Received: by 2002:a05:6602:18e:0:0:0:0 with SMTP id m14csp1269002ioo; Sun, 22 May 2022 08:58:22 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxXMqVuCYrsksmgeZMeRRf1+kvcHFAJ6hkPzEBTm5xGUcs+TbeN54V3aiDvnRE3duXnAQ42 X-Received: by 2002:a17:906:7313:b0:6f4:9079:2b2a with SMTP id di19-20020a170906731300b006f490792b2amr16270785ejc.377.1653235101845; Sun, 22 May 2022 08:58:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1653235101; cv=none; d=google.com; s=arc-20160816; b=Q391J6AVqBuOzXi7omq/f++rReq9ozTxbxPjRMQiUgGgzRQh1o6whpDwFRExuQGI3W i8ulwcJF9NE7phRfiQsUhAtNGwVprSQX78Fa3H95iLC2yUsTeRjyiCA8dfKZlYG01LA9 8KKiMCWa9iUKBocLQENqExGNXe2qh7Tp+/8F+LDOM+ba+FE2FN5NnkgQzR6f73OWCJIS q2WtvV0w1bzXvkYoMGb25OJtUxNVkcomGaSZp4P1lRL+YIPdz1T3KFiGSBi1VY1bnRmb CrXfwyhOo7iyTUbX2JaS2JHQrAENvR3Osqz1P25AKITHHO+3GGocMQdM5Z32fTiF6e7N 8g2Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=tXDh4EAgfGaP+c5kwrcHeYmbH2BJ0Z/oCbLCNo6vGoM=; b=Vsc0ti9NhCTF3fpZF60z3FiOKJQqwARC1xoBhiD/DJV4dFrROWMdXzH8dSrS9KcSmT LgT/76XZExCKV1lKjYkwgdVhadP+V/j5Ob6r9TfTX+wDm7EacelkPKdSWQOXM0PMg2PV FPbI3T8KDO5QJ41fuGrujW1Aa9U0GKz0c4WslgKigynIxJUSEnTVCgposTG/EnUoV0cv iSHHJRot+soBaVKzBqu6xS5RNEzm3vFIY4YuZ/v8jS6s+fsvs98/FPd3cPoVub1FLSIo TsF+c6DGiVmYyprFTW8Kj+Rq2A7WUAROeCd8c/JlUzLxsVZBvnofBeKUJCmz9LAPpx1V u0Iw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=arm.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id qw11-20020a1709066a0b00b006f3a9502509si3631809ejc.121.2022.05.22.08.57.55; Sun, 22 May 2022 08:58:21 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=arm.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238683AbiESPUU (ORCPT + 99 others); Thu, 19 May 2022 11:20:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57354 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230063AbiESPUO (ORCPT ); Thu, 19 May 2022 11:20:14 -0400 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id D64F4C1EC8 for ; Thu, 19 May 2022 08:20:13 -0700 (PDT) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 9A48614BF; Thu, 19 May 2022 08:20:13 -0700 (PDT) Received: from e122027.cambridge.arm.com (e122027.cambridge.arm.com [10.1.25.23]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 831E33F66F; Thu, 19 May 2022 08:20:11 -0700 (PDT) From: Steven Price To: Rob Herring , Tomeu Vizoso , Alyssa Rosenzweig , Boris Brezillon Cc: Steven Price , Daniel Vetter , David Airlie , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Subject: [PATCH] drm/panfrost: Job should reference MMU not file_priv Date: Thu, 19 May 2022 16:20:03 +0100 Message-Id: <20220519152003.81081-1-steven.price@arm.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org For a while now it's been allowed for a MMU context to outlive it's corresponding panfrost_priv, however the job structure still references panfrost_priv to get hold of the MMU context. If panfrost_priv has been freed this is a use-after-free which I've been able to trigger resulting in a splat. To fix this, drop the reference to panfrost_priv in the job structure and add a direct reference to the MMU structure which is what's actually needed. Fixes: 7fdc48cc63a3 ("drm/panfrost: Make sure MMU context lifetime is not bound to panfrost_priv") Signed-off-by: Steven Price --- drivers/gpu/drm/panfrost/panfrost_drv.c | 5 +++-- drivers/gpu/drm/panfrost/panfrost_job.c | 6 +++--- drivers/gpu/drm/panfrost/panfrost_job.h | 2 +- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/panfrost/panfrost_drv.c b/drivers/gpu/drm/panfrost/panfrost_drv.c index 7fcbc2a5b6cd..087e69b98d06 100644 --- a/drivers/gpu/drm/panfrost/panfrost_drv.c +++ b/drivers/gpu/drm/panfrost/panfrost_drv.c @@ -233,6 +233,7 @@ static int panfrost_ioctl_submit(struct drm_device *dev, void *data, struct drm_file *file) { struct panfrost_device *pfdev = dev->dev_private; + struct panfrost_file_priv *file_priv = file->driver_priv; struct drm_panfrost_submit *args = data; struct drm_syncobj *sync_out = NULL; struct panfrost_job *job; @@ -262,12 +263,12 @@ static int panfrost_ioctl_submit(struct drm_device *dev, void *data, job->jc = args->jc; job->requirements = args->requirements; job->flush_id = panfrost_gpu_get_latest_flush_id(pfdev); - job->file_priv = file->driver_priv; + job->mmu = file_priv->mmu; slot = panfrost_job_get_slot(job); ret = drm_sched_job_init(&job->base, - &job->file_priv->sched_entity[slot], + &file_priv->sched_entity[slot], NULL); if (ret) goto out_put_job; diff --git a/drivers/gpu/drm/panfrost/panfrost_job.c b/drivers/gpu/drm/panfrost/panfrost_job.c index fda5871aebe3..7c4208476fbd 100644 --- a/drivers/gpu/drm/panfrost/panfrost_job.c +++ b/drivers/gpu/drm/panfrost/panfrost_job.c @@ -201,7 +201,7 @@ static void panfrost_job_hw_submit(struct panfrost_job *job, int js) return; } - cfg = panfrost_mmu_as_get(pfdev, job->file_priv->mmu); + cfg = panfrost_mmu_as_get(pfdev, job->mmu); job_write(pfdev, JS_HEAD_NEXT_LO(js), lower_32_bits(jc_head)); job_write(pfdev, JS_HEAD_NEXT_HI(js), upper_32_bits(jc_head)); @@ -435,7 +435,7 @@ static void panfrost_job_handle_err(struct panfrost_device *pfdev, job->jc = 0; } - panfrost_mmu_as_put(pfdev, job->file_priv->mmu); + panfrost_mmu_as_put(pfdev, job->mmu); panfrost_devfreq_record_idle(&pfdev->pfdevfreq); if (signal_fence) @@ -456,7 +456,7 @@ static void panfrost_job_handle_done(struct panfrost_device *pfdev, * happen when we receive the DONE interrupt while doing a GPU reset). */ job->jc = 0; - panfrost_mmu_as_put(pfdev, job->file_priv->mmu); + panfrost_mmu_as_put(pfdev, job->mmu); panfrost_devfreq_record_idle(&pfdev->pfdevfreq); dma_fence_signal_locked(job->done_fence); diff --git a/drivers/gpu/drm/panfrost/panfrost_job.h b/drivers/gpu/drm/panfrost/panfrost_job.h index 77e6d0e6f612..8becc1ba0eb9 100644 --- a/drivers/gpu/drm/panfrost/panfrost_job.h +++ b/drivers/gpu/drm/panfrost/panfrost_job.h @@ -17,7 +17,7 @@ struct panfrost_job { struct kref refcount; struct panfrost_device *pfdev; - struct panfrost_file_priv *file_priv; + struct panfrost_mmu *mmu; /* Fence to be signaled by IRQ handler when the job is complete. */ struct dma_fence *done_fence; -- 2.30.2