Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7e0a3f13 authored by Archana Sriram's avatar Archana Sriram
Browse files

msm: kgsl: Compare pid pointer instead of TGID for a new process 



There is a possibility of sharing process_private between two unrelated
processes due to PID wrapping. In kgsl_process_private_new(), instead
of checking numeric TGID, compare the unique pid pointer of the current
process with that of the existing processes in kgsl process list to
allow sharing of process_private data judiciously. Also, in all required
functions get TGID/PID of a process from its struct pid.

Change-Id: I0e3d5d79275cdb3f3c304fb36322ad56b0d0b227
Signed-off-by: default avatarArchana Sriram <apsrir@codeaurora.org>
parent 51e4e553

drivers/gpu/msm/adreno_debugfs.c

+1 −1
Original line number Diff line number Diff line
@@ -291,7 +291,7 @@ static int ctx_print(struct seq_file *s, void *unused) 
		   ctx_type_str(drawctxt->type),

		   drawctxt->base.priority,

		   drawctxt->base.proc_priv->comm,

		   drawctxt->base.proc_priv->pid,

		   pid_nr(drawctxt->base.proc_priv->pid),

		   drawctxt->base.tid);



	seq_puts(s, "flags: ");

drivers/gpu/msm/adreno_dispatch.c

+1 −1
Original line number Diff line number Diff line
@@ -1671,7 +1671,7 @@ static inline const char *_kgsl_context_comm(struct kgsl_context *context) 
#define pr_fault(_d, _c, fmt, args...) \

		dev_err((_d)->dev, "%s[%d]: " fmt, \

		_kgsl_context_comm((_c)->context), \

		(_c)->context->proc_priv->pid, ##args)

		pid_nr((_c)->context->proc_priv->pid), ##args)





static void adreno_fault_header(struct kgsl_device *device,

drivers/gpu/msm/adreno_profile.c

+2 −2
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2013-2019, The Linux Foundation. All rights reserved.

 * Copyright (c) 2013-2020, The Linux Foundation. All rights reserved.

 */



#include <linux/ctype.h>
@@ -131,7 +131,7 @@ static int _build_pre_ib_cmds(struct adreno_device *adreno_dev, 
	ibcmds += _ib_cmd_mem_write(adreno_dev, ibcmds, gpuaddr + data_offset,

			drawctxt->base.id, &data_offset);

	ibcmds += _ib_cmd_mem_write(adreno_dev, ibcmds, gpuaddr + data_offset,

			drawctxt->base.proc_priv->pid, &data_offset);

			pid_nr(drawctxt->base.proc_priv->pid), &data_offset);

	ibcmds += _ib_cmd_mem_write(adreno_dev, ibcmds, gpuaddr + data_offset,

			drawctxt->base.tid, &data_offset);

	ibcmds += _ib_cmd_mem_write(adreno_dev, ibcmds, gpuaddr + data_offset,

drivers/gpu/msm/kgsl.c

+18 −13
Original line number Diff line number Diff line
@@ -589,7 +589,7 @@ int kgsl_context_init(struct kgsl_device_private *dev_priv, 
	if (atomic_read(&proc_priv->ctxt_count) > KGSL_MAX_CONTEXTS_PER_PROC) {

		dev_err(device->dev,

			     "Per process context limit reached for pid %u\n",

			     dev_priv->process_priv->pid);

			     pid_nr(dev_priv->process_priv->pid));

		spin_unlock(&proc_priv->ctxt_count_lock);

		return -ENOSPC;

	}
@@ -906,6 +906,7 @@ static void kgsl_destroy_process_private(struct kref *kref) 
	struct kgsl_process_private *private = container_of(kref,

			struct kgsl_process_private, refcount);



	put_pid(private->pid);

	idr_destroy(&private->mem_idr);

	idr_destroy(&private->syncsource_idr);
@@ -935,7 +936,7 @@ struct kgsl_process_private *kgsl_process_private_find(pid_t pid) 


	spin_lock(&kgsl_driver.proclist_lock);

	list_for_each_entry(p, &kgsl_driver.process_list, list) {

		if (p->pid == pid) {

		if (pid_nr(p->pid) == pid) {

			if (kgsl_process_private_get(p))

				private = p;

			break;
@@ -950,7 +951,7 @@ static struct kgsl_process_private *kgsl_process_private_new( 
		struct kgsl_device *device)

{

	struct kgsl_process_private *private;

	pid_t tgid = task_tgid_nr(current);

	struct pid *cur_pid = get_task_pid(current->group_leader, PIDTYPE_PID);



	/*

	 * Flush mem_workqueue to make sure that any lingering
@@ -961,9 +962,11 @@ static struct kgsl_process_private *kgsl_process_private_new( 


	/* Search in the process list */

	list_for_each_entry(private, &kgsl_driver.process_list, list) {

		if (private->pid == tgid) {

			if (!kgsl_process_private_get(private))

		if (private->pid == cur_pid) {

			if (!kgsl_process_private_get(private)) {

				put_pid(cur_pid);

				private = ERR_PTR(-EINVAL);

			}

			return private;

		}

	}
@@ -975,7 +978,7 @@ static struct kgsl_process_private *kgsl_process_private_new( 


	kref_init(&private->refcount);



	private->pid = tgid;

	private->pid = cur_pid;

	get_task_comm(private->comm, current->group_leader);



	spin_lock_init(&private->mem_lock);
@@ -988,12 +991,14 @@ static struct kgsl_process_private *kgsl_process_private_new( 
	kgsl_reclaim_proc_private_init(private);



	/* Allocate a pagetable for the new process object */

	private->pagetable = kgsl_mmu_getpagetable(&device->mmu, tgid);

	private->pagetable = kgsl_mmu_getpagetable(&device->mmu,

							pid_nr(cur_pid));

	if (IS_ERR(private->pagetable)) {

		int err = PTR_ERR(private->pagetable);



		idr_destroy(&private->mem_idr);

		idr_destroy(&private->syncsource_idr);

		put_pid(private->pid);



		kfree(private);

		private = ERR_PTR(err);
@@ -2172,7 +2177,7 @@ long gpumem_free_entry(struct kgsl_mem_entry *entry) 
		return -EBUSY;



	trace_kgsl_mem_free(entry);

	kgsl_memfree_add(entry->priv->pid,

	kgsl_memfree_add(pid_nr(entry->priv->pid),

			entry->memdesc.pagetable ?

				entry->memdesc.pagetable->name : 0,

			entry->memdesc.gpuaddr, entry->memdesc.size,
@@ -2195,7 +2200,7 @@ static void gpumem_free_func(struct kgsl_device *device, 
	/* Free the memory for all event types */

	trace_kgsl_mem_timestamp_free(device, entry, KGSL_CONTEXT_ID(context),

		timestamp, 0);

	kgsl_memfree_add(entry->priv->pid,

	kgsl_memfree_add(pid_nr(entry->priv->pid),

			entry->memdesc.pagetable ?

				entry->memdesc.pagetable->name : 0,

			entry->memdesc.gpuaddr, entry->memdesc.size,
@@ -2295,7 +2300,7 @@ static bool gpuobj_free_fence_func(void *priv) 
	struct kgsl_mem_entry *entry = priv;



	trace_kgsl_mem_free(entry);

	kgsl_memfree_add(entry->priv->pid,

	kgsl_memfree_add(pid_nr(entry->priv->pid),

			entry->memdesc.pagetable ?

				entry->memdesc.pagetable->name : 0,

			entry->memdesc.gpuaddr, entry->memdesc.size,
@@ -4828,14 +4833,14 @@ kgsl_get_unmapped_area(struct file *file, unsigned long addr, 
		if (IS_ERR_VALUE(val))

			dev_err_ratelimited(device->dev,

					       "get_unmapped_area: pid %d addr %lx pgoff %lx len %ld failed error %d\n",

					       private->pid, addr, pgoff, len,

					       (int) val);

						pid_nr(private->pid), addr,

						pgoff, len, (int) val);

	} else {

		val = _get_svm_area(private, entry, addr, len, flags);

		if (IS_ERR_VALUE(val))

			dev_err_ratelimited(device->dev,

					       "_get_svm_area: pid %d mmap_base %lx addr %lx pgoff %lx len %ld failed error %d\n",

					       private->pid,

					       pid_nr(private->pid),

					       current->mm->mmap_base, addr,

					       pgoff, len, (int) val);

	}

drivers/gpu/msm/kgsl_debugfs.c

+5 −4
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0-only

/*

 * Copyright (c) 2002,2008-2019, The Linux Foundation. All rights reserved.

 * Copyright (c) 2002,2008-2020, The Linux Foundation. All rights reserved.

 */



#include <linux/debugfs.h>
@@ -393,7 +393,7 @@ void kgsl_process_init_debugfs(struct kgsl_process_private *private) 
	unsigned char name[16];

	struct dentry *dentry;



	snprintf(name, sizeof(name), "%d", private->pid);

	snprintf(name, sizeof(name), "%d", pid_nr(private->pid));



	private->debug_root = debugfs_create_dir(name, proc_d_debugfs);
@@ -413,14 +413,15 @@ void kgsl_process_init_debugfs(struct kgsl_process_private *private) 
	}



	dentry = debugfs_create_file("mem", 0444, private->debug_root,

		(void *) ((unsigned long) private->pid), &process_mem_fops);

		(void *) ((unsigned long) pid_nr(private->pid)),

		&process_mem_fops);



	if (IS_ERR_OR_NULL(dentry))

		WARN((dentry == NULL),

			"Unable to create 'mem' file for %s\n", name);



	dentry = debugfs_create_file("sparse_mem", 0444, private->debug_root,

		(void *) ((unsigned long) private->pid),

		(void *) ((unsigned long) pid_nr(private->pid)),

		&process_sparse_mem_fops);



	if (IS_ERR_OR_NULL(dentry))