From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AEDC1C433F5 for ; Thu, 6 Oct 2022 19:23:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231653AbiJFTXm (ORCPT ); Thu, 6 Oct 2022 15:23:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59956 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232102AbiJFTWj (ORCPT ); Thu, 6 Oct 2022 15:22:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8A9A21144C4 for ; Thu, 6 Oct 2022 12:22:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 262C161A94 for ; Thu, 6 Oct 2022 19:22:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E57FCC433D7; Thu, 6 Oct 2022 19:22:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1665084154; bh=YsMh0kWe/OOR+5QG3loglTlzXYtyV8KBcvp4A3mJk5Q=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=BVJCPliSRQiCQnT7Nl1mNjkmwplBTP4CTh/QWA/r38FtWwVGbWjuoeyTvGbaEt5Ep sRnDdxkefmR3TRQULCPjSOp+KRIx0SdZjsp+ZUwI/6z1SIREquHhn84iNiUWZ/igTz lmi1YCbk/hJYZpNCJxUCJML1iHEdri22IlDOWvrI= Date: Thu, 6 Oct 2022 21:23:15 +0200 From: Greg KH To: Zheng Wang Cc: 1002992920@qq.com, airlied@linux.ie, alex000young@gmail.com, dri-devel@lists.freedesktop.org, hackerzheng666@gmail.com, intel-gfx@lists.freedesktop.org, jani.nikula@linux.intel.com, linux-kernel@vger.kernel.org, security@kernel.org, tvrtko.ursulin@linux.intel.com Subject: Re: [PATCH v2] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry Message-ID: References: <20220928033340.1063949-1-zyytlz.wz@163.com> <20221006165845.1735393-1-zyytlz.wz@163.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20221006165845.1735393-1-zyytlz.wz@163.com> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Oct 07, 2022 at 12:58:45AM +0800, Zheng Wang wrote: > If intel_gvt_dma_map_guest_page failed, it will call > ppgtt_invalidate_spt, which will finally free the spt. > But the caller does not notice that, it will free spt again in error path. > > Fix this by spliting invalidate and free in ppgtt_invalidate_spt. > Only free spt when in good case. > > Reported-by: Zheng Wang > Signed-off-by: Zheng Wang > --- > v2: > - split initial function into two api function suggested by Greg > > v1: https://lore.kernel.org/all/20220928033340.1063949-1-zyytlz.wz@163.com/ > --- > drivers/gpu/drm/i915/gvt/gtt.c | 31 +++++++++++++++++++++---------- > 1 file changed, 21 insertions(+), 10 deletions(-) > > diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c > index ce0eb03709c3..55d8e1419302 100644 > --- a/drivers/gpu/drm/i915/gvt/gtt.c > +++ b/drivers/gpu/drm/i915/gvt/gtt.c > @@ -959,6 +959,7 @@ static inline int ppgtt_put_spt(struct intel_vgpu_ppgtt_spt *spt) > return atomic_dec_return(&spt->refcount); > } > > +static int ppgtt_invalidate_and_free_spt(struct intel_vgpu_ppgtt_spt *spt); Odd extra space after the 'int', why? From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C234BC433F5 for ; Thu, 6 Oct 2022 19:22:45 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 16C4410E87D; Thu, 6 Oct 2022 19:22:43 +0000 (UTC) Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by gabe.freedesktop.org (Postfix) with ESMTPS id 2A30B10E87D; Thu, 6 Oct 2022 19:22:37 +0000 (UTC) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CB73AB82150; Thu, 6 Oct 2022 19:22:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E57FCC433D7; Thu, 6 Oct 2022 19:22:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1665084154; bh=YsMh0kWe/OOR+5QG3loglTlzXYtyV8KBcvp4A3mJk5Q=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=BVJCPliSRQiCQnT7Nl1mNjkmwplBTP4CTh/QWA/r38FtWwVGbWjuoeyTvGbaEt5Ep sRnDdxkefmR3TRQULCPjSOp+KRIx0SdZjsp+ZUwI/6z1SIREquHhn84iNiUWZ/igTz lmi1YCbk/hJYZpNCJxUCJML1iHEdri22IlDOWvrI= Date: Thu, 6 Oct 2022 21:23:15 +0200 From: Greg KH To: Zheng Wang Subject: Re: [PATCH v2] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry Message-ID: References: <20220928033340.1063949-1-zyytlz.wz@163.com> <20221006165845.1735393-1-zyytlz.wz@163.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20221006165845.1735393-1-zyytlz.wz@163.com> X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: alex000young@gmail.com, security@kernel.org, tvrtko.ursulin@linux.intel.com, airlied@linux.ie, intel-gfx@lists.freedesktop.org, hackerzheng666@gmail.com, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, 1002992920@qq.com Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" On Fri, Oct 07, 2022 at 12:58:45AM +0800, Zheng Wang wrote: > If intel_gvt_dma_map_guest_page failed, it will call > ppgtt_invalidate_spt, which will finally free the spt. > But the caller does not notice that, it will free spt again in error path. > > Fix this by spliting invalidate and free in ppgtt_invalidate_spt. > Only free spt when in good case. > > Reported-by: Zheng Wang > Signed-off-by: Zheng Wang > --- > v2: > - split initial function into two api function suggested by Greg > > v1: https://lore.kernel.org/all/20220928033340.1063949-1-zyytlz.wz@163.com/ > --- > drivers/gpu/drm/i915/gvt/gtt.c | 31 +++++++++++++++++++++---------- > 1 file changed, 21 insertions(+), 10 deletions(-) > > diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c > index ce0eb03709c3..55d8e1419302 100644 > --- a/drivers/gpu/drm/i915/gvt/gtt.c > +++ b/drivers/gpu/drm/i915/gvt/gtt.c > @@ -959,6 +959,7 @@ static inline int ppgtt_put_spt(struct intel_vgpu_ppgtt_spt *spt) > return atomic_dec_return(&spt->refcount); > } > > +static int ppgtt_invalidate_and_free_spt(struct intel_vgpu_ppgtt_spt *spt); Odd extra space after the 'int', why? From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 3AD8BC433FE for ; Thu, 6 Oct 2022 19:22:56 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 014CC10E87F; Thu, 6 Oct 2022 19:22:43 +0000 (UTC) Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by gabe.freedesktop.org (Postfix) with ESMTPS id 2A30B10E87D; Thu, 6 Oct 2022 19:22:37 +0000 (UTC) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CB73AB82150; Thu, 6 Oct 2022 19:22:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E57FCC433D7; Thu, 6 Oct 2022 19:22:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1665084154; bh=YsMh0kWe/OOR+5QG3loglTlzXYtyV8KBcvp4A3mJk5Q=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=BVJCPliSRQiCQnT7Nl1mNjkmwplBTP4CTh/QWA/r38FtWwVGbWjuoeyTvGbaEt5Ep sRnDdxkefmR3TRQULCPjSOp+KRIx0SdZjsp+ZUwI/6z1SIREquHhn84iNiUWZ/igTz lmi1YCbk/hJYZpNCJxUCJML1iHEdri22IlDOWvrI= Date: Thu, 6 Oct 2022 21:23:15 +0200 From: Greg KH To: Zheng Wang Message-ID: References: <20220928033340.1063949-1-zyytlz.wz@163.com> <20221006165845.1735393-1-zyytlz.wz@163.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20221006165845.1735393-1-zyytlz.wz@163.com> Subject: Re: [Intel-gfx] [PATCH v2] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry X-BeenThere: intel-gfx@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel graphics driver community testing & development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: alex000young@gmail.com, security@kernel.org, airlied@linux.ie, intel-gfx@lists.freedesktop.org, hackerzheng666@gmail.com, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, 1002992920@qq.com Errors-To: intel-gfx-bounces@lists.freedesktop.org Sender: "Intel-gfx" On Fri, Oct 07, 2022 at 12:58:45AM +0800, Zheng Wang wrote: > If intel_gvt_dma_map_guest_page failed, it will call > ppgtt_invalidate_spt, which will finally free the spt. > But the caller does not notice that, it will free spt again in error path. > > Fix this by spliting invalidate and free in ppgtt_invalidate_spt. > Only free spt when in good case. > > Reported-by: Zheng Wang > Signed-off-by: Zheng Wang > --- > v2: > - split initial function into two api function suggested by Greg > > v1: https://lore.kernel.org/all/20220928033340.1063949-1-zyytlz.wz@163.com/ > --- > drivers/gpu/drm/i915/gvt/gtt.c | 31 +++++++++++++++++++++---------- > 1 file changed, 21 insertions(+), 10 deletions(-) > > diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c > index ce0eb03709c3..55d8e1419302 100644 > --- a/drivers/gpu/drm/i915/gvt/gtt.c > +++ b/drivers/gpu/drm/i915/gvt/gtt.c > @@ -959,6 +959,7 @@ static inline int ppgtt_put_spt(struct intel_vgpu_ppgtt_spt *spt) > return atomic_dec_return(&spt->refcount); > } > > +static int ppgtt_invalidate_and_free_spt(struct intel_vgpu_ppgtt_spt *spt); Odd extra space after the 'int', why?