[Intel-gfx] [PATCH 2/2] drm/i915/ttm: add some sanity checks for lmem_userfault_list

[Andrzej Hajda]

On 07.11.2022 17:54, Matthew Auld wrote:
> Rather than getting some hard to debug uaf, add some warns to hopefully
> catch issues with userfault_count being non-zero when destroying the
> object. Also if we somehow add an object to lmem_userfault_list that
> somehow doesn't map lmem.
>
> References: https://gitlab.freedesktop.org/drm/intel/-/issues/7469
> Signed-off-by: Matthew Auld <matthew.auld at intel.com>
> Cc: Anshuman Gupta <anshuman.gupta at intel.com>
> Cc: Rodrigo Vivi <rodrigo.vivi at intel.com>
> Cc: Andrzej Hajda <andrzej.hajda at intel.com>
> Cc: Nirmoy Das <nirmoy.das at intel.com>

Reviewed-by: Andrzej Hajda <andrzej.hajda at intel.com>

Regards
Andrzej
> ---
>   drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 4 ++++
>   1 file changed, 4 insertions(+)
>
> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
> index 9421dc4dc98f..2c8b2d5ae903 100644
> --- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
> +++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
> @@ -1098,6 +1098,8 @@ static vm_fault_t vm_fault_ttm(struct vm_fault *vmf)
>   		spin_lock(&to_i915(obj->base.dev)->runtime_pm.lmem_userfault_lock);
>   		list_add(&obj->userfault_link, &to_i915(obj->base.dev)->runtime_pm.lmem_userfault_list);
>   		spin_unlock(&to_i915(obj->base.dev)->runtime_pm.lmem_userfault_lock);
> +
> +		GEM_WARN_ON(!i915_ttm_cpu_maps_iomem(bo->resource));
>   	}
>   
>   	if (wakeref & CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND)
> @@ -1180,6 +1182,8 @@ static void i915_ttm_unmap_virtual(struct drm_i915_gem_object *obj)
>   		}
>   	}
>   
> +	GEM_WARN_ON(obj->userfault_count);
> +
>   	ttm_bo_unmap_virtual(i915_gem_to_ttm(obj));
>   
>   	if (wakeref)