From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3E25CA9EC0 for ; Mon, 28 Oct 2019 20:08:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 79F46208C0 for ; Mon, 28 Oct 2019 20:08:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732717AbfJ1UIf (ORCPT ); Mon, 28 Oct 2019 16:08:35 -0400 Received: from foss.arm.com ([217.140.110.172]:44636 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727463AbfJ1UIf (ORCPT ); Mon, 28 Oct 2019 16:08:35 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 8293531F; Mon, 28 Oct 2019 13:08:34 -0700 (PDT) Received: from e110467-lin.cambridge.arm.com (e110467-lin.cambridge.arm.com [10.1.197.57]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id B4C9F3F71F; Mon, 28 Oct 2019 13:08:33 -0700 (PDT) From: Robin Murphy To: robh@kernel.org, tomeu.vizoso@collabora.com Cc: steven.price@arm.com, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: [PATCH] drm/panfrost: Don't dereference bogus MMU pointers Date: Mon, 28 Oct 2019 20:08:25 +0000 Message-Id: <9a0b09e6b5851f0d4428b72dd6b8b4c0d0ef4206.1572293305.git.robin.murphy@arm.com> X-Mailer: git-send-email 2.21.0.dirty MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org It seems that killing an application while faults are occurring (particularly with a GPU in FPGA at a whopping 40MHz) can lead to handling a lingering page fault after all the address space contexts have already been freed. In this situation, the LRU list is empty so addr_to_drm_mm_node() ends up dereferencing the list head as if it were a struct panfrost_mmu entry; this leaves "mmu->as" actually pointing at the pfdev->alloc_mask bitmap, which is also empty, and given that the fault has a high likelihood of being in AS0, hilarity ensues. Sadly, the cleanest solution seems to involve another goto. Oh well, at least it's robust... Signed-off-by: Robin Murphy --- drivers/gpu/drm/panfrost/panfrost_mmu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/panfrost/panfrost_mmu.c b/drivers/gpu/drm/panfrost/panfrost_mmu.c index e61984e26e0a..508765f80cfe 100644 --- a/drivers/gpu/drm/panfrost/panfrost_mmu.c +++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c @@ -413,11 +413,11 @@ addr_to_drm_mm_node(struct panfrost_device *pfdev, int as, u64 addr) spin_lock(&pfdev->as_lock); list_for_each_entry(mmu, &pfdev->as_lru_list, list) { if (as == mmu->as) - break; + goto found_mmu; } - if (as != mmu->as) - goto out; + goto out; +found_mmu: priv = container_of(mmu, struct panfrost_file_priv, mmu); spin_lock(&priv->mm_lock); -- 2.21.0.dirty From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7FE12CA9EC1 for ; Mon, 28 Oct 2019 20:08:37 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 64FBB214B2 for ; Mon, 28 Oct 2019 20:08:37 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 64FBB214B2 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 038536E9E9; Mon, 28 Oct 2019 20:08:37 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by gabe.freedesktop.org (Postfix) with ESMTP id 615936E9E9 for ; Mon, 28 Oct 2019 20:08:35 +0000 (UTC) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 8293531F; Mon, 28 Oct 2019 13:08:34 -0700 (PDT) Received: from e110467-lin.cambridge.arm.com (e110467-lin.cambridge.arm.com [10.1.197.57]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id B4C9F3F71F; Mon, 28 Oct 2019 13:08:33 -0700 (PDT) From: Robin Murphy To: robh@kernel.org, tomeu.vizoso@collabora.com Subject: [PATCH] drm/panfrost: Don't dereference bogus MMU pointers Date: Mon, 28 Oct 2019 20:08:25 +0000 Message-Id: <9a0b09e6b5851f0d4428b72dd6b8b4c0d0ef4206.1572293305.git.robin.murphy@arm.com> X-Mailer: git-send-email 2.21.0.dirty MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, steven.price@arm.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" Message-ID: <20191028200825.pmkoDmGBj-lSkAGKJ4HqPspd7RKDqYBENt8zlu1GUq4@z> SXQgc2VlbXMgdGhhdCBraWxsaW5nIGFuIGFwcGxpY2F0aW9uIHdoaWxlIGZhdWx0cyBhcmUgb2Nj dXJyaW5nCihwYXJ0aWN1bGFybHkgd2l0aCBhIEdQVSBpbiBGUEdBIGF0IGEgd2hvcHBpbmcgNDBN SHopIGNhbiBsZWFkIHRvCmhhbmRsaW5nIGEgbGluZ2VyaW5nIHBhZ2UgZmF1bHQgYWZ0ZXIgYWxs IHRoZSBhZGRyZXNzIHNwYWNlIGNvbnRleHRzCmhhdmUgYWxyZWFkeSBiZWVuIGZyZWVkLiBJbiB0 aGlzIHNpdHVhdGlvbiwgdGhlIExSVSBsaXN0IGlzIGVtcHR5IHNvCmFkZHJfdG9fZHJtX21tX25v ZGUoKSBlbmRzIHVwIGRlcmVmZXJlbmNpbmcgdGhlIGxpc3QgaGVhZCBhcyBpZiBpdCB3ZXJlCmEg c3RydWN0IHBhbmZyb3N0X21tdSBlbnRyeTsgdGhpcyBsZWF2ZXMgIm1tdS0+YXMiIGFjdHVhbGx5 IHBvaW50aW5nIGF0CnRoZSBwZmRldi0+YWxsb2NfbWFzayBiaXRtYXAsIHdoaWNoIGlzIGFsc28g ZW1wdHksIGFuZCBnaXZlbiB0aGF0IHRoZQpmYXVsdCBoYXMgYSBoaWdoIGxpa2VsaWhvb2Qgb2Yg YmVpbmcgaW4gQVMwLCBoaWxhcml0eSBlbnN1ZXMuCgpTYWRseSwgdGhlIGNsZWFuZXN0IHNvbHV0 aW9uIHNlZW1zIHRvIGludm9sdmUgYW5vdGhlciBnb3RvLiBPaCB3ZWxsLCBhdApsZWFzdCBpdCdz IHJvYnVzdC4uLgoKU2lnbmVkLW9mZi1ieTogUm9iaW4gTXVycGh5IDxyb2Jpbi5tdXJwaHlAYXJt LmNvbT4KLS0tCiBkcml2ZXJzL2dwdS9kcm0vcGFuZnJvc3QvcGFuZnJvc3RfbW11LmMgfCA2ICsr Ky0tLQogMSBmaWxlIGNoYW5nZWQsIDMgaW5zZXJ0aW9ucygrKSwgMyBkZWxldGlvbnMoLSkKCmRp ZmYgLS1naXQgYS9kcml2ZXJzL2dwdS9kcm0vcGFuZnJvc3QvcGFuZnJvc3RfbW11LmMgYi9kcml2 ZXJzL2dwdS9kcm0vcGFuZnJvc3QvcGFuZnJvc3RfbW11LmMKaW5kZXggZTYxOTg0ZTI2ZTBhLi41 MDg3NjVmODBjZmUgMTAwNjQ0Ci0tLSBhL2RyaXZlcnMvZ3B1L2RybS9wYW5mcm9zdC9wYW5mcm9z dF9tbXUuYworKysgYi9kcml2ZXJzL2dwdS9kcm0vcGFuZnJvc3QvcGFuZnJvc3RfbW11LmMKQEAg LTQxMywxMSArNDEzLDExIEBAIGFkZHJfdG9fZHJtX21tX25vZGUoc3RydWN0IHBhbmZyb3N0X2Rl dmljZSAqcGZkZXYsIGludCBhcywgdTY0IGFkZHIpCiAJc3Bpbl9sb2NrKCZwZmRldi0+YXNfbG9j ayk7CiAJbGlzdF9mb3JfZWFjaF9lbnRyeShtbXUsICZwZmRldi0+YXNfbHJ1X2xpc3QsIGxpc3Qp IHsKIAkJaWYgKGFzID09IG1tdS0+YXMpCi0JCQlicmVhazsKKwkJCWdvdG8gZm91bmRfbW11Owog CX0KLQlpZiAoYXMgIT0gbW11LT5hcykKLQkJZ290byBvdXQ7CisJZ290byBvdXQ7CiAKK2ZvdW5k X21tdToKIAlwcml2ID0gY29udGFpbmVyX29mKG1tdSwgc3RydWN0IHBhbmZyb3N0X2ZpbGVfcHJp diwgbW11KTsKIAogCXNwaW5fbG9jaygmcHJpdi0+bW1fbG9jayk7Ci0tIAoyLjIxLjAuZGlydHkK Cl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCmRyaS1kZXZl bCBtYWlsaW5nIGxpc3QKZHJpLWRldmVsQGxpc3RzLmZyZWVkZXNrdG9wLm9yZwpodHRwczovL2xp c3RzLmZyZWVkZXNrdG9wLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2RyaS1kZXZlbA==