On Wed, 13 Sep 2023 03:56:14 +0300
Dmitry Osipenko <dmitry.osipenko@xxxxxxxxxxxxx> wrote:
> On 9/5/23 11:03, Boris Brezillon wrote:
> >> * But
> >> + * acquiring the obj lock in drm_gem_shmem_release_pages_locked() can
> >> + * cause a locking order inversion between reservation_ww_class_mutex
> >> + * and fs_reclaim.
> >> + *
> >> + * This deadlock is not actually possible, because no one should
> >> + * be already holding the lock when drm_gem_shmem_free() is called.
> >> + * Unfortunately lockdep is not aware of this detail. So when the
> >> + * refcount drops to zero, don't touch the reservation lock.
> >> + */
> >> + if (shmem->got_pages_sgt &&
> >> + refcount_dec_and_test(&shmem->pages_use_count)) {
> >> + drm_gem_shmem_do_release_pages_locked(shmem);
> >> + shmem->got_pages_sgt = false;
> >> }
> > Leaking memory is the right thing to do if pages_use_count > 1 (it's
> > better to leak than having someone access memory it no longer owns), but
> > I think it's worth mentioning in the above comment.
>
> It's unlikely that it will be only a leak without a following up
> use-after-free. Neither is acceptable.
Not necessarily, if you have a page leak, it could be that the GPU has
access to those pages, but doesn't need the GEM object anymore
(pages are mapped by the iommu, which doesn't need shmem->sgt or
shmem->pages after the mapping is created). Without a WARN_ON(), this
can go unnoticed and lead to memory corruptions/information leaks.
>
> The drm_gem_shmem_free() could be changed such that kernel won't blow up
> on a refcnt bug, but that's not worthwhile doing because drivers
> shouldn't have silly bugs.
We definitely don't want to fix that, but we want to complain loudly
(WARN_ON()), and make sure the risk is limited (preventing memory from
being re-assigned to someone else by not freeing it).
