<div dir="ltr"><div>Confirming that v3 patch still fixes the bug.</div><div><br></div><div>Thanks,</div><div>-Joe<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Oct 11, 2019 at 7:36 AM Yang, Philip <<a href="mailto:Philip.Yang@amd.com">Philip.Yang@amd.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">user_pages array should always be freed after validation regardless if<br>
user pages are changed after bo is created because with HMM change parse<br>
bo always allocate user pages array to get user pages for userptr bo.<br>
<br>
v2: remove unused local variable and amend commit<br>
<br>
v3: add back get user pages in gem_userptr_ioctl, to detect application<br>
bug where an userptr VMA is not ananymous memory and reject it.<br>
<br>
Bugzilla: <a href="https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1844962" rel="noreferrer" target="_blank">https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1844962</a><br>
<br>
Signed-off-by: Philip Yang <<a href="mailto:Philip.Yang@amd.com" target="_blank">Philip.Yang@amd.com</a>><br>
Tested-by: Joe Barnett <<a href="mailto:thejoe@gmail.com" target="_blank">thejoe@gmail.com</a>><br>
Reviewed-by: Christian König <<a href="mailto:christian.koenig@amd.com" target="_blank">christian.koenig@amd.com</a>><br>
---<br>
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 4 +---<br>
1 file changed, 1 insertion(+), 3 deletions(-)<br>
<br>
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c<br>
index c18a153b3d2a..e7b39daa22f6 100644<br>
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c<br>
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c<br>
@@ -476,7 +476,6 @@ static int amdgpu_cs_list_validate(struct amdgpu_cs_parser *p,<br>
<br>
list_for_each_entry(lobj, validated, tv.head) {<br>
struct amdgpu_bo *bo = ttm_to_amdgpu_bo(lobj-><a href="http://tv.bo" rel="noreferrer" target="_blank">tv.bo</a>);<br>
- bool binding_userptr = false;<br>
struct mm_struct *usermm;<br>
<br>
usermm = amdgpu_ttm_tt_get_usermm(bo->tbo.ttm);<br>
@@ -493,14 +492,13 @@ static int amdgpu_cs_list_validate(struct amdgpu_cs_parser *p,<br>
<br>
amdgpu_ttm_tt_set_user_pages(bo->tbo.ttm,<br>
lobj->user_pages);<br>
- binding_userptr = true;<br>
}<br>
<br>
r = amdgpu_cs_validate(p, bo);<br>
if (r)<br>
return r;<br>
<br>
- if (binding_userptr) {<br>
+ if (lobj->user_pages) {<br>
kvfree(lobj->user_pages);<br>
lobj->user_pages = NULL;<br>
}<br>
-- <br>
2.17.1<br>
<br>
</blockquote></div>