diff options
| author | Matthew Auld <matthew.auld@intel.com> | 2022-11-07 16:54:14 +0000 |
|---|---|---|
| committer | Matthew Auld <matthew.auld@intel.com> | 2022-11-08 09:58:45 +0000 |
| commit | ccb0e02787d0f80d0081c446aec3756dd8f7bfe0 (patch) | |
| tree | 4ccdf3e23a7894e121afe2a7d8db3656c8ad864a | |
| parent | 625b74460ec0978979f883fbee117e1b97e6e35e (diff) | |
| download | linux-ccb0e02787d0f80d0081c446aec3756dd8f7bfe0.tar.gz linux-ccb0e02787d0f80d0081c446aec3756dd8f7bfe0.tar.bz2 linux-ccb0e02787d0f80d0081c446aec3756dd8f7bfe0.zip | |
drm/i915/ttm: add some sanity checks for lmem_userfault_list
Rather than getting some hard to debug uaf, add some warns to hopefully
catch issues with userfault_count being non-zero when destroying the
object. Also if we somehow add an object to lmem_userfault_list that
somehow doesn't map lmem.
References: https://gitlab.freedesktop.org/drm/intel/-/issues/7469
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Anshuman Gupta <anshuman.gupta@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Cc: Andrzej Hajda <andrzej.hajda@intel.com>
Cc: Nirmoy Das <nirmoy.das@intel.com>
Reviewed-by: Andrzej Hajda <andrzej.hajda@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20221107165414.56970-2-matthew.auld@intel.com
| -rw-r--r-- | drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c index 9421dc4dc98f..2c8b2d5ae903 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c @@ -1098,6 +1098,8 @@ static vm_fault_t vm_fault_ttm(struct vm_fault *vmf) spin_lock(&to_i915(obj->base.dev)->runtime_pm.lmem_userfault_lock); list_add(&obj->userfault_link, &to_i915(obj->base.dev)->runtime_pm.lmem_userfault_list); spin_unlock(&to_i915(obj->base.dev)->runtime_pm.lmem_userfault_lock); + + GEM_WARN_ON(!i915_ttm_cpu_maps_iomem(bo->resource)); } if (wakeref & CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND) @@ -1180,6 +1182,8 @@ static void i915_ttm_unmap_virtual(struct drm_i915_gem_object *obj) } } + GEM_WARN_ON(obj->userfault_count); + ttm_bo_unmap_virtual(i915_gem_to_ttm(obj)); if (wakeref) |