Commit ed14d225 authored by Dawei Li's avatar Dawei Li Committed by Zack Rusin
Browse files

drm/vmwgfx: Fix race issue calling pin_user_pages 



pin_user_pages() is unsafe without protection of mmap_lock,
fix it by calling pin_user_pages_fast().

Fixes: 7a7a933e ("drm/vmwgfx: Introduce VMware mks-guest-stats")
Signed-off-by: default avatarDawei Li <set_pte_at@outlook.com>
Reviewed-by: default avatarMartin Krastev <krastevm@vmware.com>
Signed-off-by: default avatarZack Rusin <zackr@vmware.com>
Link: https://patchwork.freedesktop.org/patch/msgid/TYWP286MB23193621CB443E1E1959A00BCA3E9@TYWP286MB2319.JPNP286.PROD.OUTLOOK.COM
parent a6a00d7e

drivers/gpu/drm/vmwgfx/vmwgfx_msg.c

+3 −3
Original line number Diff line number Diff line
@@ -1085,21 +1085,21 @@ int vmw_mksstat_add_ioctl(struct drm_device *dev, void *data, 
	reset_ppn_array(pdesc->strsPPNs, ARRAY_SIZE(pdesc->strsPPNs));



	/* Pin mksGuestStat user pages and store those in the instance descriptor */

	nr_pinned_stat = pin_user_pages(arg->stat, num_pages_stat, FOLL_LONGTERM, pages_stat, NULL);

	nr_pinned_stat = pin_user_pages_fast(arg->stat, num_pages_stat, FOLL_LONGTERM, pages_stat);

	if (num_pages_stat != nr_pinned_stat)

		goto err_pin_stat;



	for (i = 0; i < num_pages_stat; ++i)

		pdesc->statPPNs[i] = page_to_pfn(pages_stat[i]);



	nr_pinned_info = pin_user_pages(arg->info, num_pages_info, FOLL_LONGTERM, pages_info, NULL);

	nr_pinned_info = pin_user_pages_fast(arg->info, num_pages_info, FOLL_LONGTERM, pages_info);

	if (num_pages_info != nr_pinned_info)

		goto err_pin_info;



	for (i = 0; i < num_pages_info; ++i)

		pdesc->infoPPNs[i] = page_to_pfn(pages_info[i]);



	nr_pinned_strs = pin_user_pages(arg->strs, num_pages_strs, FOLL_LONGTERM, pages_strs, NULL);

	nr_pinned_strs = pin_user_pages_fast(arg->strs, num_pages_strs, FOLL_LONGTERM, pages_strs);

	if (num_pages_strs != nr_pinned_strs)

		goto err_pin_strs;