path.

indent

> 
> Fix this by undoing the mapping of DMA address and freeing sub_spt.
> Besides, leave the handle of spt destroy to caller function instead of
> callee function when error occurs.
> 
> Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support")
> Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
> ---
> v5:
> - remove unnecessary switch-case code for there is only one particular case,
> correct the unmap target from parent_spt to sub_spt.add more details in
> commit message. All suggested by Zhenyu
> 
> v4:
> - fix by undo the mapping of DMA address and free sub_spt suggested by Zhi
> 
> v3:
> - correct spelling mistake and remove unused variable suggested by Greg
> 
> v2: https://lore.kernel.org/all/20221006165845.1735393-1-zyytlz.wz@163.com/
> 
> v1: https://lore.kernel.org/all/20220928033340.1063949-1-zyytlz.wz@163.com/
> ---
>  drivers/gpu/drm/i915/gvt/gtt.c | 18 ++++++++++++++----
>  1 file changed, 14 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
> index 51e5e8fb505b..4d478a59eb7d 100644
> --- a/drivers/gpu/drm/i915/gvt/gtt.c
> +++ b/drivers/gpu/drm/i915/gvt/gtt.c
> @@ -1209,10 +1209,8 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu,
>  	for_each_shadow_entry(sub_spt, &sub_se, sub_index) {
>  		ret = intel_gvt_dma_map_guest_page(vgpu, start_gfn + sub_index,
>  						   PAGE_SIZE, &dma_addr);
> -		if (ret) {
> -			ppgtt_invalidate_spt(spt);
> -			return ret;
> -		}
> +		if (ret)
> +			goto err;
>  		sub_se.val64 = se->val64;
>  
>  		/* Copy the PAT field from PDE. */
> @@ -1231,6 +1229,18 @@ static int split_2MB_gtt_entry(struct intel_vgpu *vgpu,
>  	ops->set_pfn(se, sub_spt->shadow_page.mfn);
>  	ppgtt_set_shadow_entry(spt, se, index);
>  	return 0;
> +err:
> +	/* Undone the existing mappings of DMA addr. */

We need a verb here for Undo.

> +	for_each_present_shadow_entry(sub_spt, &sub_se, sub_index) {
> +		gvt_vdbg_mm("invalidate 4K entry\n");
> +		ppgtt_invalidate_pte(sub_spt, &sub_se);
> +	}
> +	/* Release the new allocated spt. */
> +	trace_spt_change(sub_spt->vgpu->id, "release", sub_spt,
> +		sub_spt->guest_page.gfn, sub_spt->shadow_page.type);
> +	ppgtt_free_spt(sub_spt);
> +	sub_spt = NULL;

Not need to reset local variable that has no use then.

I'll handle these trivial fixes during the merge.

Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>

thanks

> +	return ret;
>  }
>  
>  static int split_64KB_gtt_entry(struct intel_vgpu *vgpu,
> -- 
> 2.25.1
> 

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

  reply	other threads:[~2022-12-21  3:01 UTC|newest]

Thread overview: 93+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-09-18 19:24 [PATCH] drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry Zheng Wang
2022-09-18 19:24 ` [Intel-gfx] " Zheng Wang
2022-09-19  9:30 ` Jani Nikula
2022-09-19  9:30   ` [Intel-gfx] " Jani Nikula
2022-09-19  9:55   ` Zheng Hacker
2022-09-19  9:55     ` [Intel-gfx] " Zheng Hacker
2022-09-19  9:55     ` Zheng Hacker
2022-09-21  9:13   ` Zheng Hacker
2022-09-21  9:13     ` [Intel-gfx] " Zheng Hacker
2022-09-21  9:13     ` Zheng Hacker
2022-09-28  3:33     ` [PATCH] drm/i915/gvt: fix double free " Zheng Wang
2022-09-28  3:33       ` [Intel-gfx] " Zheng Wang
2022-09-28  3:33       ` Zheng Wang
2022-10-02 14:18       ` Greg KH
2022-10-02 14:18         ` [Intel-gfx] " Greg KH
2022-10-02 14:18         ` Greg KH
2022-10-03  4:36         ` Zheng Hacker
2022-10-03  4:36           ` [Intel-gfx] " Zheng Hacker
2022-10-03  4:36           ` Zheng Hacker
2022-10-06 16:58       ` [PATCH v2] " Zheng Wang
2022-10-06 16:58         ` [Intel-gfx] " Zheng Wang
2022-10-06 16:58         ` Zheng Wang
2022-10-06 19:23         ` Greg KH
2022-10-06 19:23           ` [Intel-gfx] " Greg KH
2022-10-06 19:23           ` Greg KH
2022-10-07  0:39           ` Zheng Hacker
2022-10-07  0:39             ` [Intel-gfx] " Zheng Hacker
2022-10-07  0:39             ` Zheng Hacker
2022-10-07  1:37           ` [PATCH v3] " Zheng Wang
2022-10-07  1:37             ` [Intel-gfx] " Zheng Wang
2022-10-07  1:37             ` Zheng Wang
2022-10-27  0:01             ` [Intel-gfx] " Dave Airlie
2022-10-27  0:01               ` Dave Airlie
2022-10-27  0:01               ` Dave Airlie
2022-10-27  3:26               ` Zheng Hacker
2022-10-27  3:26                 ` [Intel-gfx] " Zheng Hacker
2022-10-27  3:26                 ` Zheng Hacker
2022-10-27  5:12                 ` Dave Airlie
2022-10-27  5:12                   ` [Intel-gfx] " Dave Airlie
2022-10-27  5:12                   ` Dave Airlie
2022-10-30 15:10                   ` Zheng Hacker
2022-10-30 15:10                     ` [Intel-gfx] " Zheng Hacker
2022-10-30 15:10                     ` Zheng Hacker
2022-12-15 10:47                   ` Joonas Lahtinen
2022-12-15 10:47                     ` [Intel-gfx] " Joonas Lahtinen
2022-12-15 11:33                     ` Wang, Zhi A
2022-12-15 11:33                       ` [Intel-gfx] " Wang, Zhi A
2022-12-15 13:26                       ` Zheng Hacker
2022-12-15 13:26                         ` [Intel-gfx] " Zheng Hacker
2022-12-15 13:26                         ` Zheng Hacker
2022-12-19  7:57                       ` [Intel-gfx] " Zheng Wang
2022-12-19  7:57                         ` Zheng Wang
2022-12-19  7:57                         ` Zheng Wang
2022-12-19  8:22                         ` Wang, Zhi A
2022-12-19  8:22                           ` Wang, Zhi A
2022-12-19  8:22                           ` Wang, Zhi A
2022-12-19  9:21                           ` Zheng Wang
2022-12-19  9:21                             ` Zheng Wang
2022-12-19  9:21                             ` Zheng Wang
2022-12-19 12:46                           ` [PATCH v4] [PATCH v4] " Zheng Wang
2022-12-19 12:46                             ` [Intel-gfx] " Zheng Wang
2022-12-19 12:46                             ` Zheng Wang
2022-12-19 12:52                           ` [RESEND PATCH " Zheng Wang
2022-12-19 12:52                             ` [Intel-gfx] " Zheng Wang
2022-12-19 12:52                             ` Zheng Wang
2022-12-20  8:22                             ` Zhenyu Wang
2022-12-20  8:22                               ` [Intel-gfx] " Zhenyu Wang
2022-12-20  8:22                               ` Zhenyu Wang
2022-12-20  9:03                               ` Zheng Hacker
2022-12-20  9:03                                 ` [Intel-gfx] " Zheng Hacker
2022-12-20  9:03                                 ` Zheng Hacker
2022-12-20  9:40                           ` [PATCH v5] " Zheng Wang
2022-12-20  9:40                             ` [Intel-gfx] " Zheng Wang
2022-12-20  9:40                             ` Zheng Wang
2022-12-21  2:58                             ` Zhenyu Wang [this message]
2022-12-21  2:58                               ` [Intel-gfx] " Zhenyu Wang
2022-12-21  2:58                               ` Zhenyu Wang
2022-12-21  5:01                               ` Zheng Hacker
2022-12-21  5:01                                 ` [Intel-gfx] " Zheng Hacker
2022-12-21  5:01                                 ` Zheng Hacker
2022-12-29 16:56                           ` [PATCH v6] " Zheng Wang
2022-12-29 16:56                             ` [Intel-gfx] " Zheng Wang
2022-12-29 16:56                             ` Zheng Wang
2022-09-19 20:17 ` [Intel-gfx] ✗ Fi.CI.BUILD: failure for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry (rev2) Patchwork
2022-09-29 18:16 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry (rev3) Patchwork
2022-09-29 18:40 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork
2022-09-30 18:41 ` [Intel-gfx] ✓ Fi.CI.IGT: " Patchwork
2022-10-10 15:00 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry (rev5) Patchwork
2022-10-10 15:30 ` [Intel-gfx] ✗ Fi.CI.BAT: failure " Patchwork
2022-12-22 12:25 ` [Intel-gfx] ✗ Fi.CI.CHECKPATCH: warning for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry (rev8) Patchwork
2022-12-22 12:53 ` [Intel-gfx] ✓ Fi.CI.BAT: success " Patchwork
2022-12-22 18:13 ` [Intel-gfx] ✗ Fi.CI.IGT: failure " Patchwork
2022-12-29 17:57 ` [Intel-gfx] ✗ Fi.CI.BAT: failure for drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry (rev9) Patchwork

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20221221025857.GG30028@zhen-hp.sh.intel.com \
    --to=zhenyuw@linux.intel.com \
    --cc=1002992920@qq.com \
    --cc=airlied@gmail.com \
    --cc=airlied@linux.ie \
    --cc=alex000young@gmail.com \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=hackerzheng666@gmail.com \
    --cc=intel-gfx@lists.freedesktop.org \
    --cc=intel-gvt-dev@lists.freedesktop.org \
    --cc=joonas.lahtinen@linux.intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=security@kernel.org \
    --cc=tvrtko.ursulin@linux.intel.com \
    --cc=zhi.a.wang@intel.com \
    --cc=zyytlz.wz@163.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.