Commit 8b6ab6d1 authored by Alex Deucher's avatar Alex Deucher Committed by Zhang Changzhong
Browse files

drm/amdkfd: don't allow mapping the MMIO HDP page with large pages 

mainline inclusion
from mainline-v6.9
commit be4a2a81b6b90d1a47eaeaace4cc8e2cb57b96c7
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAEF52
CVE: CVE-2024-41011

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=be4a2a81b6b90d1a47eaeaace4cc8e2cb57b96c7



--------------------------------

We don't get the right offset in that case.  The GPU has
an unused 4K area of the register BAR space into which you can
remap registers.  We remap the HDP flush registers into this
space to allow userspace (CPU or GPU) to flush the HDP when it
updates VRAM.  However, on systems with >4K pages, we end up
exposing PAGE_SIZE of MMIO space.

Fixes: d8e408a8 ("drm/amdkfd: Expose HDP registers to user space")
Reviewed-by: default avatarFelix Kuehling <felix.kuehling@amd.com>
Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Conflicts:
	drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
[Commit 73fa13b6 ("drm/amdkfd: CRIU Implement KFD restore ioctl") is
not merged]
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parent 1e94b0d2

drivers/gpu/drm/amd/amdkfd/kfd_chardev.c

+4 −1
Original line number Diff line number Diff line
@@ -1304,7 +1304,7 @@ static int kfd_ioctl_alloc_memory_of_gpu(struct file *filep, 
			goto err_unlock;

		}

		offset = amdgpu_amdkfd_get_mmio_remap_phys_addr(dev->kgd);

		if (!offset) {

		if (!offset || (PAGE_SIZE > 4096)) {

			err = -ENOMEM;

			goto err_unlock;

		}
@@ -1962,6 +1962,9 @@ static int kfd_mmio_mmap(struct kfd_dev *dev, struct kfd_process *process, 
	if (vma->vm_end - vma->vm_start != PAGE_SIZE)

		return -EINVAL;



	if (PAGE_SIZE > 4096)

		return -EINVAL;



	address = amdgpu_amdkfd_get_mmio_remap_phys_addr(dev->kgd);



	vma->vm_flags |= VM_IO | VM_DONTCOPY | VM_DONTEXPAND | VM_NORESERVE |