Unverified Commit 09bf649a authored by Rob Clark's avatar Rob Clark Committed by Javier Martinez Canillas
Browse files

drm/shmem-helper: Avoid vm_open error paths 



vm_open() is not allowed to fail.  Fortunately we are guaranteed that
the pages are already pinned, thanks to the initial mmap which is now
being cloned into a forked process, and only need to increment the
refcnt.  So just increment it directly.  Previously if a signal was
delivered at the wrong time to the forking process, the
mutex_lock_interruptible() could fail resulting in the pages_use_count
not being incremented.

Fixes: 2194a63a ("drm: Add library for shmem backed GEM objects")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20221130185748.357410-3-robdclark@gmail.com
parent 24013314

drivers/gpu/drm/drm_gem_shmem_helper.c

+11 −3
Original line number Diff line number Diff line
@@ -571,12 +571,20 @@ static void drm_gem_shmem_vm_open(struct vm_area_struct *vma) 
{

	struct drm_gem_object *obj = vma->vm_private_data;

	struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj);

	int ret;



	WARN_ON(shmem->base.import_attach);



	ret = drm_gem_shmem_get_pages(shmem);

	WARN_ON_ONCE(ret != 0);

	mutex_lock(&shmem->pages_lock);



	/*

	 * We should have already pinned the pages when the buffer was first

	 * mmap'd, vm_open() just grabs an additional reference for the new

	 * mm the vma is getting copied into (ie. on fork()).

	 */

	if (!WARN_ON_ONCE(!shmem->pages_use_count))

		shmem->pages_use_count++;



	mutex_unlock(&shmem->pages_lock);



	drm_gem_vm_open(vma);

}