91398b413d
Surfaces can be backed (i.e. stored in) memory objects (mob's) which are created and managed by the userspace as GEM buffers. Surfaces grab only a ttm reference which means that the gem object can be deleted underneath us, especially in cases where prime buffer export is used. Make sure that all userspace surfaces which are backed by gem objects hold a gem reference to make sure they're not deleted before vmw surfaces are done with them, which fixes: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 2 PID: 2632 at lib/refcount.c:28 refcount_warn_saturate+0xfb/0x150 Modules linked in: overlay vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vsock snd_ens1371 snd_ac97_codec ac97_bus snd_pcm gameport> CPU: 2 PID: 2632 Comm: vmw_ref_count Not tainted 6.5.0-rc2-vmwgfx #1 Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 RIP: 0010:refcount_warn_saturate+0xfb/0x150 Code: eb 9e 0f b6 1d 8b 5b a6 01 80 fb 01 0f 87 ba e4 80 00 83 e3 01 75 89 48 c7 c7 c0 3c f9 a3 c6 05 6f 5b a6 01 01 e8 15 81 98 ff <0f> 0b e9 6f ff ff ff 0f b> RSP: 0018:ffffbdc34344bba0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000027 RDX: ffff960475ea1548 RSI: 0000000000000001 RDI: ffff960475ea1540 RBP: ffffbdc34344bba8 R08: 0000000000000003 R09: 65646e75203a745f R10: ffffffffa5b32b20 R11: 72657466612d6573 R12: ffff96037d6a6400 R13: ffff9603484805b0 R14: 000000000000000b R15: ffff9603bed06060 FS: 00007f5fd8520c40(0000) GS:ffff960475e80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5fda755000 CR3: 000000010d012005 CR4: 00000000003706e0 Call Trace: <TASK> ? show_regs+0x6e/0x80 ? refcount_warn_saturate+0xfb/0x150 ? __warn+0x91/0x150 ? refcount_warn_saturate+0xfb/0x150 ? report_bug+0x19d/0x1b0 ? handle_bug+0x46/0x80 ? exc_invalid_op+0x1d/0x80 ? asm_exc_invalid_op+0x1f/0x30 ? refcount_warn_saturate+0xfb/0x150 drm_gem_object_handle_put_unlocked+0xba/0x110 [drm] drm_gem_object_release_handle+0x6e/0x80 [drm] drm_gem_handle_delete+0x6a/0xc0 [drm] ? __pfx_vmw_bo_unref_ioctl+0x10/0x10 [vmwgfx] vmw_bo_unref_ioctl+0x33/0x40 [vmwgfx] drm_ioctl_kernel+0xbc/0x160 [drm] drm_ioctl+0x2d2/0x580 [drm] ? __pfx_vmw_bo_unref_ioctl+0x10/0x10 [vmwgfx] ? do_vmi_munmap+0xee/0x180 vmw_generic_ioctl+0xbd/0x180 [vmwgfx] vmw_unlocked_ioctl+0x19/0x20 [vmwgfx] __x64_sys_ioctl+0x99/0xd0 do_syscall_64+0x5d/0x90 ? syscall_exit_to_user_mode+0x2a/0x50 ? do_syscall_64+0x6d/0x90 ? handle_mm_fault+0x16e/0x2f0 ? exit_to_user_mode_prepare+0x34/0x170 ? irqentry_exit_to_user_mode+0xd/0x20 ? irqentry_exit+0x3f/0x50 ? exc_page_fault+0x8e/0x190 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 RIP: 0033:0x7f5fda51aaff Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 7> RSP: 002b:00007ffd536a4d30 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffd536a4de0 RCX: 00007f5fda51aaff RDX: 00007ffd536a4de0 RSI: 0000000040086442 RDI: 0000000000000003 RBP: 0000000040086442 R08: 000055fa603ada50 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000246 R12: 00007ffd536a51b8 R13: 0000000000000003 R14: 000055fa5ebb4c80 R15: 00007f5fda90f040 </TASK> ---[ end trace 0000000000000000 ]--- A lot of the analyis on the bug was done by Murray McAllister and Ian Forbes. Reported-by: Murray McAllister <murray.mcallister@gmail.com> Cc: Ian Forbes <iforbes@vmware.com> Signed-off-by: Zack Rusin <zackr@vmware.com> Fixes: a950b989ea29 ("drm/vmwgfx: Do not drop the reference to the handle too soon") Cc: <stable@vger.kernel.org> # v6.2+ Reviewed-by: Martin Krastev <krastevm@vmware.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230928041355.737635-1-zack@kde.org
219 lines
6.3 KiB
C
219 lines
6.3 KiB
C
/* SPDX-License-Identifier: GPL-2.0 OR MIT */
|
|
/**************************************************************************
|
|
*
|
|
* Copyright 2023 VMware, Inc., Palo Alto, CA., USA
|
|
*
|
|
* Permission is hereby granted, free of charge, to any person obtaining a
|
|
* copy of this software and associated documentation files (the
|
|
* "Software"), to deal in the Software without restriction, including
|
|
* without limitation the rights to use, copy, modify, merge, publish,
|
|
* distribute, sub license, and/or sell copies of the Software, and to
|
|
* permit persons to whom the Software is furnished to do so, subject to
|
|
* the following conditions:
|
|
*
|
|
* The above copyright notice and this permission notice (including the
|
|
* next paragraph) shall be included in all copies or substantial portions
|
|
* of the Software.
|
|
*
|
|
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
* FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT. IN NO EVENT SHALL
|
|
* THE COPYRIGHT HOLDERS, AUTHORS AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM,
|
|
* DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
|
|
* OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
|
|
* USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
*
|
|
**************************************************************************/
|
|
|
|
#ifndef VMWGFX_BO_H
|
|
#define VMWGFX_BO_H
|
|
|
|
#include "device_include/svga_reg.h"
|
|
|
|
#include <drm/ttm/ttm_bo.h>
|
|
#include <drm/ttm/ttm_placement.h>
|
|
|
|
#include <linux/rbtree_types.h>
|
|
#include <linux/types.h>
|
|
|
|
struct vmw_bo_dirty;
|
|
struct vmw_fence_obj;
|
|
struct vmw_private;
|
|
struct vmw_resource;
|
|
|
|
enum vmw_bo_domain {
|
|
VMW_BO_DOMAIN_SYS = BIT(0),
|
|
VMW_BO_DOMAIN_WAITABLE_SYS = BIT(1),
|
|
VMW_BO_DOMAIN_VRAM = BIT(2),
|
|
VMW_BO_DOMAIN_GMR = BIT(3),
|
|
VMW_BO_DOMAIN_MOB = BIT(4),
|
|
};
|
|
|
|
struct vmw_bo_params {
|
|
u32 domain;
|
|
u32 busy_domain;
|
|
enum ttm_bo_type bo_type;
|
|
size_t size;
|
|
bool pin;
|
|
};
|
|
|
|
/**
|
|
* struct vmw_bo - TTM buffer object with vmwgfx additions
|
|
* @tbo: The TTM buffer object
|
|
* @placement: The preferred placement for this buffer object
|
|
* @places: The chosen places for the preferred placement.
|
|
* @busy_places: Chosen busy places for the preferred placement
|
|
* @map: Kmap object for semi-persistent mappings
|
|
* @res_tree: RB tree of resources using this buffer object as a backing MOB
|
|
* @res_prios: Eviction priority counts for attached resources
|
|
* @cpu_writers: Number of synccpu write grabs. Protected by reservation when
|
|
* increased. May be decreased without reservation.
|
|
* @dx_query_ctx: DX context if this buffer object is used as a DX query MOB
|
|
* @dirty: structure for user-space dirty-tracking
|
|
*/
|
|
struct vmw_bo {
|
|
struct ttm_buffer_object tbo;
|
|
|
|
struct ttm_placement placement;
|
|
struct ttm_place places[5];
|
|
struct ttm_place busy_places[5];
|
|
|
|
/* Protected by reservation */
|
|
struct ttm_bo_kmap_obj map;
|
|
|
|
struct rb_root res_tree;
|
|
u32 res_prios[TTM_MAX_BO_PRIORITY];
|
|
|
|
atomic_t cpu_writers;
|
|
/* Not ref-counted. Protected by binding_mutex */
|
|
struct vmw_resource *dx_query_ctx;
|
|
struct vmw_bo_dirty *dirty;
|
|
};
|
|
|
|
void vmw_bo_placement_set(struct vmw_bo *bo, u32 domain, u32 busy_domain);
|
|
void vmw_bo_placement_set_default_accelerated(struct vmw_bo *bo);
|
|
|
|
int vmw_bo_create(struct vmw_private *dev_priv,
|
|
struct vmw_bo_params *params,
|
|
struct vmw_bo **p_bo);
|
|
|
|
int vmw_bo_unref_ioctl(struct drm_device *dev, void *data,
|
|
struct drm_file *file_priv);
|
|
|
|
int vmw_bo_pin_in_vram(struct vmw_private *dev_priv,
|
|
struct vmw_bo *buf,
|
|
bool interruptible);
|
|
int vmw_bo_pin_in_vram_or_gmr(struct vmw_private *dev_priv,
|
|
struct vmw_bo *buf,
|
|
bool interruptible);
|
|
int vmw_bo_pin_in_start_of_vram(struct vmw_private *vmw_priv,
|
|
struct vmw_bo *bo,
|
|
bool interruptible);
|
|
void vmw_bo_pin_reserved(struct vmw_bo *bo, bool pin);
|
|
int vmw_bo_unpin(struct vmw_private *vmw_priv,
|
|
struct vmw_bo *bo,
|
|
bool interruptible);
|
|
|
|
void vmw_bo_get_guest_ptr(const struct ttm_buffer_object *buf,
|
|
SVGAGuestPtr *ptr);
|
|
int vmw_user_bo_synccpu_ioctl(struct drm_device *dev, void *data,
|
|
struct drm_file *file_priv);
|
|
void vmw_bo_fence_single(struct ttm_buffer_object *bo,
|
|
struct vmw_fence_obj *fence);
|
|
|
|
void *vmw_bo_map_and_cache(struct vmw_bo *vbo);
|
|
void vmw_bo_unmap(struct vmw_bo *vbo);
|
|
|
|
void vmw_bo_move_notify(struct ttm_buffer_object *bo,
|
|
struct ttm_resource *mem);
|
|
void vmw_bo_swap_notify(struct ttm_buffer_object *bo);
|
|
|
|
int vmw_user_bo_lookup(struct drm_file *filp,
|
|
u32 handle,
|
|
struct vmw_bo **out);
|
|
/**
|
|
* vmw_bo_adjust_prio - Adjust the buffer object eviction priority
|
|
* according to attached resources
|
|
* @vbo: The struct vmw_bo
|
|
*/
|
|
static inline void vmw_bo_prio_adjust(struct vmw_bo *vbo)
|
|
{
|
|
int i = ARRAY_SIZE(vbo->res_prios);
|
|
|
|
while (i--) {
|
|
if (vbo->res_prios[i]) {
|
|
vbo->tbo.priority = i;
|
|
return;
|
|
}
|
|
}
|
|
|
|
vbo->tbo.priority = 3;
|
|
}
|
|
|
|
/**
|
|
* vmw_bo_prio_add - Notify a buffer object of a newly attached resource
|
|
* eviction priority
|
|
* @vbo: The struct vmw_bo
|
|
* @prio: The resource priority
|
|
*
|
|
* After being notified, the code assigns the highest resource eviction priority
|
|
* to the backing buffer object (mob).
|
|
*/
|
|
static inline void vmw_bo_prio_add(struct vmw_bo *vbo, int prio)
|
|
{
|
|
if (vbo->res_prios[prio]++ == 0)
|
|
vmw_bo_prio_adjust(vbo);
|
|
}
|
|
|
|
/**
|
|
* vmw_bo_used_prio_del - Notify a buffer object of a resource with a certain
|
|
* priority being removed
|
|
* @vbo: The struct vmw_bo
|
|
* @prio: The resource priority
|
|
*
|
|
* After being notified, the code assigns the highest resource eviction priority
|
|
* to the backing buffer object (mob).
|
|
*/
|
|
static inline void vmw_bo_prio_del(struct vmw_bo *vbo, int prio)
|
|
{
|
|
if (--vbo->res_prios[prio] == 0)
|
|
vmw_bo_prio_adjust(vbo);
|
|
}
|
|
|
|
static inline void vmw_bo_unreference(struct vmw_bo **buf)
|
|
{
|
|
struct vmw_bo *tmp_buf = *buf;
|
|
|
|
*buf = NULL;
|
|
if (tmp_buf)
|
|
ttm_bo_put(&tmp_buf->tbo);
|
|
}
|
|
|
|
static inline struct vmw_bo *vmw_bo_reference(struct vmw_bo *buf)
|
|
{
|
|
ttm_bo_get(&buf->tbo);
|
|
return buf;
|
|
}
|
|
|
|
static inline struct vmw_bo *vmw_user_bo_ref(struct vmw_bo *vbo)
|
|
{
|
|
drm_gem_object_get(&vbo->tbo.base);
|
|
return vbo;
|
|
}
|
|
|
|
static inline void vmw_user_bo_unref(struct vmw_bo **buf)
|
|
{
|
|
struct vmw_bo *tmp_buf = *buf;
|
|
|
|
*buf = NULL;
|
|
if (tmp_buf)
|
|
drm_gem_object_put(&tmp_buf->tbo.base);
|
|
}
|
|
|
|
static inline struct vmw_bo *to_vmw_bo(struct drm_gem_object *gobj)
|
|
{
|
|
return container_of((gobj), struct vmw_bo, tbo.base);
|
|
}
|
|
|
|
#endif // VMWGFX_BO_H
|