Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Dawei Li <set_pte_at@outlook.com>
To:     alexander.deucher@amd.com, christian.koenig@amd.com,
        Xinhui.Pan@amd.com
Cc:     airlied@gmail.com, daniel@ffwll.ch, jglisse@redhat.com,
        amd-gfx@lists.freedesktop.org, dri-devel@lists.freedesktop.org,
        linux-kernel@vger.kernel.org, Dawei Li <set_pte_at@outlook.com>
Subject: [PATCH] drm/radeon: fix potential racing issue due to mmap_lock
Date:   Sun, 13 Nov 2022 20:42:15 +0800
Message-ID: <TYCP286MB232339970F7009B962E2F1BECA029@TYCP286MB2323.JPNP286.PROD.OUTLOOK.COM>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
X-MS-PublicTrafficType: Email
X-MS-TrafficTypeDiagnostic: TYCP286MB2323:EE_|OSZP286MB1558:EE_
X-MS-Office365-Filtering-Correlation-Id: d18a857b-f5f9-47df-e3d5-08dac57485ed
X-MS-Exchange-SLBlob-MailProps: fNPDeqDZc0LhcnwXkCC2ybqWGJ5u/EXML2J5Ddo+QJ5u30gFk+ZKLYkdSu0tTCFt800dTSLcaHk4WFJbwHSYwehJ3096e0EX8MJIcIERgHFXHnYY3YvEkSAFJIvrSi3ZRpAejPSZd0wfoEPFScYbnWpudgW3hf6D3AwD6NJ8Qob2HV89I77mEZbH5oHbgfVXge5bmxyZPGRX4T35jKXG6hF3BMRKk1FAAts/lnn5tiPoIcihVg6sgVLUfihn6H5B+HU04OnCsm3qaUKi4SWSMWIKQp4g/nzlhorKCoGfHcmV/5wp6KM0wHAUWHpA+G+HI1E8fngzyGS+xZszchR5hm+tOJCT+dNduvAGk66z3yhECengGTkxqkSTz9//Jo6//rKEJOZcUx5RlxF0BOYD7aNQI5ZrBXUFaWjkpHCOVpY2FzyKuKd/UuLuhQXK4nlmSnpTi3fjP5nMTHxpDdnUankNJEYnVoa+4gkOR79bXHV1aHsHtw1v+kECZqaR3Rpk8aI4bAH/+diwMDubooQVEs3zfCBMedM6HozXcQZDO9WwFCCX6tqDxPLeaRFs1B7To6m0EbgtHwcPgXyZ4qLNl2UufXmp78UZXyChOoct/xDu6NCJ9MWpt8DvElnl4rdRC+1/CbfdT7id7/BsuHlrEwDkBvRDrz7IkE/z32jLNBw8xOOLG+ysLwDK8KgiENkIB8rZOf4LK3V6ErcbAvgE1Ly1xtd+AsoG79K6PAUmK7w++DJgzqJKs2Ysod8HTtjUv9jK7QnXEOM5odAetIIeXg==
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: 0/I8NVe4zX4XdR2qmsgQAucQngA9KUWcN4A/KohD1EdIB+Og3krFZYbYBZZTqMwhia2fjBmSlFJAeuz6awbqt92Zw/641J+3KLQ185LDPdKIjQscE0XkW6NJ/AxNZHYjrlOhxcah0L70elBVhaQEoRGT4RGyZuvfL/oE6AEXxTntnStvgNRJJVxufLr8z7azp92JIa9vdBInWJdC/e3aooUSl7iAuCzkXmD54MmDf+jIj31rao5GL/aC3wCyuHTInvHHKXSTfWOl/1+isx5ch/mLCxNiXy98pPKQ5hKOhthS0sVIA5bJyAiiEahL2u0q1etVZjjR2hT4f5XoRLrNydADsmaLRAzJdQwGsYcOETFG0DrehlQkzhdbHCgRTEGF57L9vOlWKELyhchAH2CVpmPXZcrWuLcGr4H9u71dte+5NA7k3MqqWPwQDcD3tJ4RXlmvVgU2X4iEHCPL0JtVbM1T7c/nRWGKe8SKAciWx/Buugbyf2CZ6S0YrICVGiZBmgaSgYK5qxoIS/4oXRAy/T338NhxVnidJH7jnGwKPqinNBFNsayqqED/Z3DpCazEErFPgL/UOjnYiskEKW4wV27nfxJl1nYPf1fvksDKNM5adTeBhe9P+yC2cAL3hosg8NUWlyUbXjE4oGxmm485Ftp/uyG5s0hD2+hrT2ZuaIYRnf8h2fSzNjx3tZ2ftuLD
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?t3mjIGZkgsc+5fuYUI9xzct9v+o2yzb6tvygltnICeQQCM5KxtUmN31pkec5?=
 =?us-ascii?Q?ES0nhyXsJAk1QC8iN1/WlxjVU22lOo9zU4YAVX/Pi5BFBjVSHS6XLEzThjPI?=
 =?us-ascii?Q?v3OPf18g2ZaP6zB34HgbSEFDXOHf9q446WaqHaGyJQ2omUmQv2cfqevdfpap?=
 =?us-ascii?Q?27TAJPuyWe0JRL1weZZGE0xMLy3GkZqM2BeT2SjMiGTzbpIv9cwYdnS/kXK2?=
 =?us-ascii?Q?a0mI2zJqSAj7X1gEjQrlLVkXh0+GH7CgIUXK5qQi0xh9Ngr7gM2n95MbqTyZ?=
 =?us-ascii?Q?GtLLIRcTJz7e1udZWkBrGiaEEZq1IvOzI9Y7GJE+tPVQr2ZLoZDiZMl9YZiQ?=
 =?us-ascii?Q?h7ixvP225b2pTn5LiayFgBAwhV1KyhzDswkxQDPhhMwCCciQiKnELy9hMk61?=
 =?us-ascii?Q?H1e7mTHbNQHtWdkjHNqEEMoOL/txxb9f/eWIHSuhOHXkOI1I69n5UUNTDFQG?=
 =?us-ascii?Q?Ta01BG1gc9YueutcSuTZQc06cmYDBpBU2MXq/c0Tvp+gTQdgs0PvZ3tMREFt?=
 =?us-ascii?Q?5raO1H8+k8gIeb2PtCtTiKP5bzzp77T8Sth6LYvClB1G9U0gimFlphG68nc2?=
 =?us-ascii?Q?TQd9E3j4DoIvqSLNhJfkKWbH7iGeOCu1LgFyVoN7jN7VWY22UAq4EW5zcycg?=
 =?us-ascii?Q?btoAk2lYOfOj5Er38lpepXxaYs6YoXUvV/RIS6OwKOLsF/vgMtdnAI59RcQl?=
 =?us-ascii?Q?wPAeZ8IHpY8/7V1m6qIktznBZkE+hF97phbVobxhSeV10VXyvSxFTRXSRqg2?=
 =?us-ascii?Q?4rcaVVo8p8aM0tJjGiVyaEKFlM+Dico5gDo7zqpoRWQKYbURFqdrkAsfSKXD?=
 =?us-ascii?Q?eYO/Tyijcz86I55LMQHMSbNYcRTZzmXQcfwKkwaVd+V9yDNBdSU4Se6eP2wG?=
 =?us-ascii?Q?JHr3s6PSP8zMsD5eo5RkF7kUaG/BhAO4luQUZH1PkRzta9NsxdXqDaU29vj9?=
 =?us-ascii?Q?QMaYQqlR53HpOlivcj7Wem+izu8XDac0o07jlHwQK/UwY9/ZkkX7P1KWaH6y?=
 =?us-ascii?Q?jB5demSKC+vXigItmUGHus8j+I0TvAMrvDmmMXkFVRFIwpAqK+tLN9PUvIHR?=
 =?us-ascii?Q?6Og3P3m4C/1L7UzbjNSXQCSaviQqV5r9RZKahx2mdXV1mlABJky8GtnnsxoZ?=
 =?us-ascii?Q?1bHuSng6l3U3AfI7qSELLIxQL1l73j49ZefYWWmySrinFIUKgo3Au9dLYw0a?=
 =?us-ascii?Q?/qqIg+//fRfeKBDJB1j/zFzJjomebt3x4prX0SbwohrF32zuErD0bNJC95f4?=
 =?us-ascii?Q?VmDYFqYnbapjk5W0mW5OGA0H4LSdWZ3SsQ7MHpWoKQ=3D=3D?=
X-OriginatorOrg: outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d18a857b-f5f9-47df-e3d5-08dac57485ed
X-MS-Exchange-CrossTenant-AuthSource: TYCP286MB2323.JPNP286.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Nov 2022 12:42:28.2384
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 84df9e7f-e9f6-40af-b435-aaaaaaaaaaaa
X-MS-Exchange-CrossTenant-RMS-PersistedConsumerOrg: 00000000-0000-0000-0000-000000000000
X-MS-Exchange-Transport-CrossTenantHeadersStamped: OSZP286MB1558
X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,
        RCVD_IN_DNSWL_NONE,SPF_HELO_PASS,SPF_PASS autolearn=ham
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Both find_vma() and get_user_pages() need explicit protection of
mmap lock, fix them by mmap_lock and get_user_pages_fast().

Fixes: ddd00e33e17a ("drm/radeon: add userptr flag to limit it to anonymous memory v2")
Fixes: f72a113a71ab ("drm/radeon: add userptr support v8")
Signed-off-by: Dawei Li <set_pte_at@outlook.com>
---
 drivers/gpu/drm/radeon/radeon_ttm.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index d33fec488713..741ea64b9402 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -351,7 +351,10 @@ static int radeon_ttm_tt_pin_userptr(struct ttm_device *bdev, struct ttm_tt *ttm
 		   to prevent problems with writeback */
 		unsigned long end = gtt->userptr + (u64)ttm->num_pages * PAGE_SIZE;
 		struct vm_area_struct *vma;
+
+		mmap_read_lock(gtt->usermm);
 		vma = find_vma(gtt->usermm, gtt->userptr);
+		mmap_read_unlock(gtt->usermm);
 		if (!vma || vma->vm_file || vma->vm_end < end)
 			return -EPERM;
 	}
@@ -361,8 +364,7 @@ static int radeon_ttm_tt_pin_userptr(struct ttm_device *bdev, struct ttm_tt *ttm
 		uint64_t userptr = gtt->userptr + pinned * PAGE_SIZE;
 		struct page **pages = ttm->pages + pinned;
 
-		r = get_user_pages(userptr, num_pages, write ? FOLL_WRITE : 0,
-				   pages, NULL);
+		r = get_user_pages_fast(userptr, num_pages, write ? FOLL_WRITE : 0, pages);
 		if (r < 0)
 			goto release_pages;
 
-- 
2.25.1