linux-kernel - [PATCH] Revert "drm/i915/userptr: Acquire the page lock around set_page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190912125634.29054-1-chris@chris-wilson.co.uk>
Date:   Thu, 12 Sep 2019 13:56:34 +0100
From:   Chris Wilson <chris@...is-wilson.co.uk>
To:     intel-gfx@...ts.freedesktop.org, torvalds@...ux-foundation.org
Cc:     Martin.Wilck@...e.com, MKoutny@...e.com, leho@...av.com,
        tiwai@...e.de, linux-kernel@...r.kernel.org,
        Chris Wilson <chris@...is-wilson.co.uk>,
        Lionel Landwerlin <lionel.g.landwerlin@...el.com>,
        Tvrtko Ursulin <tvrtko.ursulin@...el.com>,
        Jani Nikula <jani.nikula@...el.com>,
        Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>,
        stable@...r.kernel.org
Subject: [PATCH] Revert "drm/i915/userptr: Acquire the page lock around set_page_dirty()"

The userptr put_pages can be called from inside try_to_unmap, and so
enters with the page lock held on one of the object's backing pages. We
cannot take the page lock ourselves for fear of recursion.

Reported-by: Lionel Landwerlin <lionel.g.landwerlin@...el.com>
Reported-by: Martin Wilck <Martin.Wilck@...e.com>
Reported-by: Leo Kraav <leho@...av.com>
Fixes: aa56a292ce62 ("drm/i915/userptr: Acquire the page lock around set_page_dirty()")
References: https://bugzilla.kernel.org/show_bug.cgi?id=203317
Signed-off-by: Chris Wilson <chris@...is-wilson.co.uk>
Cc: Tvrtko Ursulin <tvrtko.ursulin@...el.com>
Cc: Jani Nikula <jani.nikula@...el.com>
Cc: Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>
Cc: stable@...r.kernel.org
---
 drivers/gpu/drm/i915/gem/i915_gem_userptr.c | 10 +---------
 1 file changed, 1 insertion(+), 9 deletions(-)

diff --git a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
index 74da35611d7c..11b231c187c5 100644
--- a/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_userptr.c
@@ -672,15 +672,7 @@ i915_gem_userptr_put_pages(struct drm_i915_gem_object *obj,
 
 	for_each_sgt_page(page, sgt_iter, pages) {
 		if (obj->mm.dirty)
-			/*
-			 * As this may not be anonymous memory (e.g. shmem)
-			 * but exist on a real mapping, we have to lock
-			 * the page in order to dirty it -- holding
-			 * the page reference is not sufficient to
-			 * prevent the inode from being truncated.
-			 * Play safe and take the lock.
-			 */
-			set_page_dirty_lock(page);
+			set_page_dirty(page);
 
 		mark_page_accessed(page);
 		put_page(page);
-- 
2.23.0