This is a note to let you know that I've just added the patch titled drm/shmem-helper: Check for purged buffers in fault handler to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: drm-shmem-helper-check-for-purged-buffers-in-fault-handler.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From d611b4a0907cece060699f2fd347c492451cd2aa Mon Sep 17 00:00:00 2001 From: Neil Roberts <nroberts@xxxxxxxxxx> Date: Tue, 23 Feb 2021 16:51:24 +0100 Subject: drm/shmem-helper: Check for purged buffers in fault handler From: Neil Roberts <nroberts@xxxxxxxxxx> commit d611b4a0907cece060699f2fd347c492451cd2aa upstream. When a buffer is madvised as not needed and then purged, any attempts to access the buffer from user-space should cause a bus fault. This patch adds a check for that. Cc: stable@xxxxxxxxxxxxxxx Fixes: 17acb9f35ed7 ("drm/shmem: Add madvise state and purge helpers") Signed-off-by: Neil Roberts <nroberts@xxxxxxxxxx> Reviewed-by: Steven Price <steven.price@xxxxxxx> Signed-off-by: Steven Price <steven.price@xxxxxxx> Link: https://patchwork.freedesktop.org/patch/msgid/20210223155125.199577-2-nroberts@xxxxxxxxxx Signed-off-by: Maarten Lankhorst <maarten.lankhorst@xxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/gpu/drm/drm_gem_shmem_helper.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -474,14 +474,24 @@ static vm_fault_t drm_gem_shmem_fault(st struct drm_gem_object *obj = vma->vm_private_data; struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj); loff_t num_pages = obj->size >> PAGE_SHIFT; + vm_fault_t ret; struct page *page; - if (vmf->pgoff >= num_pages || WARN_ON_ONCE(!shmem->pages)) - return VM_FAULT_SIGBUS; + mutex_lock(&shmem->pages_lock); - page = shmem->pages[vmf->pgoff]; + if (vmf->pgoff >= num_pages || + WARN_ON_ONCE(!shmem->pages) || + shmem->madv < 0) { + ret = VM_FAULT_SIGBUS; + } else { + page = shmem->pages[vmf->pgoff]; - return vmf_insert_page(vma, vmf->address, page); + ret = vmf_insert_page(vma, vmf->address, page); + } + + mutex_unlock(&shmem->pages_lock); + + return ret; } static void drm_gem_shmem_vm_open(struct vm_area_struct *vma) Patches currently in stable-queue which might be from nroberts@xxxxxxxxxx are queue-5.4/drm-shmem-helper-don-t-remove-the-offset-in-vm_area_struct-pgoff.patch queue-5.4/drm-shmem-helper-check-for-purged-buffers-in-fault-handler.patch