| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <6b039d9b-90a4-4527-9a6a-783137793d7f@suse.de>
Date: Mon, 18 Aug 2025 10:47:07 +0200
From: Thomas Zimmermann <tzimmermann@...e.de>
To: sumit.semwal@...aro.org, christian.koenig@....com, oushixiong@...inos.cn,
maarten.lankhorst@...ux.intel.com, mripard@...nel.org, airlied@...il.com,
simona@...ll.ch
Cc: dri-devel@...ts.freedesktop.org, linux-media@...r.kernel.org,
linaro-mm-sig@...ts.linaro.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm/gem-shmem: Pin and unpin buffers when importing w/o
S/G table
Am 15.08.25 um 08:02 schrieb Thomas Zimmermann:
> FYI this patch got feedback at
>
> https://lore.kernel.org/dri-devel/805acaca-3b91-438d-b842-25c055fd898c@amd.com/
>
>
> Preferably the problem should be addressed on GEM/PRIME code instead
> of dma-buf.
Follow-up patch is at
https://lore.kernel.org/dri-devel/20250818084148.212443-1-tzimmermann@suse.de/
>
> Best regards
> Thomas
>
> Am 14.08.25 um 09:34 schrieb Thomas Zimmermann:
>> Imported dma-buf objects need to be pinned while being vmap'ed into
>> kernel address space. This used to be done before while creating an
>> S/G table.
>>
>> GEM-SHMEN can import dma-buf objects without creating the S/G table,
>> but the pin/unpin is now missing. Leads to page-mapping errors such
>> as the one shown below.
>>
>> [ 102.101726] BUG: unable to handle page fault for address:
>> ffffc90127000000
>> [...]
>> [ 102.157102] RIP: 0010:udl_compress_hline16+0x219/0x940 [udl]
>> [...]
>> [ 102.243250] Call Trace:
>> [ 102.245695] <TASK>
>> [ 102.2477V95] ? validate_chain+0x24e/0x5e0
>> [ 102.251805] ? __lock_acquire+0x568/0xae0
>> [ 102.255807] udl_render_hline+0x165/0x341 [udl]
>> [ 102.260338] ? __pfx_udl_render_hline+0x10/0x10 [udl]
>> [ 102.265379] ? local_clock_noinstr+0xb/0x100
>> [ 102.269642] ? __lock_release.isra.0+0x16c/0x2e0
>> [ 102.274246] ? mark_held_locks+0x40/0x70
>> [ 102.278177] udl_primary_plane_helper_atomic_update+0x43e/0x680 [udl]
>> [ 102.284606] ?
>> __pfx_udl_primary_plane_helper_atomic_update+0x10/0x10 [udl]
>> [ 102.291551] ? lockdep_hardirqs_on_prepare.part.0+0x92/0x170
>> [ 102.297208] ? lockdep_hardirqs_on+0x88/0x130
>> [ 102.301554] ? _raw_spin_unlock_irq+0x24/0x50
>> [ 102.305901] ? wait_for_completion_timeout+0x2bb/0x3a0
>> [ 102.311028] ?
>> drm_atomic_helper_calc_timestamping_constants+0x141/0x200
>> [ 102.317714] ? drm_atomic_helper_commit_planes+0x3b6/0x1030
>> [ 102.323279] drm_atomic_helper_commit_planes+0x3b6/0x1030
>> [ 102.328664] drm_atomic_helper_commit_tail+0x41/0xb0
>> [ 102.333622] commit_tail+0x204/0x330
>> [...]
>> [ 102.529946] ---[ end trace 0000000000000000 ]---
>> [ 102.651980] RIP: 0010:udl_compress_hline16+0x219/0x940 [udl]
>>
>> Support pin/unpin in drm_buf_map_attachment() without creating an S/G
>> table. Passing DMA_NONE for the DMA direction will only pin. Do the
>> inverse for unmap_attachment(). Modify GEM-SHMEM accordingly, so that
>> it pins the imported dma-buf.
>>
>> Signed-off-by: Thomas Zimmermann <tzimmermann@...e.de>
>> Fixes: 660cd44659a0 ("drm/shmem-helper: Import dmabuf without mapping
>> its sg_table")
>> Reported-by: Thomas Zimmermann <tzimmermann@...e.de>
>> Closes:
>> https://lore.kernel.org/dri-devel/ba1bdfb8-dbf7-4372-bdcb-df7e0511c702@suse.de/
>> Cc: Shixiong Ou <oushixiong@...inos.cn>
>> Cc: Thomas Zimmermann <tzimmermann@...e.de>
>> Cc: Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>
>> Cc: Maxime Ripard <mripard@...nel.org>
>> Cc: David Airlie <airlied@...il.com>
>> Cc: Simona Vetter <simona@...ll.ch>
>> Cc: Sumit Semwal <sumit.semwal@...aro.org>
>> Cc: "Christian König" <christian.koenig@....com>
>> Cc: dri-devel@...ts.freedesktop.org
>> Cc: linux-media@...r.kernel.org
>> Cc: linaro-mm-sig@...ts.linaro.org
>> ---
>> drivers/dma-buf/dma-buf.c | 16 +++++++++++++---
>> drivers/gpu/drm/drm_gem_shmem_helper.c | 11 ++++++++++-
>> drivers/gpu/drm/drm_prime.c | 2 ++
>> 3 files changed, 25 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
>> index 2bcf9ceca997..f1e1385ce630 100644
>> --- a/drivers/dma-buf/dma-buf.c
>> +++ b/drivers/dma-buf/dma-buf.c
>> @@ -1086,7 +1086,8 @@ EXPORT_SYMBOL_NS_GPL(dma_buf_unpin, "DMA_BUF");
>> * @direction: [in] direction of DMA transfer
>> *
>> * Returns sg_table containing the scatterlist to be returned;
>> returns ERR_PTR
>> - * on error. May return -EINTR if it is interrupted by a signal.
>> + * on error. May return -EINTR if it is interrupted by a signal.
>> Returns NULL
>> + * on success iff direction is DMA_NONE.
>> *
>> * On success, the DMA addresses and lengths in the returned
>> scatterlist are
>> * PAGE_SIZE aligned.
>> @@ -1122,6 +1123,8 @@ struct sg_table *dma_buf_map_attachment(struct
>> dma_buf_attachment *attach,
>> if (ret)
>> return ERR_PTR(ret);
>> }
>> + if (!valid_dma_direction(direction))
>> + return NULL; /* only pin; don't map */
>> sg_table = attach->dmabuf->ops->map_dma_buf(attach, direction);
>> if (!sg_table)
>> @@ -1216,14 +1219,21 @@ void dma_buf_unmap_attachment(struct
>> dma_buf_attachment *attach,
>> {
>> might_sleep();
>> - if (WARN_ON(!attach || !attach->dmabuf || !sg_table))
>> + if (WARN_ON(!attach || !attach->dmabuf))
>> return;
>> dma_resv_assert_held(attach->dmabuf->resv);
>> + if (!valid_dma_direction(direction))
>> + goto unpin;
>> +
>> + if (WARN_ON(!sg_table))
>> + return;
>> +
>> mangle_sg_table(sg_table);
>> attach->dmabuf->ops->unmap_dma_buf(attach, sg_table, direction);
>> +unpin:
>> if (dma_buf_pin_on_map(attach))
>> attach->dmabuf->ops->unpin(attach);
>> }
>> @@ -1245,7 +1255,7 @@ void dma_buf_unmap_attachment_unlocked(struct
>> dma_buf_attachment *attach,
>> {
>> might_sleep();
>> - if (WARN_ON(!attach || !attach->dmabuf || !sg_table))
>> + if (WARN_ON(!attach || !attach->dmabuf))
>> return;
>> dma_resv_lock(attach->dmabuf->resv, NULL);
>> diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c
>> b/drivers/gpu/drm/drm_gem_shmem_helper.c
>> index 5d1349c34afd..1b66501420d3 100644
>> --- a/drivers/gpu/drm/drm_gem_shmem_helper.c
>> +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
>> @@ -817,6 +817,7 @@ struct drm_gem_object
>> *drm_gem_shmem_prime_import_no_map(struct drm_device *dev,
>> struct dma_buf *dma_buf)
>> {
>> struct dma_buf_attachment *attach;
>> + struct sg_table *sgt;
>> struct drm_gem_shmem_object *shmem;
>> struct drm_gem_object *obj;
>> size_t size;
>> @@ -838,12 +839,18 @@ struct drm_gem_object
>> *drm_gem_shmem_prime_import_no_map(struct drm_device *dev,
>> get_dma_buf(dma_buf);
>> + sgt = dma_buf_map_attachment_unlocked(attach, DMA_NONE);
>> + if (IS_ERR(sgt)) {
>> + ret = PTR_ERR(sgt);
>> + goto fail_detach;
>> + }
>> +
>> size = PAGE_ALIGN(attach->dmabuf->size);
>> shmem = __drm_gem_shmem_create(dev, size, true, NULL);
>> if (IS_ERR(shmem)) {
>> ret = PTR_ERR(shmem);
>> - goto fail_detach;
>> + goto fail_unmap;
>> }
>> drm_dbg_prime(dev, "size = %zu\n", size);
>> @@ -853,6 +860,8 @@ struct drm_gem_object
>> *drm_gem_shmem_prime_import_no_map(struct drm_device *dev,
>> return &shmem->base;
>> +fail_unmap:
>> + dma_buf_unmap_attachment_unlocked(attach, sgt, DMA_NONE);
>> fail_detach:
>> dma_buf_detach(dma_buf, attach);
>> dma_buf_put(dma_buf);
>> diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c
>> index 43a10b4af43a..b3b070868e3b 100644
>> --- a/drivers/gpu/drm/drm_prime.c
>> +++ b/drivers/gpu/drm/drm_prime.c
>> @@ -1109,6 +1109,8 @@ void drm_prime_gem_destroy(struct
>> drm_gem_object *obj, struct sg_table *sg)
>> attach = obj->import_attach;
>> if (sg)
>> dma_buf_unmap_attachment_unlocked(attach, sg,
>> DMA_BIDIRECTIONAL);
>> + else
>> + dma_buf_unmap_attachment_unlocked(attach, NULL, DMA_NONE);
>> dma_buf = attach->dmabuf;
>> dma_buf_detach(attach->dmabuf, attach);
>> /* remove the reference */
>
--
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)
Powered by blists - more mailing lists