From patchwork Wed Nov 30 18:57:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rob Clark X-Patchwork-Id: 27959 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp1105913wrr; Wed, 30 Nov 2022 11:15:10 -0800 (PST) X-Google-Smtp-Source: AA0mqf6KKkyC38lBQofS9p7tey6crA7un4KZ8G+Jvy5GtXBai7XSi7Mt0p1vBpSV6/fb78XY11sJ X-Received: by 2002:a17:906:3ad6:b0:7ae:40b7:7fbe with SMTP id z22-20020a1709063ad600b007ae40b77fbemr51274023ejd.371.1669835709841; Wed, 30 Nov 2022 11:15:09 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669835709; cv=none; d=google.com; s=arc-20160816; b=AKH4CCQ7H/UgtJWlvB9TdUIM5DQ22f9RR5JiXjX/ntz1N/l76hkwNrcM3A1XWBiyPa tO/Cp5WLyFJvBLmF90KN/pW2B/f9kkjyCkRKnSuonNQhCxfVtEx4RVLQYZq4JIPv828r gEcABIjyvXJcAKyKe+LgoruhKvSgmkNwB0mLfje2/UXqAraOUkLjT5A7LGKvHQRFqbMc Vyg4C32EUVShVUBQ8K+ntTnSbE3GKfOO16pRhdOau2qdfUfjf2nyOLU8LnGuym1/nXaY RTtPsTpsixVhTEb+i4dREuwQp7hzQmkp7sFcFzw1oS6wdZHXQEE3hUaQ7x+hHcAgDFVs eijA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=443GVmcToH/y8glGR0fFoR2riM937PfQ5f3l05L3jxo=; b=kgTO2s0DcqTYWdDOfV+FQDZoce0yELw9wxbWRBCVTu7eKoX1HmEKGDnR7PtOv4rFdO lhAOd+nwD7rekyhXVMCX21cBx4fi+VQP9Q+MsdbGHaP6uAutHdfaWfbEldm0LVro8287 BF3bhy/EFuXad8xIekwUAzZV92bifPsX8JljPLEsbzYhjFJmUdGpJAlMJ3FB3wiLy7lj GeWsz6PL+WjL/6VDROFGsGVrkqMQtSCfv+rfAIKmNAmoPuBeFKejoo7Xtd5eoHhokx1m OpWjqzAmHb9vthJT6rhA2b3b+LpVg3SMtO5S0WPQZtn+1T8em5dCaPq29bgM6uU9Yih6 oYow== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=nU5cx5Ze; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id nc13-20020a1709071c0d00b007ae4717bf11si2187215ejc.80.2022.11.30.11.14.42; Wed, 30 Nov 2022 11:15:09 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=nU5cx5Ze; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229823AbiK3S6F (ORCPT + 99 others); Wed, 30 Nov 2022 13:58:05 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48544 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229817AbiK3S55 (ORCPT ); Wed, 30 Nov 2022 13:57:57 -0500 Received: from mail-pl1-x631.google.com (mail-pl1-x631.google.com [IPv6:2607:f8b0:4864:20::631]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D40E543AF9; Wed, 30 Nov 2022 10:57:56 -0800 (PST) Received: by mail-pl1-x631.google.com with SMTP id p24so13868228plw.1; Wed, 30 Nov 2022 10:57:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=443GVmcToH/y8glGR0fFoR2riM937PfQ5f3l05L3jxo=; b=nU5cx5ZeKoq3BQaltqdsx6egPMVueQQzwxAPy9tlM9TmEdoE3QctSFV5PK711ntz+M c3UIPubekuFGIAJW8HGycbOjmB4h5XlOpZK00YpUtvh6TszI58RY4FyR76sBEYXCRpJ3 WZgg06t29/5muKCfY7GxFyilfZ4chVwf2O/4txjgp3U+pS+x1Qcerl0t/Xj0H5uDbMus 1eZR+BfVQZBVA3ctLiURgDnE5yo9nje22jRt3h9ZalnN5DYLS364MiwA9Off5ZZfuIUH dQ+/NB5/sHleF9fmbkuZUsIVWh1L686M/A/wp/lMagmZtzYKlgXvlL7OaT3nBWi1gX2V NFCQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=443GVmcToH/y8glGR0fFoR2riM937PfQ5f3l05L3jxo=; b=hvC+5tA2/sqpZA4Up4o3FqSZjMM1Rvx8W3nH06lHvb+3nkfMOwYefDDkxpzjAcWiqS HSZVGhy/epOcqjlkWqFVwTK/PT5wMCd2GAdbWfZL//b21GFaUANVCIkMYtuNxWrskFe9 aDtPFZN3ztVw/pBwIU4rZP5SEzRIch9/QNf5pk9B+QIYmvB3SKpGrC5ehI+hXO5RNCgz gHhEWLE7nHfiG0zw/IZ1N7zrZT6k+Q8Qf55+93upw1OUzm6Qo+OJ1z1vQPUNFm9UmRGd ko4yaoBK1PvqTPp9a6kLaCwKZpITGiXbS7X9HEfRfe1UzVctAyWq/tUQsxtl7ZC3Q+dO f/jg== X-Gm-Message-State: ANoB5pnMgK3m2xJHkQl4wqrdTKR08YIsI/xlXwr1k1JIwqiqNcLEHvuk gpRvB/ONoNjIJt76DERRCow= X-Received: by 2002:a17:903:2112:b0:188:7dca:6f41 with SMTP id o18-20020a170903211200b001887dca6f41mr43302945ple.72.1669834676369; Wed, 30 Nov 2022 10:57:56 -0800 (PST) Received: from localhost ([2a00:79e1:abd:4a00:2703:3c72:eb1a:cffd]) by smtp.gmail.com with ESMTPSA id d6-20020a170902654600b00188f3970d4asm1823737pln.163.2022.11.30.10.57.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 30 Nov 2022 10:57:56 -0800 (PST) From: Rob Clark To: dri-devel@lists.freedesktop.org Cc: Daniel Vetter , Rob Clark , syzbot+c8ae65286134dd1b800d@syzkaller.appspotmail.com, stable@vger.kernel.org, Daniel Vetter , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Eric Anholt , Rob Herring , =?utf-8?q?Noralf_Tr=C3=B8nnes?= , linux-kernel@vger.kernel.org (open list) Subject: [PATCH v2 1/2] drm/shmem-helper: Remove errant put in error path Date: Wed, 30 Nov 2022 10:57:47 -0800 Message-Id: <20221130185748.357410-2-robdclark@gmail.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221130185748.357410-1-robdclark@gmail.com> References: <20221130185748.357410-1-robdclark@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1750949649168752357?= X-GMAIL-MSGID: =?utf-8?q?1750949649168752357?= From: Rob Clark drm_gem_shmem_mmap() doesn't own this reference, resulting in the GEM object getting prematurely freed leading to a later use-after-free. Link: https://syzkaller.appspot.com/bug?extid=c8ae65286134dd1b800d Reported-by: syzbot+c8ae65286134dd1b800d@syzkaller.appspotmail.com Fixes: 2194a63a818d ("drm: Add library for shmem backed GEM objects") Cc: stable@vger.kernel.org Signed-off-by: Rob Clark Reviewed-by: Daniel Vetter --- drivers/gpu/drm/drm_gem_shmem_helper.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c index 35138f8a375c..3b7b71391a4c 100644 --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -622,10 +622,8 @@ int drm_gem_shmem_mmap(struct drm_gem_shmem_object *shmem, struct vm_area_struct } ret = drm_gem_shmem_get_pages(shmem); - if (ret) { - drm_gem_vm_close(vma); + if (ret) return ret; - } vma->vm_flags |= VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP; vma->vm_page_prot = vm_get_page_prot(vma->vm_flags); From patchwork Wed Nov 30 18:57:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rob Clark X-Patchwork-Id: 27960 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp1105929wrr; Wed, 30 Nov 2022 11:15:11 -0800 (PST) X-Google-Smtp-Source: AA0mqf40RlhxIJe0tq/6fxNViJ8zyfCEtUVEGGG49OYKhPEJVrOxw9eLkTBTbrkU3pvTccvQoLOu X-Received: by 2002:a17:906:194e:b0:7c0:a6c2:fcef with SMTP id b14-20020a170906194e00b007c0a6c2fcefmr2007713eje.671.1669835711800; Wed, 30 Nov 2022 11:15:11 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669835711; cv=none; d=google.com; s=arc-20160816; b=WXp3cuXsPco18MWD0kaAOjpNiUgoOpR1RiNtuCvB2V7YCznjcvLpmZE060AJMFCRjt t0nCZtQ+Rap3A4gCUR6lZEKMmUJSGMUmBEZtiZCkCYkofbA8QJH9TOGHN6vadAprXvJZ NeJ4IiiYKJoP5sjv7GtOjoTOvcJrrTBOzM3NJrcBiRhTapeOF6zzBo6VjzFrpGg5r3Aw 324MW7WSk4vrvRld0hfigZRp7xm119kckb6TS7+YA4bGzGcphCGdfAWMIJEoOfXjMHxY 3HHM3FlmE8mmgqtrlzlVpoGj5pDn9WOjTqtYH5Joedny/oKSPLsSlD5b+ypJg3xNw3Hk 2FAA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=HARMmg9a8K/b5vAg5+2jWHn5nGF+ldiYt0bz7xqmdnE=; b=Zr9q6hsdTOn+x4zGJxcRhUgVF0QF/pHTHuNCCjT4Smnfmh2G0UioZorjKYkv0OFr5/ v95WK6mOythKcL4QlpURWH2vjt8hCpA1I/58rH9FCXhK849hSakdpGIeLOdbWh8f1U4O M7BSKn7Bir0sugwG+CcY1Aeke8iANeVBFwLImJ9dTgk+z/W5cfE447jaBcFRMwJpN8oA Kmpmff3bjTtOo5DEMu+Onx5F9Wje/E04HJoB6fIroEJBQn/Z3sKPMRFkGTZKSzFTmjyj QwV6ENKVan1B7CrB8tijut2AfOzcmCATBBdGXXd2UHbBC3tzTHyDb+6uksahga+7kDni 4wlg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=WGTJiF3y; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id 3-20020a170906328300b007827639faffsi1451697ejw.760.2022.11.30.11.14.46; Wed, 30 Nov 2022 11:15:11 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=WGTJiF3y; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230352AbiK3S6J (ORCPT + 99 others); Wed, 30 Nov 2022 13:58:09 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48722 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230247AbiK3S6C (ORCPT ); Wed, 30 Nov 2022 13:58:02 -0500 Received: from mail-pg1-x530.google.com (mail-pg1-x530.google.com [IPv6:2607:f8b0:4864:20::530]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CE5A94A5A2; Wed, 30 Nov 2022 10:57:58 -0800 (PST) Received: by mail-pg1-x530.google.com with SMTP id 82so9458484pgc.0; Wed, 30 Nov 2022 10:57:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=HARMmg9a8K/b5vAg5+2jWHn5nGF+ldiYt0bz7xqmdnE=; b=WGTJiF3yAhGqZTID6d08gJEXQ4pOpw/F8IW70Fk4DX3/XKK4GX6O6O5z6sEg6z3ZxA nKoCubP1Y5g7MDxpafjnlDV+EId4HA5w7daSh2YvcN6HdV0obI9+UFlyKjmkKYqFR72y gMWy1dzzql8GfeFzdH/WmENL31+zec2xHdtXcCkYXTjR8m3n4QiPg3PrzBzgOcwPIHS6 AaR7qidp6vLsXCgkZT4up/CQ2btS/YTKnCNO3QAxE+f6yYpnKWixbNMgPaXlio5w8zOX hxUDE2u3oizkjBG0c3nPpcxfw2PyzrMLfX65HIkSY8twjcXL4M+p+vy8Z5yNr+rm4yNn JTgA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=HARMmg9a8K/b5vAg5+2jWHn5nGF+ldiYt0bz7xqmdnE=; b=qxgeTRD4kqFhqcCAYiK5nZTLG09+JX8DxDIex1JvgbVZTzcf3EBKgEaVzTOWfq8h4D NsdfoqJ3Jxrn2+LP03ljDUlMEQVWls3lzGbJ76S8vxcmEbVMIIz41acfgEtvOhQ5kwfT 9eLW/+OCQ1i+D0ZlHYNKNADaSr5cq99kIbl/bbVwix88jgzDoppVx4GrCxN+8cobZMwN ujounUfO0wtjY6Xr3pgnBqEZbHsW7YOz717n3EOy3ogHub8TAiNfYOWabhnwwuKR08z3 /XRXgijgjtpVcicSiRx1UFZMCQNiHm8LuZx6KracT+f+rp6VmWSu+tWmSVMZzKMVrwYw W3EQ== X-Gm-Message-State: ANoB5pnTaMuLH63HbNuWao7cpnuF2Uyy8OBWU8VgWxDzyxa/6Wf2/AF/ YjNZ+XrEweP0zQjc95bpGFY= X-Received: by 2002:a63:f506:0:b0:470:14fa:a294 with SMTP id w6-20020a63f506000000b0047014faa294mr37579508pgh.361.1669834678336; Wed, 30 Nov 2022 10:57:58 -0800 (PST) Received: from localhost ([2a00:79e1:abd:4a00:2703:3c72:eb1a:cffd]) by smtp.gmail.com with ESMTPSA id q14-20020aa7842e000000b00575cc2f74ffsm1735664pfn.35.2022.11.30.10.57.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 30 Nov 2022 10:57:57 -0800 (PST) From: Rob Clark To: dri-devel@lists.freedesktop.org Cc: Daniel Vetter , Rob Clark , stable@vger.kernel.org, Daniel Vetter , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Eric Anholt , =?utf-8?q?Noralf_Tr=C3=B8nnes?= , Rob Herring , linux-kernel@vger.kernel.org (open list) Subject: [PATCH v2 2/2] drm/shmem-helper: Avoid vm_open error paths Date: Wed, 30 Nov 2022 10:57:48 -0800 Message-Id: <20221130185748.357410-3-robdclark@gmail.com> X-Mailer: git-send-email 2.38.1 In-Reply-To: <20221130185748.357410-1-robdclark@gmail.com> References: <20221130185748.357410-1-robdclark@gmail.com> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1750949651245977381?= X-GMAIL-MSGID: =?utf-8?q?1750949651245977381?= From: Rob Clark vm_open() is not allowed to fail. Fortunately we are guaranteed that the pages are already pinned, thanks to the initial mmap which is now being cloned into a forked process, and only need to increment the refcnt. So just increment it directly. Previously if a signal was delivered at the wrong time to the forking process, the mutex_lock_interruptible() could fail resulting in the pages_use_count not being incremented. Fixes: 2194a63a818d ("drm: Add library for shmem backed GEM objects") Cc: stable@vger.kernel.org Signed-off-by: Rob Clark Reviewed-by: Daniel Vetter --- drivers/gpu/drm/drm_gem_shmem_helper.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c index 3b7b71391a4c..b602cd72a120 100644 --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -571,12 +571,20 @@ static void drm_gem_shmem_vm_open(struct vm_area_struct *vma) { struct drm_gem_object *obj = vma->vm_private_data; struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj); - int ret; WARN_ON(shmem->base.import_attach); - ret = drm_gem_shmem_get_pages(shmem); - WARN_ON_ONCE(ret != 0); + mutex_lock(&shmem->pages_lock); + + /* + * We should have already pinned the pages when the buffer was first + * mmap'd, vm_open() just grabs an additional reference for the new + * mm the vma is getting copied into (ie. on fork()). + */ + if (!WARN_ON_ONCE(!shmem->pages_use_count)) + shmem->pages_use_count++; + + mutex_unlock(&shmem->pages_lock); drm_gem_vm_open(vma); }