The patch titled Subject: drm/amdgpu: untag user pointers has been added to the -mm tree. Its filename is drm-amdgpu-untag-user-pointers.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/drm-amdgpu-untag-user-pointers.patch and later at http://ozlabs.org/~akpm/mmotm/broken-out/drm-amdgpu-untag-user-pointers.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Andrey Konovalov <andreyknvl@xxxxxxxxxx> Subject: drm/amdgpu: untag user pointers This patch is a part of a series that extends kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments. In amdgpu_gem_userptr_ioctl() and amdgpu_amdkfd_gpuvm.c/init_user_pages() an MMU notifier is set up with a (tagged) userspace pointer. The untagged address should be used so that MMU notifiers for the untagged address get correctly matched up with the right BO. This patch untag user pointers in amdgpu_gem_userptr_ioctl() for the GEM case and in amdgpu_amdkfd_gpuvm_ alloc_memory_of_gpu() for the KFD case. This also makes sure that an untagged pointer is passed to amdgpu_ttm_tt_get_user_pages(), which uses it for vma lookups. Link: http://lkml.kernel.org/r/d684e1df08f2ecb6bc292e222b64fa9efbc26e69.1563904656.git.andreyknvl@xxxxxxxxxx Signed-off-by: Andrey Konovalov <andreyknvl@xxxxxxxxxx> Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx> Suggested-by: Felix Kuehling <Felix.Kuehling@xxxxxxx> Acked-by: Felix Kuehling <Felix.Kuehling@xxxxxxx> Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx> Cc: Catalin Marinas <catalin.marinas@xxxxxxx> Cc: Dave Hansen <dave.hansen@xxxxxxxxx> Cc: Eric Auger <eric.auger@xxxxxxxxxx> Cc: Jens Wiklander <jens.wiklander@xxxxxxxxxx> Cc: Khalid Aziz <khalid.aziz@xxxxxxxxxx> Cc: Mauro Carvalho Chehab <mchehab+samsung@xxxxxxxxxx> Cc: Mike Rapoport <rppt@xxxxxxxxxxxxx> Cc: Vincenzo Frascino <vincenzo.frascino@xxxxxxx> Cc: Will Deacon <will@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c~drm-amdgpu-untag-user-pointers +++ a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c @@ -1103,7 +1103,7 @@ int amdgpu_amdkfd_gpuvm_alloc_memory_of_ alloc_flags = 0; if (!offset || !*offset) return -EINVAL; - user_addr = *offset; + user_addr = untagged_addr(*offset); } else if (flags & (ALLOC_MEM_FLAGS_DOORBELL | ALLOC_MEM_FLAGS_MMIO_REMAP)) { domain = AMDGPU_GEM_DOMAIN_GTT; --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c~drm-amdgpu-untag-user-pointers +++ a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c @@ -291,6 +291,8 @@ int amdgpu_gem_userptr_ioctl(struct drm_ uint32_t handle; int r; + args->addr = untagged_addr(args->addr); + if (offset_in_page(args->addr | args->size)) return -EINVAL; _ Patches currently in -mm which might be from andreyknvl@xxxxxxxxxx are lib-untag-user-pointers-in-strn_user.patch mm-untag-user-pointers-passed-to-memory-syscalls.patch mm-untag-user-pointers-in-mm-gupc.patch mm-untag-user-pointers-in-get_vaddr_frames.patch fs-namespace-untag-user-pointers-in-copy_mount_options.patch userfaultfd-untag-user-pointers.patch drm-amdgpu-untag-user-pointers.patch drm-radeon-untag-user-pointers-in-radeon_gem_userptr_ioctl.patch media-v4l2-core-untag-user-pointers-in-videobuf_dma_contig_user_get.patch tee-shm-untag-user-pointers-in-tee_shm_register.patch vfio-type1-untag-user-pointers-in-vaddr_get_pfn.patch