linux-kernel - Re: [PATCH] drm/i915: Fix page cleanup on DMA remap failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z4kZx1q2JLsdjjzY@intel.com>
Date: Thu, 16 Jan 2025 16:37:59 +0200
From: Ville Syrjälä <ville.syrjala@...ux.intel.com>
To: Brian Geffon <bgeffon@...gle.com>
Cc: intel-gfx@...ts.freedesktop.org, chris.p.wilson@...el.com,
	jani.saarinen@...el.com, tomasz.mistat@...el.com,
	vidya.srinivas@...el.com, jani.nikula@...ux.intel.com,
	linux-kernel@...r.kernel.org, dri-devel@...ts.freedesktop.org,
	Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>,
	Tomasz Figa <tfiga@...gle.com>
Subject: Re: [PATCH] drm/i915: Fix page cleanup on DMA remap failure

On Thu, Jan 16, 2025 at 04:24:26PM +0200, Ville Syrjälä wrote:
> On Thu, Jan 16, 2025 at 08:56:36AM -0500, Brian Geffon wrote:
> > When converting to folios the cleanup path of shmem_get_pages() was
> > missed. When a DMA remap fails and the max segment size is greater than
> > PAGE_SIZE it will attempt to retry the remap with a PAGE_SIZEd segment
> > size. The cleanup code isn't properly using the folio apis and as a
> > result isn't handling compound pages correctly.
> > 
> > Link: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/13487
> > Fixes: 0b62af28f249 ("i915: convert shmem_sg_free_table() to use a folio_batch")
> > Signed-off-by: Brian Geffon <bgeffon@...gle.com>
> > Suggested-by: Tomasz Figa <tfiga@...gle.com>
> > ---
> >  drivers/gpu/drm/i915/gem/i915_gem_shmem.c | 13 +++++--------
> >  1 file changed, 5 insertions(+), 8 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
> > index fe69f2c8527d..02ddab5bf5c0 100644
> > --- a/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
> > +++ b/drivers/gpu/drm/i915/gem/i915_gem_shmem.c
> > @@ -37,8 +37,6 @@ void shmem_sg_free_table(struct sg_table *st, struct address_space *mapping,
> >  	struct folio *last = NULL;
> >  	struct page *page;
> >  
> > -	mapping_clear_unevictable(mapping);
> > -
> 
> The assymmetry here between the alloc vs. free is a bit annoying.
> Maybe we can just keep this here? 

Actually, I guess it's a bit more than just annoying since
shmem_sg_free_table() is actually used from outside i915_gem_shmem.c
as well.

> 
> Or if avoiding the ping-pong actually mattes in the gtt prepare
> error case, then maybe we should rename this guy into
> __shmem_sg_free_table() without the mapping_clear_unevictable()
> and wrap it in a higher level shmem_sg_free_table() that does
> everything?
> 
> >  	folio_batch_init(&fbatch);
> >  	for_each_sgt_page(page, sgt_iter, st) {
> >  		struct folio *folio = page_folio(page);
> > @@ -180,10 +178,10 @@ int shmem_sg_alloc_table(struct drm_i915_private *i915, struct sg_table *st,
> >  	return 0;
> >  err_sg:
> >  	sg_mark_end(sg);
> > +	mapping_clear_unevictable(mapping);
> >  	if (sg != st->sgl) {
> >  		shmem_sg_free_table(st, mapping, false, false);
> >  	} else {
> > -		mapping_clear_unevictable(mapping);
> >  		sg_free_table(st);
> >  	}
> >  
> > @@ -209,8 +207,6 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj)
> >  	struct address_space *mapping = obj->base.filp->f_mapping;
> >  	unsigned int max_segment = i915_sg_segment_size(i915->drm.dev);
> >  	struct sg_table *st;
> > -	struct sgt_iter sgt_iter;
> > -	struct page *page;
> >  	int ret;
> >  
> >  	/*
> > @@ -239,9 +235,8 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj)
> >  		 * for PAGE_SIZE chunks instead may be helpful.
> >  		 */
> >  		if (max_segment > PAGE_SIZE) {
> > -			for_each_sgt_page(page, sgt_iter, st)
> > -				put_page(page);
> > -			sg_free_table(st);
> > +			/* Leave the mapping unevictable while we retry */
> > +			shmem_sg_free_table(st, mapping, false, false);
> >  			kfree(st);
> >  
> >  			max_segment = PAGE_SIZE;
> > @@ -265,6 +260,7 @@ static int shmem_get_pages(struct drm_i915_gem_object *obj)
> >  	return 0;
> >  
> >  err_pages:
> > +	mapping_clear_unevictable(mapping);
> >  	shmem_sg_free_table(st, mapping, false, false);
> >  	/*
> >  	 * shmemfs first checks if there is enough memory to allocate the page
> > @@ -402,6 +398,7 @@ void i915_gem_object_put_pages_shmem(struct drm_i915_gem_object *obj, struct sg_
> >  	if (i915_gem_object_needs_bit17_swizzle(obj))
> >  		i915_gem_object_save_bit_17_swizzle(obj, pages);
> >  
> > +	mapping_clear_unevictable(file_inode(obj->base.filp)->i_mapping);
> >  	shmem_sg_free_table(pages, file_inode(obj->base.filp)->i_mapping,
> >  			    obj->mm.dirty, obj->mm.madv == I915_MADV_WILLNEED);
> >  	kfree(pages);
> > -- 
> > 2.48.0.rc2.279.g1de40edade-goog
> 
> -- 
> Ville Syrjälä
> Intel

-- 
Ville Syrjälä
Intel