2022-11-09 16:01:03

by Dawei Li

[permalink] [raw]
Subject: [PATCH v3] drm/vmwgfx: Fix race issue calling pin_user_pages

pin_user_pages() is unsafe without protection of mmap_lock,
fix it by calling pin_user_pages_fast().

Fixes: 7a7a933edd6c ("drm/vmwgfx: Introduce VMware mks-guest-stats")
Signed-off-by: Dawei Li <[email protected]>
---
v1:
https://lore.kernel.org/all/TYCP286MB23235C9A9FCF85C045F95EA7CA4F9@TYCP286MB2323.JPNP286.PROD.OUTLOOK.COM/

v1->v2:
Rebased to latest vmwgfx/drm-misc-fixes.

v2->v3
Replace pin_user_pages() with pin_user_pages_fast().
---
drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
index 089046fa21be..50fa3df0bc0c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
@@ -1085,21 +1085,21 @@ int vmw_mksstat_add_ioctl(struct drm_device *dev, void *data,
reset_ppn_array(pdesc->strsPPNs, ARRAY_SIZE(pdesc->strsPPNs));

/* Pin mksGuestStat user pages and store those in the instance descriptor */
- nr_pinned_stat = pin_user_pages(arg->stat, num_pages_stat, FOLL_LONGTERM, pages_stat, NULL);
+ nr_pinned_stat = pin_user_pages_fast(arg->stat, num_pages_stat, FOLL_LONGTERM, pages_stat);
if (num_pages_stat != nr_pinned_stat)
goto err_pin_stat;

for (i = 0; i < num_pages_stat; ++i)
pdesc->statPPNs[i] = page_to_pfn(pages_stat[i]);

- nr_pinned_info = pin_user_pages(arg->info, num_pages_info, FOLL_LONGTERM, pages_info, NULL);
+ nr_pinned_info = pin_user_pages_fast(arg->info, num_pages_info, FOLL_LONGTERM, pages_info);
if (num_pages_info != nr_pinned_info)
goto err_pin_info;

for (i = 0; i < num_pages_info; ++i)
pdesc->infoPPNs[i] = page_to_pfn(pages_info[i]);

- nr_pinned_strs = pin_user_pages(arg->strs, num_pages_strs, FOLL_LONGTERM, pages_strs, NULL);
+ nr_pinned_strs = pin_user_pages_fast(arg->strs, num_pages_strs, FOLL_LONGTERM, pages_strs);
if (num_pages_strs != nr_pinned_strs)
goto err_pin_strs;

--
2.25.1



2022-11-09 16:35:14

by Martin Krastev (VMware)

[permalink] [raw]
Subject: Re: [PATCH v3] drm/vmwgfx: Fix race issue calling pin_user_pages

From: Martin Krastev <[email protected]>


Looks great!


Reviewed-by: Martin Krastev <[email protected]>


Regards,
Martin


On 9.11.22 г. 17:37 ч., Dawei Li wrote:
> pin_user_pages() is unsafe without protection of mmap_lock,
> fix it by calling pin_user_pages_fast().
>
> Fixes: 7a7a933edd6c ("drm/vmwgfx: Introduce VMware mks-guest-stats")
> Signed-off-by: Dawei Li <[email protected]>
> ---
> v1:
> https://lore.kernel.org/all/TYCP286MB23235C9A9FCF85C045F95EA7CA4F9@TYCP286MB2323.JPNP286.PROD.OUTLOOK.COM/
>
> v1->v2:
> Rebased to latest vmwgfx/drm-misc-fixes.
>
> v2->v3
> Replace pin_user_pages() with pin_user_pages_fast().
> ---
> drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> index 089046fa21be..50fa3df0bc0c 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> @@ -1085,21 +1085,21 @@ int vmw_mksstat_add_ioctl(struct drm_device *dev, void *data,
> reset_ppn_array(pdesc->strsPPNs, ARRAY_SIZE(pdesc->strsPPNs));
>
> /* Pin mksGuestStat user pages and store those in the instance descriptor */
> - nr_pinned_stat = pin_user_pages(arg->stat, num_pages_stat, FOLL_LONGTERM, pages_stat, NULL);
> + nr_pinned_stat = pin_user_pages_fast(arg->stat, num_pages_stat, FOLL_LONGTERM, pages_stat);
> if (num_pages_stat != nr_pinned_stat)
> goto err_pin_stat;
>
> for (i = 0; i < num_pages_stat; ++i)
> pdesc->statPPNs[i] = page_to_pfn(pages_stat[i]);
>
> - nr_pinned_info = pin_user_pages(arg->info, num_pages_info, FOLL_LONGTERM, pages_info, NULL);
> + nr_pinned_info = pin_user_pages_fast(arg->info, num_pages_info, FOLL_LONGTERM, pages_info);
> if (num_pages_info != nr_pinned_info)
> goto err_pin_info;
>
> for (i = 0; i < num_pages_info; ++i)
> pdesc->infoPPNs[i] = page_to_pfn(pages_info[i]);
>
> - nr_pinned_strs = pin_user_pages(arg->strs, num_pages_strs, FOLL_LONGTERM, pages_strs, NULL);
> + nr_pinned_strs = pin_user_pages_fast(arg->strs, num_pages_strs, FOLL_LONGTERM, pages_strs);
> if (num_pages_strs != nr_pinned_strs)
> goto err_pin_strs;
>

2022-11-28 15:24:30

by Dawei Li

[permalink] [raw]
Subject: Re: [PATCH v3] drm/vmwgfx: Fix race issue calling pin_user_pages

On Wed, Nov 09, 2022 at 11:37:34PM +0800, Dawei Li wrote:
> pin_user_pages() is unsafe without protection of mmap_lock,
> fix it by calling pin_user_pages_fast().
>
> Fixes: 7a7a933edd6c ("drm/vmwgfx: Introduce VMware mks-guest-stats")
> Signed-off-by: Dawei Li <[email protected]>
> ---
> v1:
> https://lore.kernel.org/all/TYCP286MB23235C9A9FCF85C045F95EA7CA4F9@TYCP286MB2323.JPNP286.PROD.OUTLOOK.COM/
>
> v1->v2:
> Rebased to latest vmwgfx/drm-misc-fixes.
>
> v2->v3
> Replace pin_user_pages() with pin_user_pages_fast().

Gentle ping

> ---
> drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> index 089046fa21be..50fa3df0bc0c 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
> @@ -1085,21 +1085,21 @@ int vmw_mksstat_add_ioctl(struct drm_device *dev, void *data,
> reset_ppn_array(pdesc->strsPPNs, ARRAY_SIZE(pdesc->strsPPNs));
>
> /* Pin mksGuestStat user pages and store those in the instance descriptor */
> - nr_pinned_stat = pin_user_pages(arg->stat, num_pages_stat, FOLL_LONGTERM, pages_stat, NULL);
> + nr_pinned_stat = pin_user_pages_fast(arg->stat, num_pages_stat, FOLL_LONGTERM, pages_stat);
> if (num_pages_stat != nr_pinned_stat)
> goto err_pin_stat;
>
> for (i = 0; i < num_pages_stat; ++i)
> pdesc->statPPNs[i] = page_to_pfn(pages_stat[i]);
>
> - nr_pinned_info = pin_user_pages(arg->info, num_pages_info, FOLL_LONGTERM, pages_info, NULL);
> + nr_pinned_info = pin_user_pages_fast(arg->info, num_pages_info, FOLL_LONGTERM, pages_info);
> if (num_pages_info != nr_pinned_info)
> goto err_pin_info;
>
> for (i = 0; i < num_pages_info; ++i)
> pdesc->infoPPNs[i] = page_to_pfn(pages_info[i]);
>
> - nr_pinned_strs = pin_user_pages(arg->strs, num_pages_strs, FOLL_LONGTERM, pages_strs, NULL);
> + nr_pinned_strs = pin_user_pages_fast(arg->strs, num_pages_strs, FOLL_LONGTERM, pages_strs);
> if (num_pages_strs != nr_pinned_strs)
> goto err_pin_strs;
>
> --
> 2.25.1
>

2022-11-29 15:15:04

by Zack Rusin

[permalink] [raw]
Subject: Re: [PATCH v3] drm/vmwgfx: Fix race issue calling pin_user_pages

On Mon, 2022-11-28 at 22:56 +0800, Dawei Li wrote:
> On Wed, Nov 09, 2022 at 11:37:34PM +0800, Dawei Li wrote:
> > pin_user_pages() is unsafe without protection of mmap_lock,
> > fix it by calling pin_user_pages_fast().
> >
> > Fixes: 7a7a933edd6c ("drm/vmwgfx: Introduce VMware mks-guest-stats")
> > Signed-off-by: Dawei Li <[email protected]>
> > ---
> > v1:
> > https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flore.kernel.org%2Fall%2FTYCP286MB23235C9A9FCF85C045F95EA7CA4F9%40TYCP286MB2323.JPNP286.PROD.OUTLOOK.COM%2F&amp;data=05%7C01%7Czackr%40vmware.com%7C7960fb10f8b443e33e4508dad150af04%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C1%7C638052441759507541%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&amp;sdata=N9jdnLfT0kp9KifspFyH2GfmAwnH7NJdQE6255UY5JE%3D&amp;reserved=0
> >
> > v1->v2:
> > Rebased to latest vmwgfx/drm-misc-fixes.
> >
> > v2->v3
> > Replace pin_user_pages() with pin_user_pages_fast().
>
> Gentle ping

Thank you. I've just pushed it to drm-misc-fixes:
https://cgit.freedesktop.org/drm/drm-misc/commit/?h=drm-misc-fixes&id=ed14d225cc7c842f6d4d5a3009f71a44f5852d09
so it's going to find its way upstream soon.

z