A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 06:09:23 -04:00
Code Issues Projects Releases Packages Wiki Activity

drm/shmem-helper: Check for purged buffers in fault handler

Browse source 
commit d611b4a0907cece060699f2fd347c492451cd2aa upstream.

When a buffer is madvised as not needed and then purged, any attempts to
access the buffer from user-space should cause a bus fault. This patch
adds a check for that.

Cc: stable@vger.kernel.org
Fixes: 17acb9f35e ("drm/shmem: Add madvise state and purge helpers")
Signed-off-by: Neil Roberts <nroberts@igalia.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210223155125.199577-2-nroberts@igalia.com
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Neil Roberts 2021-02-23 16:51:24 +01:00 • committed by Greg Kroah-Hartman
commit 0d574fc463
1 changed files with 14 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

18
drivers/gpu/drm/drm_gem_shmem_helper.c
View file

@ -474,14 +474,24 @@ static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf)
struct drm_gem_object *obj = vma->vm_private_data;
struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj);
loff_t num_pages = obj->size >> PAGE_SHIFT;
vm_fault_t ret;
struct page *page;
if (vmf->pgoff >= num_pages || WARN_ON_ONCE(!shmem->pages))
return VM_FAULT_SIGBUS;
mutex_lock(&shmem->pages_lock);
page = shmem->pages[vmf->pgoff];
if (vmf->pgoff >= num_pages ||
WARN_ON_ONCE(!shmem->pages) ||
shmem->madv < 0) {
ret = VM_FAULT_SIGBUS;
} else {
page = shmem->pages[vmf->pgoff];
return vmf_insert_page(vma, vmf->address, page);
ret = vmf_insert_page(vma, vmf->address, page);
}
mutex_unlock(&shmem->pages_lock);
return ret;
}
static void drm_gem_shmem_vm_open(struct vm_area_struct *vma)