[PATCH] drm/ttm: prevent grabbing page references

[Dmitry Osipenko]

On 8/15/22 16:08, Christian König wrote:
> TTM owns the pages it uses for backing buffer objects with system
> memory. Because of this it is absolutely illegal to mess around with
> the reference count of those pages.
> 
> So make sure that nobody ever tries to grab an extra reference on
> pages allocated through the page pool.
> 
> Signed-off-by: Christian König <christian.koenig at amd.com>
> ---
>  drivers/gpu/drm/ttm/ttm_pool.c | 14 +++++++++++++-
>  1 file changed, 13 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/ttm/ttm_pool.c b/drivers/gpu/drm/ttm/ttm_pool.c
> index 1bba0a0ed3f9..cbca84dbd83f 100644
> --- a/drivers/gpu/drm/ttm/ttm_pool.c
> +++ b/drivers/gpu/drm/ttm/ttm_pool.c
> @@ -93,8 +93,17 @@ static struct page *ttm_pool_alloc_page(struct ttm_pool *pool, gfp_t gfp_flags,
>  
>  	if (!pool->use_dma_alloc) {
>  		p = alloc_pages(gfp_flags, order);
> -		if (p)
> +		if (p) {
>  			p->private = order;
> +
> +			/* The pages are fully owned by TTM and because of this
> +			 * it's illegal to grab extra references to it or
> +			 * otherwise we corrupt TTMs internal state. Make sure
> +			 * nobody tries to ever increase the reference count of
> +			 * those pages.
> +			 */
> +			set_page_count(p, 0);
> +		}
>  		return p;
>  	}
>  
> @@ -144,6 +153,9 @@ static void ttm_pool_free_page(struct ttm_pool *pool, enum ttm_caching caching,
>  #endif
>  
>  	if (!pool || !pool->use_dma_alloc) {
> +		/* See alloc why references to TTMs pages are illegal */
> +		WARN_ON(page_count(p));
> +		set_page_count(p, 1);
>  		__free_pages(p, order);
>  		return;
>  	}

Could you please explain why you're skipping the DMA pages?

-- 
Best regards,
Dmitry