[Intel-gfx] [PATCH 1/2] drm/i915/ttm: fix uaf with lmem_userfault_list handling

[Andrzej Hajda]

On 07.11.2022 17:54, Matthew Auld wrote:
> In the fault handler, make sure we check if the BO maps lmem after
> we schedule the migration, since the current resource might change from
> lmem to smem, if the pages are in the non-cpu visible portion of lmem.
> This then leads to adding the object to the lmem_userfault_list even
> though the current resource is no longer lmem. If we then destroy the
> object, the list might still contain a link to the now free object, since
> we only remove it if the object is still in lmem.
>
> Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/7469
> Fixes: ad74457a6b5a ("drm/i915/dgfx: Release mmap on rpm suspend")
> Signed-off-by: Matthew Auld <matthew.auld at intel.com>
> Cc: Anshuman Gupta <anshuman.gupta at intel.com>
> Cc: Rodrigo Vivi <rodrigo.vivi at intel.com>
> Cc: Andrzej Hajda <andrzej.hajda at intel.com>
> Cc: Nirmoy Das <nirmoy.das at intel.com>

Reviewed-by: Andrzej Hajda <andrzej.hajda at intel.com>

Regards
Andrzej

> ---
>   drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 6 +++---
>   1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
> index 25129af70f70..9421dc4dc98f 100644
> --- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
> +++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
> @@ -1048,9 +1048,6 @@ static vm_fault_t vm_fault_ttm(struct vm_fault *vmf)
>   		return VM_FAULT_SIGBUS;
>   	}
>   
> -	if (i915_ttm_cpu_maps_iomem(bo->resource))
> -		wakeref = intel_runtime_pm_get(&to_i915(obj->base.dev)->runtime_pm);
> -
>   	if (!i915_ttm_resource_mappable(bo->resource)) {
>   		int err = -ENODEV;
>   		int i;
> @@ -1078,6 +1075,9 @@ static vm_fault_t vm_fault_ttm(struct vm_fault *vmf)
>   		}
>   	}
>   
> +	if (i915_ttm_cpu_maps_iomem(bo->resource))
> +		wakeref = intel_runtime_pm_get(&to_i915(obj->base.dev)->runtime_pm);
> +
>   	if (drm_dev_enter(dev, &idx)) {
>   		ret = ttm_bo_vm_fault_reserved(vmf, vmf->vma->vm_page_prot,
>   					       TTM_BO_VM_NUM_PREFAULT);