Unverified Commit 0e85cfb0 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10167 CVE-2024-36022 

Merge Pull Request from: @ci-robot 
 
PR sync from: Liu Chuang <liuchuang40@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/I3STFYUOL3AQ76MM6LMND6W3ITPIP3YX/ 
fixing CVE-2024-36022

Ahmad Rehman (1):
    reset on reload

Felix Kuehling (1):
  [Backport] drm/amdkfd: Export DMABufs from KFD using GEM handles

Flora Cui (1):
  [Backport] drm/amdkfd: init drm_client with funcs hook

Le Ma (1):
  [Backport] drm/amdgpu: move the drm client creation behind drm device
    registration


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I9TM7F 
 
Link:https://gitee.com/openeuler/kernel/pulls/10167

 

Reviewed-by: default avatarXu Kuohai <xukuohai@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents c6563be1 37771a13

drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c

+24 −0
Original line number Diff line number Diff line
@@ -137,6 +137,30 @@ static void amdgpu_amdkfd_reset_work(struct work_struct *work) 
	amdgpu_device_gpu_recover(adev, NULL, &reset_context);

}



static const struct drm_client_funcs kfd_client_funcs = {

	.unregister	= drm_client_release,

};



int amdgpu_amdkfd_drm_client_create(struct amdgpu_device *adev)

{

	int ret;



	if (!adev->kfd.init_complete || adev->kfd.client.dev)

		return 0;



	ret = drm_client_init(&adev->ddev, &adev->kfd.client, "kfd",

			      &kfd_client_funcs);

	if (ret) {

		dev_err(adev->dev, "Failed to init DRM client: %d\n",

			ret);

		return ret;

	}



	drm_client_register(&adev->kfd.client);



	return 0;

}



void amdgpu_amdkfd_device_init(struct amdgpu_device *adev)

{

	int i;

drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h

+7 −0
Original line number Diff line number Diff line
@@ -33,6 +33,7 @@ 
#include <linux/mmu_notifier.h>

#include <linux/memremap.h>

#include <kgd_kfd_interface.h>

#include <drm/drm_client.h>

#include "amdgpu_sync.h"

#include "amdgpu_vm.h"

#include "amdgpu_xcp.h"
@@ -83,6 +84,7 @@ struct kgd_mem { 


	struct amdgpu_sync sync;



	uint32_t gem_handle;

	bool aql_queue;

	bool is_imported;

};
@@ -105,6 +107,9 @@ struct amdgpu_kfd_dev { 


	/* HMM page migration MEMORY_DEVICE_PRIVATE mapping */

	struct dev_pagemap pgmap;



	/* Client for KFD BO GEM handle allocations */

	struct drm_client_dev client;

};



enum kgd_engine_type {
@@ -182,6 +187,8 @@ int amdgpu_queue_mask_bit_to_set_resource_bit(struct amdgpu_device *adev, 
struct amdgpu_amdkfd_fence *amdgpu_amdkfd_fence_create(u64 context,

				struct mm_struct *mm,

				struct svm_range_bo *svm_bo);



int amdgpu_amdkfd_drm_client_create(struct amdgpu_device *adev);

#if defined(CONFIG_DEBUG_FS)

int kfd_debugfs_kfd_mem_limits(struct seq_file *m, void *data);

#endif

drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c

+26 −7
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ 
#include <linux/pagemap.h>

#include <linux/sched/mm.h>

#include <linux/sched/task.h>

#include <linux/fdtable.h>

#include <drm/ttm/ttm_tt.h>



#include <drm/drm_exec.h>
@@ -774,13 +775,22 @@ kfd_mem_dmaunmap_attachment(struct kgd_mem *mem, 
static int kfd_mem_export_dmabuf(struct kgd_mem *mem)

{

	if (!mem->dmabuf) {

		struct dma_buf *ret = amdgpu_gem_prime_export(

			&mem->bo->tbo.base,

		struct amdgpu_device *bo_adev;

		struct dma_buf *dmabuf;

		int r, fd;



		bo_adev = amdgpu_ttm_adev(mem->bo->tbo.bdev);

		r = drm_gem_prime_handle_to_fd(&bo_adev->ddev, bo_adev->kfd.client.file,

					       mem->gem_handle,

			mem->alloc_flags & KFD_IOC_ALLOC_MEM_FLAGS_WRITABLE ?

				DRM_RDWR : 0);

		if (IS_ERR(ret))

			return PTR_ERR(ret);

		mem->dmabuf = ret;

					       DRM_RDWR : 0, &fd);

		if (r)

			return r;

		dmabuf = dma_buf_get(fd);

		close_fd(fd);

		if (WARN_ON_ONCE(IS_ERR(dmabuf)))

			return PTR_ERR(dmabuf);

		mem->dmabuf = dmabuf;

	}



	return 0;
@@ -1737,6 +1747,9 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu( 
		pr_debug("Failed to allow vma node access. ret %d\n", ret);

		goto err_node_allow;

	}

	ret = drm_gem_handle_create(adev->kfd.client.file, gobj, &(*mem)->gem_handle);

	if (ret)

		goto err_gem_handle_create;

	bo = gem_to_amdgpu_bo(gobj);

	if (bo_type == ttm_bo_type_sg) {

		bo->tbo.sg = sg;
@@ -1778,6 +1791,8 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu( 
allocate_init_user_pages_failed:

err_pin_bo:

	remove_kgd_mem_from_kfd_bo_list(*mem, avm->process_info);

	drm_gem_handle_delete(adev->kfd.client.file, (*mem)->gem_handle);

err_gem_handle_create:

	drm_vma_node_revoke(&gobj->vma_node, drm_priv);

err_node_allow:

	/* Don't unreserve system mem limit twice */
@@ -1893,8 +1908,12 @@ int amdgpu_amdkfd_gpuvm_free_memory_of_gpu( 


	/* Free the BO*/

	drm_vma_node_revoke(&mem->bo->tbo.base.vma_node, drm_priv);

	if (mem->dmabuf)

	if (!mem->is_imported)

		drm_gem_handle_delete(adev->kfd.client.file, mem->gem_handle);

	if (mem->dmabuf) {

		dma_buf_put(mem->dmabuf);

		mem->dmabuf = NULL;

	}

	mutex_destroy(&mem->lock);



	/* If this releases the last reference, it will end up calling

drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c

+8 −1
Original line number Diff line number Diff line
@@ -2161,6 +2161,10 @@ static int amdgpu_pci_probe(struct pci_dev *pdev, 
	if (ret)

		goto err_pci;



	ret = amdgpu_amdkfd_drm_client_create(adev);

	if (ret)

		goto err_pci;



	/*

	 * 1. don't init fbdev on hw without DCE

	 * 2. don't init fbdev if there are no connectors
@@ -2372,8 +2376,11 @@ static void amdgpu_drv_delayed_reset_work_handler(struct work_struct *work) 
	}

	for (i = 0; i < mgpu_info.num_dgpu; i++) {

		adev = mgpu_info.gpu_ins[i].adev;

		if (!adev->kfd.init_complete)

		if (!adev->kfd.init_complete) {

			kgd2kfd_init_zone_device(adev);

			amdgpu_amdkfd_device_init(adev);

			amdgpu_amdkfd_drm_client_create(adev);

		}

		amdgpu_ttm_set_buffer_funcs_status(adev, true);

	}

}

drivers/gpu/drm/amd/amdkfd/kfd_chardev.c

+2 −2
Original line number Diff line number Diff line
@@ -1851,8 +1851,8 @@ static uint32_t get_process_num_bos(struct kfd_process *p) 
	return num_of_bos;

}



static int criu_get_prime_handle(struct kgd_mem *mem, int flags,

				      u32 *shared_fd)

static int criu_get_prime_handle(struct kgd_mem *mem,

				 int flags, u32 *shared_fd)

{

	struct dma_buf *dmabuf;

	int ret;