On 23/02/2021 15:51, Neil Roberts wrote:

When a buffer is madvised as not needed and then purged, any attempts to access the buffer from user-space should cause a bus fault. This patch adds a check for that.

Cc: stable@vger.kernel.org Fixes: 17acb9f35ed7 ("drm/shmem: Add madvise state and purge helpers") Signed-off-by: Neil Roberts nroberts@igalia.com

Reviewed-by: Steven Price steven.price@arm.com

---

drivers/gpu/drm/drm_gem_shmem_helper.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c index 9825c378dfa6..b26139b1dc35 100644 --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -525,14 +525,24 @@ static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf) struct drm_gem_object *obj = vma->vm_private_data; struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj); loff_t num_pages = obj->size >> PAGE_SHIFT;

• vm_fault_t ret; struct page *page;

• if (vmf->pgoff >= num_pages || WARN_ON_ONCE(!shmem->pages))

• return VM_FAULT_SIGBUS;
  

• mutex_lock(&shmem->pages_lock);
• if (vmf->pgoff >= num_pages ||

•    WARN_ON_ONCE(!shmem->pages) ||
  

•    shmem->madv < 0) {
  

• ret = VM_FAULT_SIGBUS;
  

• } else {

• page = shmem->pages[vmf->pgoff];
  

• page = shmem->pages[vmf->pgoff];

• ret = vmf_insert_page(vma, vmf->address, page);
  

• }

• return vmf_insert_page(vma, vmf->address, page);

• mutex_unlock(&shmem->pages_lock);
• return ret; }

static void drm_gem_shmem_vm_open(struct vm_area_struct *vma)