Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit db9f9203 authored by Chris Wilson's avatar Chris Wilson Committed by Jani Nikula
Browse files

drm/i915/userptr: Hold mmref whilst calling get-user-pages 



Holding a reference to the containing task_struct is not sufficient to
prevent the mm_struct from being reaped under memory pressure. If this
happens whilst we are calling get_user_pages(), explosions erupt -
sometimes an immediate GPF, sometimes page flag corruption. To prevent
the target mm from being reaped as we are reading from it, acquire a
reference before we begin.

Testcase: igt/gem_shrink/*userptr
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Michał Winiarski <michal.winiarski@intel.com>
Cc: stable@vger.kernel.org
Reviewed-by: default avatarMichał Winiarski <michal.winiarski@intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/1459864801-28606-2-git-send-email-chris@chris-wilson.co.uk


(cherry picked from commit 40313f0c)
Signed-off-by: default avatarJani Nikula <jani.nikula@intel.com>
parent d43f3ebf

drivers/gpu/drm/i915/i915_gem_userptr.c

+17 −12
Original line number Original line Diff line number Diff line
@@ -501,9 +501,12 @@ __i915_gem_userptr_get_pages_worker(struct work_struct *_work) 
	if (pvec != NULL) {

	if (pvec != NULL) {

		struct mm_struct *mm = obj->userptr.mm->mm;

		struct mm_struct *mm = obj->userptr.mm->mm;





		ret = -EFAULT;

		if (atomic_inc_not_zero(&mm->mm_users)) {

			down_read(&mm->mmap_sem);

			down_read(&mm->mmap_sem);

			while (pinned < npages) {

			while (pinned < npages) {

			ret = get_user_pages_remote(work->task, mm,

				ret = get_user_pages_remote

					(work->task, mm,

					 obj->userptr.ptr + pinned * PAGE_SIZE,

					 obj->userptr.ptr + pinned * PAGE_SIZE,

					 npages - pinned,

					 npages - pinned,

					 !obj->userptr.read_only, 0,

					 !obj->userptr.read_only, 0,
@@ -514,6 +517,8 @@ __i915_gem_userptr_get_pages_worker(struct work_struct *_work) 
				pinned += ret;

				pinned += ret;

			}

			}

			up_read(&mm->mmap_sem);

			up_read(&mm->mmap_sem);

			mmput(mm);

		}

	}

	}





	mutex_lock(&dev->struct_mutex);

	mutex_lock(&dev->struct_mutex);