Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2742fa12 authored by shaohanlin's avatar shaohanlin
Browse files

Merge SPL 2021-05-05 into mp 

* origin/8901-fp3-q-mp-release-spl-202105:
  msm:ADSPRPC :Fix to avoid Use after free in fastrpc_internal_munmap
  msm: kgsl: Deregister gpu address on memdesc_sg_virt failure
  msm: kgsl: Stop using memdesc->usermem
  tty: Fix ->pgrp locking in tiocspgrp()
Change-Id: I79fda460e15d228f107e77f76621ff1ccc1ec6f1
parents ddc9e8e8 facfb22a

drivers/char/adsprpc.c

+9 −7
Original line number Diff line number Diff line
@@ -2728,6 +2728,7 @@ static int fastrpc_internal_munmap(struct fastrpc_file *fl, 
	mutex_unlock(&fl->fl_map_mutex);

	if (err)

		goto bail;

	if (map) {

		VERIFY(err, !fastrpc_munmap_on_dsp(fl, map->raddr,

					map->phys, map->size, map->flags));

		if (err)
@@ -2735,6 +2736,7 @@ static int fastrpc_internal_munmap(struct fastrpc_file *fl, 
		mutex_lock(&fl->fl_map_mutex);

		fastrpc_mmap_free(map, 0);

		mutex_unlock(&fl->fl_map_mutex);

	}

bail:

	if (err && map) {

		mutex_lock(&fl->fl_map_mutex);

drivers/gpu/msm/kgsl.c

+42 −28
Original line number Diff line number Diff line
@@ -265,6 +265,7 @@ kgsl_mem_entry_create(void) 
		kref_get(&entry->refcount);

	}



	atomic_set(&entry->map_count, 0);

	return entry;

}

#ifdef CONFIG_DMA_SHARED_BUFFER
@@ -459,9 +460,6 @@ static void kgsl_mem_entry_detach_process(struct kgsl_mem_entry *entry) 
	type = kgsl_memdesc_usermem_type(&entry->memdesc);

	entry->priv->stats[type].cur -= entry->memdesc.size;



	if (type != KGSL_MEM_ENTRY_ION)

		entry->priv->gpumem_mapped -= entry->memdesc.mapsize;



	spin_unlock(&entry->priv->mem_lock);



	kgsl_mmu_put_gpuaddr(&entry->memdesc);
@@ -2124,7 +2122,7 @@ static int check_vma(unsigned long hostptr, u64 size) 
	return true;

}



static int memdesc_sg_virt(struct kgsl_memdesc *memdesc)

static int memdesc_sg_virt(struct kgsl_memdesc *memdesc, unsigned long useraddr)

{

	int ret = 0;

	long npages = 0, i;
@@ -2147,13 +2145,13 @@ static int memdesc_sg_virt(struct kgsl_memdesc *memdesc) 
	}



	down_read(&current->mm->mmap_sem);

	if (!check_vma(memdesc->useraddr, memdesc->size)) {

	if (!check_vma(useraddr, memdesc->size)) {

		up_read(&current->mm->mmap_sem);

		ret = -EFAULT;

		goto out;

	}



	npages = get_user_pages(memdesc->useraddr,

	npages = get_user_pages(useraddr,

				sglen, write, pages, NULL);

	up_read(&current->mm->mmap_sem);
@@ -2186,29 +2184,34 @@ static int kgsl_setup_anon_useraddr(struct kgsl_pagetable *pagetable, 
{

	/* Map an anonymous memory chunk */



	int ret;



	if (size == 0 || offset != 0 ||

		!IS_ALIGNED(size, PAGE_SIZE))

		return -EINVAL;



	entry->memdesc.pagetable = pagetable;

	entry->memdesc.size = (uint64_t) size;

	entry->memdesc.useraddr = hostptr;

	entry->memdesc.flags |= (uint64_t)KGSL_MEMFLAGS_USERMEM_ADDR;



	if (kgsl_memdesc_use_cpu_map(&entry->memdesc)) {

		int ret;



		/* Register the address in the database */

		ret = kgsl_mmu_set_svm_region(pagetable,

			(uint64_t) entry->memdesc.useraddr, (uint64_t) size);

			(uint64_t) hostptr, (uint64_t) size);



		if (ret)

			return ret;



		entry->memdesc.gpuaddr = (uint64_t)  entry->memdesc.useraddr;

		entry->memdesc.gpuaddr = (uint64_t) hostptr;

	}



	return memdesc_sg_virt(&entry->memdesc);

	ret = memdesc_sg_virt(&entry->memdesc, hostptr);



	if (ret && kgsl_memdesc_use_cpu_map(&entry->memdesc))

		kgsl_mmu_put_gpuaddr(&entry->memdesc);



	return ret;

}



#ifdef CONFIG_DMA_SHARED_BUFFER
@@ -2293,8 +2296,7 @@ static int kgsl_setup_dmabuf_useraddr(struct kgsl_device *device, 
		return ret;

	}



	/* Setup the user addr/cache mode for cache operations */

	entry->memdesc.useraddr = hostptr;

	/* Setup the cache mode for cache operations */

	_setup_cache_mode(entry, vma);

	up_read(&current->mm->mmap_sem);

	return 0;
@@ -3307,7 +3309,12 @@ long kgsl_ioctl_gpumem_get_info(struct kgsl_device_private *dev_priv, 
	param->flags = (unsigned int) entry->memdesc.flags;

	param->size = (size_t) entry->memdesc.size;

	param->mmapsize = (size_t) kgsl_memdesc_footprint(&entry->memdesc);

	param->useraddr = entry->memdesc.useraddr;

	/*

	 * Entries can have multiple user mappings so thre isn't any one address

	 * we can report. Plus, the user should already know their mappings, so

	 * there isn't any value in reporting it back to them.

	 */

	param->useraddr = 0;



	kgsl_mem_entry_put(entry);

	return result;
@@ -3776,9 +3783,6 @@ static int _sparse_bind(struct kgsl_process_private *process, 
	if (memdesc->gpuaddr)

		return -EINVAL;



	if (memdesc->useraddr != 0)

		return -EINVAL;



	pagetable = memdesc->pagetable;



	/* Clear out any mappings */
@@ -4058,7 +4062,12 @@ long kgsl_ioctl_gpuobj_info(struct kgsl_device_private *dev_priv, 
	param->flags = entry->memdesc.flags;

	param->size = entry->memdesc.size;

	param->va_len = kgsl_memdesc_footprint(&entry->memdesc);

	param->va_addr = (uint64_t) entry->memdesc.useraddr;

	/*

	 * Entries can have multiple user mappings so thre isn't any one address

	 * we can report. Plus, the user should already know their mappings, so

	 * there isn't any value in reporting it back to them.

	 */

	param->va_addr = 0;



	kgsl_mem_entry_put(entry);

	return 0;
@@ -4165,24 +4174,21 @@ static void kgsl_gpumem_vm_open(struct vm_area_struct *vma) 


	if (kgsl_mem_entry_get(entry) == 0)

		vma->vm_private_data = NULL;



	atomic_inc(&entry->map_count);

}



static int

kgsl_gpumem_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)

{

	struct kgsl_mem_entry *entry = vma->vm_private_data;

	int ret;



	if (!entry)

		return VM_FAULT_SIGBUS;

	if (!entry->memdesc.ops || !entry->memdesc.ops->vmfault)

		return VM_FAULT_SIGBUS;



	ret = entry->memdesc.ops->vmfault(&entry->memdesc, vma, vmf);

	if ((ret == 0) || (ret == VM_FAULT_NOPAGE))

		entry->priv->gpumem_mapped += PAGE_SIZE;



	return ret;

	return entry->memdesc.ops->vmfault(&entry->memdesc, vma, vmf);

}



static void
@@ -4193,7 +4199,13 @@ kgsl_gpumem_vm_close(struct vm_area_struct *vma) 
	if (!entry)

		return;



	entry->memdesc.useraddr = 0;

	/*

	 * Remove the memdesc from the mapped stat once all the mappings have

	 * gone away

	 */

	if (!atomic_dec_return(&entry->map_count))

		entry->priv->gpumem_mapped -= entry->memdesc.size;



	kgsl_mem_entry_put(entry);

}
@@ -4232,7 +4244,8 @@ get_mmap_entry(struct kgsl_process_private *private, 
		}

	}



	if (entry->memdesc.useraddr != 0) {

	/* Don't allow ourselves to remap user memory */

	if (entry->memdesc.flags & KGSL_MEMFLAGS_USERMEM_ADDR) {

		ret = -EBUSY;

		goto err_put;

	}
@@ -4557,9 +4570,10 @@ static int kgsl_mmap(struct file *file, struct vm_area_struct *vma) 


	vma->vm_file = file;



	entry->memdesc.useraddr = vma->vm_start;

	if (atomic_inc_return(&entry->map_count) == 1)

		entry->priv->gpumem_mapped += entry->memdesc.size;



	trace_kgsl_mem_mmap(entry);

	trace_kgsl_mem_mmap(entry, vma->vm_start);

	return 0;

}

drivers/gpu/msm/kgsl.h

+5 −4
Original line number Diff line number Diff line
@@ -205,11 +205,9 @@ struct kgsl_memdesc_ops { 
 * @pagetable: Pointer to the pagetable that the object is mapped in

 * @hostptr: Kernel virtual address

 * @hostptr_count: Number of threads using hostptr

 * @useraddr: User virtual address (if applicable)

 * @gpuaddr: GPU virtual address

 * @physaddr: Physical address of the memory object

 * @size: Size of the memory object

 * @mapsize: Size of memory mapped in userspace

 * @priv: Internal flags and settings

 * @sgt: Scatter gather table for allocated pages

 * @ops: Function hooks for the memdesc memory type
@@ -224,11 +222,9 @@ struct kgsl_memdesc { 
	struct kgsl_pagetable *pagetable;

	void *hostptr;

	unsigned int hostptr_count;

	unsigned long useraddr;

	uint64_t gpuaddr;

	phys_addr_t physaddr;

	uint64_t size;

	uint64_t mapsize;

	unsigned int priv;

	struct sg_table *sgt;

	struct kgsl_memdesc_ops *ops;
@@ -286,6 +282,11 @@ struct kgsl_mem_entry { 
	struct work_struct work;

	spinlock_t bind_lock;

	struct rb_root bind_tree;

	/*

	 * @map_count: Count how many vmas this object is mapped in - used for

	 * debugfs accounting

	 */

	atomic_t map_count;

};



struct kgsl_device_private;

drivers/gpu/msm/kgsl_debugfs.c

+14 −6
Original line number Diff line number Diff line
@@ -152,7 +152,11 @@ static int print_mem_entry(void *data, void *ptr) 
	flags[3] = get_alignflag(m);

	flags[4] = get_cacheflag(m);

	flags[5] = kgsl_memdesc_use_cpu_map(m) ? 'p' : '-';

	flags[6] = (m->useraddr) ? 'Y' : 'N';

	/*

	 * Show Y if at least one vma has this entry

	 * mapped (could be multiple)

	 */

	flags[6] = atomic_read(&entry->map_count) ? 'Y' : 'N';

	flags[7] = kgsl_memdesc_is_secured(m) ?  's' : '-';

	flags[8] = m->flags & KGSL_MEMFLAGS_SPARSE_PHYS ? 'P' : '-';

	flags[9] = '\0';
@@ -163,12 +167,16 @@ static int print_mem_entry(void *data, void *ptr) 
		kgsl_get_egl_counts(entry, &egl_surface_count,

						&egl_image_count);



	seq_printf(s, "%pK %pK %16llu %5d %9s %10s %16s %5d %16llu %6d %6d",

	seq_printf(s, "%pK %d %16llu %5d %9s %10s %16s %5d %16d %6d %6d",

			(uint64_t *)(uintptr_t) m->gpuaddr,

			(unsigned long *) m->useraddr,

			m->size, entry->id, flags,

			/*

			 * Show zero for the useraddr - we can't reliably track

			 * that value for multiple vmas anyway

			 */

			0, m->size, entry->id, flags,

			memtype_str(usermem_type),

			usage, (m->sgt ? m->sgt->nents : 0), m->mapsize,

			usage, (m->sgt ? m->sgt->nents : 0),

			atomic_read(&entry->map_count),

			egl_surface_count, egl_image_count);



	if (entry->metadata[0] != 0)
@@ -239,7 +247,7 @@ static int process_mem_seq_show(struct seq_file *s, void *ptr) 
	if (ptr == SEQ_START_TOKEN) {

		seq_printf(s, "%16s %16s %16s %5s %9s %10s %16s %5s %16s %6s %6s\n",

			"gpuaddr", "useraddr", "size", "id", "flags", "type",

			"usage", "sglen", "mapsize", "eglsrf", "eglimg");

			"usage", "sglen", "mapcount", "eglsrf", "eglimg");

		return 0;

	} else

		return print_mem_entry(s, ptr);

drivers/gpu/msm/kgsl_mmu.c

+3 −2
Original line number Diff line number Diff line 
/* Copyright (c) 2002,2007-2017, The Linux Foundation. All rights reserved.

/* Copyright (c) 2002,2007-2017,2021, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -439,7 +439,8 @@ void kgsl_mmu_put_gpuaddr(struct kgsl_memdesc *memdesc) 
	if (memdesc->size == 0 || memdesc->gpuaddr == 0)

		return;



	if (!kgsl_memdesc_is_global(memdesc))

	if (!kgsl_memdesc_is_global(memdesc) &&

			 (KGSL_MEMDESC_MAPPED & memdesc->priv))

		unmap_fail = kgsl_mmu_unmap(pagetable, memdesc);



	/*