lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.14 374/849] drm/ttm: stop calling tt_swapin in vm_access
    Date
    From: Matthew Auld <matthew.auld@intel.com>

    [ Upstream commit f5d28856b89baab4232a9f841e565763fcebcdf9 ]

    In commit:

    commit 09ac4fcb3f255e9225967c75f5893325c116cdbe
    Author: Felix Kuehling <Felix.Kuehling@amd.com>
    Date: Thu Jul 13 17:01:16 2017 -0400

    drm/ttm: Implement vm_operations_struct.access v2

    we added the vm_access hook, where we also directly call tt_swapin for
    some reason. If something is swapped-out then the ttm_tt must also be
    unpopulated, and since access_kmap should also call tt_populate, if
    needed, then swapping-in will already be handled there.

    If anything, calling tt_swapin directly here would likely always fail
    since the tt->pages won't yet be populated, or worse since the tt->pages
    array is never actually cleared in unpopulate this might lead to a nasty
    uaf.

    Fixes: 09ac4fcb3f25 ("drm/ttm: Implement vm_operations_struct.access v2")
    Signed-off-by: Matthew Auld <matthew.auld@intel.com>
    Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Cc: Christian König <christian.koenig@amd.com>
    Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20210927114114.152310-1-matthew.auld@intel.com
    Signed-off-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/gpu/drm/ttm/ttm_bo_vm.c | 5 -----
    1 file changed, 5 deletions(-)

    diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c
    index f56be5bc0861e..5b9b7fd01a692 100644
    --- a/drivers/gpu/drm/ttm/ttm_bo_vm.c
    +++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c
    @@ -519,11 +519,6 @@ int ttm_bo_vm_access(struct vm_area_struct *vma, unsigned long addr,

    switch (bo->resource->mem_type) {
    case TTM_PL_SYSTEM:
    - if (unlikely(bo->ttm->page_flags & TTM_PAGE_FLAG_SWAPPED)) {
    - ret = ttm_tt_swapin(bo->ttm);
    - if (unlikely(ret != 0))
    - return ret;
    - }
    fallthrough;
    case TTM_PL_TT:
    ret = ttm_bo_vm_access_kmap(bo, offset, buf, len, write);
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-16 02:40    [W:4.045 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site