]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit
drm/ttm: stop calling tt_swapin in vm_access
authorMatthew Auld <matthew.auld@intel.com>
Mon, 27 Sep 2021 11:41:02 +0000 (12:41 +0100)
committerAndrea Righi <andrea.righi@canonical.com>
Tue, 4 Jan 2022 08:48:20 +0000 (09:48 +0100)
commit03ebe65eaa96910b7b247352317892b8a7f54b9c
treeefe5b326e3316904336da411111b2f82c80f44ed
parent2fee602becd918ad581357494ee000a164cdfb51
drm/ttm: stop calling tt_swapin in vm_access

BugLink: https://bugs.launchpad.net/bugs/1951822
[ Upstream commit f5d28856b89baab4232a9f841e565763fcebcdf9 ]

In commit:

commit 09ac4fcb3f255e9225967c75f5893325c116cdbe
Author: Felix Kuehling <Felix.Kuehling@amd.com>
Date:   Thu Jul 13 17:01:16 2017 -0400

    drm/ttm: Implement vm_operations_struct.access v2

we added the vm_access hook, where we also directly call tt_swapin for
some reason. If something is swapped-out then the ttm_tt must also be
unpopulated, and since access_kmap should also call tt_populate, if
needed, then swapping-in will already be handled there.

If anything, calling tt_swapin directly here would likely always fail
since the tt->pages won't yet be populated, or worse since the tt->pages
array is never actually cleared in unpopulate this might lead to a nasty
uaf.

Fixes: 09ac4fcb3f25 ("drm/ttm: Implement vm_operations_struct.access v2")
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Christian König <christian.koenig@amd.com>
Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210927114114.152310-1-matthew.auld@intel.com
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
drivers/gpu/drm/ttm/ttm_bo_vm.c