linux-kernel - Re: [PATCH AUTOSEL 5.2 13/23] drm/i915/userptr: Acquire the page lock around set_page

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <36993214-6ce7-260f-68c7-6fbb0630143f@mageia.org>
Date:   Thu, 12 Sep 2019 23:51:33 +0300
From:   Thomas Backlund <tmb@...eia.org>
To:     Sasha Levin <sashal@...nel.org>, <linux-kernel@...r.kernel.org>,
        <stable@...r.kernel.org>
CC:     Jani Nikula <jani.nikula@...el.com>,
        <intel-gfx@...ts.freedesktop.org>,
        <dri-devel@...ts.freedesktop.org>
Subject: Re: [PATCH AUTOSEL 5.2 13/23] drm/i915/userptr: Acquire the page lock
 around set_page_dirty()

Den 03-09-2019 kl. 19:24, skrev Sasha Levin:
> From: Chris Wilson <chris@...is-wilson.co.uk>
> 
> [ Upstream commit aa56a292ce623734ddd30f52d73f527d1f3529b5 ]
> 
> set_page_dirty says:
> 
> 	For pages with a mapping this should be done under the page lock
> 	for the benefit of asynchronous memory errors who prefer a
> 	consistent dirty state. This rule can be broken in some special
> 	cases, but should be better not to.
> 
> Under those rules, it is only safe for us to use the plain set_page_dirty
> calls for shmemfs/anonymous memory. Userptr may be used with real
> mappings and so needs to use the locked version (set_page_dirty_lock).
> 
> Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203317
> Fixes: 5cc9ed4b9a7a ("drm/i915: Introduce mapping of user pages into video memory (userptr) ioctl")
> References: 6dcc693bc57f ("ext4: warn when page is dirtied without buffers")
> Signed-off-by: Chris Wilson <chris@...is-wilson.co.uk>
> Cc: Tvrtko Ursulin <tvrtko.ursulin@...el.com>
> Cc: stable@...r.kernel.org
> Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@...el.com>
> Link: https://patchwork.freedesktop.org/patch/msgid/20190708140327.26825-1-chris@chris-wilson.co.uk
> (cherry picked from commit cb6d7c7dc7ff8cace666ddec66334117a6068ce2)
> Signed-off-by: Jani Nikula <jani.nikula@...el.com>
> Signed-off-by: Sasha Levin <sashal@...nel.org>
> ---
>   drivers/gpu/drm/i915/i915_gem_userptr.c | 10 +++++++++-
>   1 file changed, 9 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c b/drivers/gpu/drm/i915/i915_gem_userptr.c
> index 8079ea3af1039..b1fc15c7f5997 100644
> --- a/drivers/gpu/drm/i915/i915_gem_userptr.c
> +++ b/drivers/gpu/drm/i915/i915_gem_userptr.c
> @@ -678,7 +678,15 @@ i915_gem_userptr_put_pages(struct drm_i915_gem_object *obj,
>   
>   	for_each_sgt_page(page, sgt_iter, pages) {
>   		if (obj->mm.dirty)
> -			set_page_dirty(page);
> +			/*
> +			 * As this may not be anonymous memory (e.g. shmem)
> +			 * but exist on a real mapping, we have to lock
> +			 * the page in order to dirty it -- holding
> +			 * the page reference is not sufficient to
> +			 * prevent the inode from being truncated.
> +			 * Play safe and take the lock.
> +			 */
> +			set_page_dirty_lock(page);
>   
>   		mark_page_accessed(page);
>   		put_page(page);
> 


Please drop this one from all 5.2 and 4.19 stable queues

It has now been reverted in Linus tree:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=505a8ec7e11ae5236c4a154a1e24ef49a8349600

--
Thomas