Commit d611b4a0 authored by Neil Roberts's avatar Neil Roberts Committed by Maarten Lankhorst
Browse files

drm/shmem-helper: Check for purged buffers in fault handler 



When a buffer is madvised as not needed and then purged, any attempts to
access the buffer from user-space should cause a bus fault. This patch
adds a check for that.

Cc: stable@vger.kernel.org
Fixes: 17acb9f3 ("drm/shmem: Add madvise state and purge helpers")
Signed-off-by: default avatarNeil Roberts <nroberts@igalia.com>
Reviewed-by: default avatarSteven Price <steven.price@arm.com>
Signed-off-by: default avatarSteven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210223155125.199577-2-nroberts@igalia.com


Signed-off-by: default avatarMaarten Lankhorst <maarten.lankhorst@linux.intel.com>
parent 738acd49

drivers/gpu/drm/drm_gem_shmem_helper.c

+14 −4
Original line number Diff line number Diff line
@@ -525,14 +525,24 @@ static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf) 
	struct drm_gem_object *obj = vma->vm_private_data;

	struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj);

	loff_t num_pages = obj->size >> PAGE_SHIFT;

	vm_fault_t ret;

	struct page *page;



	if (vmf->pgoff >= num_pages || WARN_ON_ONCE(!shmem->pages))

		return VM_FAULT_SIGBUS;

	mutex_lock(&shmem->pages_lock);



	if (vmf->pgoff >= num_pages ||

	    WARN_ON_ONCE(!shmem->pages) ||

	    shmem->madv < 0) {

		ret = VM_FAULT_SIGBUS;

	} else {

		page = shmem->pages[vmf->pgoff];



	return vmf_insert_page(vma, vmf->address, page);

		ret = vmf_insert_page(vma, vmf->address, page);

	}



	mutex_unlock(&shmem->pages_lock);



	return ret;

}



static void drm_gem_shmem_vm_open(struct vm_area_struct *vma)