From: Greg Kroah-Hartman Date: Thu, 11 May 2017 12:46:40 +0000 (+0200) Subject: 3.18-stable patches X-Git-Tag: v4.4.68~13 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=a8f4bf67f34c889e5b07fc55d25157ab05cd2bac;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: drm-ttm-fix-use-after-free-races-in-vm-fault-handling.patch --- diff --git a/queue-3.18/drm-ttm-fix-use-after-free-races-in-vm-fault-handling.patch b/queue-3.18/drm-ttm-fix-use-after-free-races-in-vm-fault-handling.patch new file mode 100644 index 00000000000..574c0220799 --- /dev/null +++ b/queue-3.18/drm-ttm-fix-use-after-free-races-in-vm-fault-handling.patch @@ -0,0 +1,69 @@ +From 3089c1df10e2931b1d72d2ffa7d86431084c86b3 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Nicolai=20H=C3=A4hnle?= +Date: Sat, 18 Feb 2017 22:59:56 +0100 +Subject: drm/ttm: fix use-after-free races in vm fault handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nicolai Hähnle + +commit 3089c1df10e2931b1d72d2ffa7d86431084c86b3 upstream. + +The vm fault handler relies on the fact that the VMA owns a reference +to the BO. However, once mmap_sem is released, other tasks are free to +destroy the VMA, which can lead to the BO being freed. Fix two code +paths where that can happen, both related to vm fault retries. + +Found via a lock debugging warning which flagged &bo->wu_mutex as +locked while being destroyed. + +Fixes: cbe12e74ee4e ("drm/ttm: Allow vm fault retries") +Signed-off-by: Nicolai Hähnle +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/ttm/ttm_bo_vm.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c ++++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c +@@ -66,8 +66,11 @@ static int ttm_bo_vm_fault_idle(struct t + if (vmf->flags & FAULT_FLAG_RETRY_NOWAIT) + goto out_unlock; + ++ ttm_bo_reference(bo); + up_read(&vma->vm_mm->mmap_sem); + (void) ttm_bo_wait(bo, false, true, false); ++ ttm_bo_unreserve(bo); ++ ttm_bo_unref(&bo); + goto out_unlock; + } + +@@ -114,8 +117,10 @@ static int ttm_bo_vm_fault(struct vm_are + + if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) { + if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) { ++ ttm_bo_reference(bo); + up_read(&vma->vm_mm->mmap_sem); + (void) ttm_bo_wait_unreserved(bo); ++ ttm_bo_unref(&bo); + } + + return VM_FAULT_RETRY; +@@ -160,6 +165,13 @@ static int ttm_bo_vm_fault(struct vm_are + ret = ttm_bo_vm_fault_idle(bo, vma, vmf); + if (unlikely(ret != 0)) { + retval = ret; ++ ++ if (retval == VM_FAULT_RETRY && ++ !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) { ++ /* The BO has already been unreserved. */ ++ return retval; ++ } ++ + goto out_unlock; + } + diff --git a/queue-3.18/series b/queue-3.18/series index ebcc084d2ec..a93dc2b2832 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -36,3 +36,4 @@ ipv6-initialize-route-null-entry-in-addrconf_init.patch ipv6-reorder-ip6_route_dev_notifier-after-ipv6_dev_notf.patch tcp-fix-wraparound-issue-in-tcp_lp.patch f2fs-sanity-check-segment-count.patch +drm-ttm-fix-use-after-free-races-in-vm-fault-handling.patch