Received: by 2002:a25:d7c1:0:0:0:0:0 with SMTP id o184csp2252574ybg; Sun, 27 Oct 2019 14:26:23 -0700 (PDT) X-Google-Smtp-Source: APXvYqzNvxGz2WEUcyrBZt5fEE3kcic8xzyoZqTrWCHmwJ+vzTEnNMx0ZfJ7uyGiVdoxKynf1inS X-Received: by 2002:aa7:cc18:: with SMTP id q24mr15963450edt.150.1572211583070; Sun, 27 Oct 2019 14:26:23 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1572211583; cv=none; d=google.com; s=arc-20160816; b=wuhYqYqQaUxDIRQSCdjM6eVxXq4c+rHQvbk7V+3qlWrJ+75OjR+8F0LF7d6T5oH3so 3iupybZpBNeqwSZ/Ha/vO0mdTUDBuWzVKGvOhkNuLuM7DLVSC6XqT/WbiF3mi/3FDOeD Rh1EZ8aS0NAwfDvo5mE/JI503656mic4vtBtCxAusGSb2sWEIX27kM1Lk0C/2CJWJrHP DrscXOfbx2kG8q9zbbunlO7XQzjOIvsB36zp+yW/Uassom5ZiV3RSADG3xjxGMf3BhUx fqPbgnay9ZCcfknO/1IOVlQG4xEiSFhLr7/RP0cNM7PaVUdmCN+y2v5dS80QrmSVAn5B urmA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=626UcSMFJoctJPUoKVQ6BdyjqTPGwrR9+SA06tFXQ8c=; b=aUxNGgC8N439Nvi8BVgRRQjsZCywIfQjBeJLrJF6Wt0WP+03mUh86ThJZwlvu9SWg2 Ev0GR49hq4GWEja6zM1MmHZ0SN3a+uNIM69qvlfBJjb1/JK/zc0HRlF6fQp+NiNmcrz6 NNPSFKW0g6MDg0hWyzAUhNKZyN2oNggcotXJMmjgKoYUywFGCCRaRivW6B2HSyLKMLpL 45zECLqrF0vX84ZULViZnBFvfmUWocwk9Ec+yl5RIvCSRIu7hqVmGNm2b1Bre6wJqmx2 izSSPoCx+KvJyAFRodJ2FiJNxEHnLktOBcF5EgfP8bfX/JYza8QxN7CE76zNRuobm/Bg V8EA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=wOiZoxwK; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id h12si4931246ejj.40.2019.10.27.14.25.59; Sun, 27 Oct 2019 14:26:23 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=wOiZoxwK; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732531AbfJ0VYb (ORCPT + 99 others); Sun, 27 Oct 2019 17:24:31 -0400 Received: from mail.kernel.org ([198.145.29.99]:46106 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732524AbfJ0VY3 (ORCPT ); Sun, 27 Oct 2019 17:24:29 -0400 Received: from localhost (100.50.158.77.rev.sfr.net [77.158.50.100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0C9F521848; Sun, 27 Oct 2019 21:24:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1572211468; bh=ducbvbvTebvGptEQe/6xKp5AEyQgn3Bc0/DQdWbjwVY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wOiZoxwKEsxRVSZTjTOmDVrPfr3Ccaeb4/NfrntDLWPz1OF4pc50GoPpW2gqQGSJ5 Z7EYcDoiUlBmpbKrJsPH3r3IAfjPLqOblS9E+JRCA3c1802xKoN721Ofq+0svsSSx/ qpuoejKqjE5XJQAF7vgGGlSFROy/IklwtRbpyO+U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Philip Yang , Joe Barnett , =?UTF-8?q?Christian=20K=C3=B6nig?= , Felix Kuehling , Alex Deucher Subject: [PATCH 5.3 135/197] drm/amdgpu: user pages array memory leak fix Date: Sun, 27 Oct 2019 22:00:53 +0100 Message-Id: <20191027203359.001669494@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191027203351.684916567@linuxfoundation.org> References: <20191027203351.684916567@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Philip Yang commit 209620b422945ee03cebb03f726e706d537b692d upstream. user_pages array should always be freed after validation regardless if user pages are changed after bo is created because with HMM change parse bo always allocate user pages array to get user pages for userptr bo. v2: remove unused local variable and amend commit v3: add back get user pages in gem_userptr_ioctl, to detect application bug where an userptr VMA is not ananymous memory and reject it. Bugzilla: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1844962 Signed-off-by: Philip Yang Tested-by: Joe Barnett Reviewed-by: Christian König Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 5.3 Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c @@ -536,7 +536,6 @@ static int amdgpu_cs_list_validate(struc list_for_each_entry(lobj, validated, tv.head) { struct amdgpu_bo *bo = ttm_to_amdgpu_bo(lobj->tv.bo); - bool binding_userptr = false; struct mm_struct *usermm; usermm = amdgpu_ttm_tt_get_usermm(bo->tbo.ttm); @@ -553,7 +552,6 @@ static int amdgpu_cs_list_validate(struc amdgpu_ttm_tt_set_user_pages(bo->tbo.ttm, lobj->user_pages); - binding_userptr = true; } if (p->evictable == lobj) @@ -563,10 +561,8 @@ static int amdgpu_cs_list_validate(struc if (r) return r; - if (binding_userptr) { - kvfree(lobj->user_pages); - lobj->user_pages = NULL; - } + kvfree(lobj->user_pages); + lobj->user_pages = NULL; } return 0; }