From: Max Zhen max.zhen@amd.com

Holding mmap_read_lock across user buffer VMA checking and page pinning. This keeps VMA validation and user page pinning synchronized with mmap updates.

Also adding the check for VM_MAYWRITE to make sure the mapping can't be updated to writable after pinning of the pages.

Fixes: f649e63d4a64 ("accel/amdxdna: Support read-only user-pointer BO mappings") Signed-off-by: Max Zhen max.zhen@amd.com Signed-off-by: Lizhi Hou lizhi.hou@amd.com --- drivers/accel/amdxdna/amdxdna_ubuf.c | 34 ++++++++++++++++------------ 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/drivers/accel/amdxdna/amdxdna_ubuf.c b/drivers/accel/amdxdna/amdxdna_ubuf.c index df4ab225fbf9..85c3d6f46845 100644 --- a/drivers/accel/amdxdna/amdxdna_ubuf.c +++ b/drivers/accel/amdxdna/amdxdna_ubuf.c @@ -99,17 +99,13 @@ static int readonly_va_entry(struct amdxdna_drm_va_entry *va_ent) struct vm_area_struct *vma; int ret;

- mmap_read_lock(mm); - vma = find_vma(mm, va_ent->vaddr); if (!vma || vma->vm_start > va_ent->vaddr || vma->vm_end - va_ent->vaddr < va_ent->len) ret = -ENOENT; else - ret = vma->vm_flags & VM_WRITE ? 0 : 1; - - mmap_read_unlock(mm); + ret = vma->vm_flags & (VM_WRITE | VM_MAYWRITE) ? 0 : 1; return ret; }

@@ -123,7 +119,7 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev, u32 npages, start = 0; struct dma_buf *dbuf; bool readonly = true; - int i, ret; + int i, ret = 0; DEFINE_DMA_BUF_EXPORT_INFO(exp_info);

if (!can_do_mlock()) @@ -161,10 +157,6 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev, ret = -EINVAL; goto free_ent; } - - /* Pin pages as writable as long as not all entries are read-only. */ - if (readonly && readonly_va_entry(&va_ent[i]) != 1) - readonly = false; }

ubuf->nr_pages = exp_info.size >> PAGE_SHIFT; @@ -183,25 +175,37 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev, goto sub_pin_cnt; }

+ mmap_read_lock(current->mm); + + for (i = 0; i < num_entries; i++) { + /* Pin pages as writable as long as not all entries are read-only. */ + if (readonly && readonly_va_entry(&va_ent[i]) != 1) + readonly = false; + } for (i = 0; i < num_entries; i++) { npages = va_ent[i].len >> PAGE_SHIFT;

- ret = pin_user_pages_fast(va_ent[i].vaddr, npages, - (readonly ? 0 : FOLL_WRITE) | FOLL_LONGTERM, - &ubuf->pages[start]); + ret = pin_user_pages(va_ent[i].vaddr, npages, + (readonly ? 0 : FOLL_WRITE) | FOLL_LONGTERM, + &ubuf->pages[start]); if (ret >= 0) { start += ret; if (ret != npages) { XDNA_ERR(xdna, "Partially pinned pages %d/%u", ret, npages); ret = -ENOMEM; - goto destroy_pages; + break; } } else { XDNA_ERR(xdna, "Failed to pin pages ret %d", ret); - goto destroy_pages; + break; } }

+ mmap_read_unlock(current->mm); + + if (ret < 0) + goto destroy_pages; + exp_info.ops = &amdxdna_ubuf_dmabuf_ops; exp_info.priv = ubuf; exp_info.flags = (readonly ? O_RDONLY : O_RDWR) | O_CLOEXEC;