On Mon, May 30, 2022 at 12:26 AM Thomas Zimmermann <tzimmermann@xxxxxxx> wrote: > > Hi > > Am 29.05.22 um 18:29 schrieb Rob Clark: > > From: Rob Clark <robdclark@xxxxxxxxxxxx> > > > > If a GEM object is allocated, and then exported as a dma-buf fd which is > > mmap'd before or without the GEM buffer being directly mmap'd, the > > vma_node could be unitialized. This leads to a situation where the CPU > > mapping is not correctly torn down in drm_vma_node_unmap(). > > Which drivers are affected by this problem? > > I checked several drivers and most appear to be initializing the offset > during object construction, such as GEM SHMEM. [1] TTM-based drivers > also seem unaffected. [2] > > From a quick grep, only etnaviv, msm and omapdrm appear to be affected? > They only seem to run drm_gem_create_mmap_offset() from their > ioctl-handling code. > > If so, I'd say it's preferable to fix these drivers and put a > drm_WARN_ONCE() into drm_gem_prime_mmap(). That is good if fewer drivers are affected, however I disagree with your proposal. At least for freedreno userspace, a lot of bo's never get mmap'd (either directly of via dmabuf), so we should not be allocating a mmap offset unnecessarily. BR, -R > Best regards > Thomas > > [1] > https://elixir.bootlin.com/linux/v5.18/source/drivers/gpu/drm/drm_gem_shmem_helper.c#L85 > [2] > https://elixir.bootlin.com/linux/v5.18/source/drivers/gpu/drm/ttm/ttm_bo.c#L1002 > > > > > Fixes: e5516553999f ("drm: call drm_gem_object_funcs.mmap with fake offset") > > Signed-off-by: Rob Clark <robdclark@xxxxxxxxxxxx> > > --- > > Note, it's possible the issue existed in some related form prior to the > > commit tagged with Fixes. > > > > drivers/gpu/drm/drm_prime.c | 5 +++++ > > 1 file changed, 5 insertions(+) > > > > diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c > > index e3f09f18110c..849eea154dfc 100644 > > --- a/drivers/gpu/drm/drm_prime.c > > +++ b/drivers/gpu/drm/drm_prime.c > > @@ -716,6 +716,11 @@ int drm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma) > > struct file *fil; > > int ret; > > > > + /* Ensure that the vma_node is initialized: */ > > + ret = drm_gem_create_mmap_offset(obj); > > + if (ret) > > + return ret; > > + > > /* Add the fake offset */ > > vma->vm_pgoff += drm_vma_node_start(&obj->vma_node); > > > > -- > Thomas Zimmermann > Graphics Driver Developer > SUSE Software Solutions Germany GmbH > Maxfeldstr. 5, 90409 Nürnberg, Germany > (HRB 36809, AG Nürnberg) > Geschäftsführer: Ivo Totev
