drm/shmem-helper: Check for purged buffers in fault handler

When a buffer is madvised as not needed and then purged, any attempts to
access the buffer from user-space should cause a bus fault. This patch
adds a check for that.

Cc: stable@vger.kernel.org
Fixes: b137feb7dbde ("drm/shmem: Add madvise state and purge helpers")
Signed-off-by: Neil Roberts <nroberts@igalia.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Signed-off-by: Steven Price <steven.price@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210223155125.199577-2-nroberts@igalia.com
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>

diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c
index 9825c378dfa6dabfe0fcb26e7335134feb2ab03b..b26139b1dc35ccc34f8b5eb0a91d3aa9226ee1a6 100644 (file)
--- a/drivers/gpu/drm/drm_gem_shmem_helper.c
+++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
@@ -525,14 +525,24 @@ static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf)
        struct drm_gem_object *obj = vma->vm_private_data;
        struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj);
        loff_t num_pages = obj->size >> PAGE_SHIFT;
+       vm_fault_t ret;
        struct page *page;
 
-       if (vmf->pgoff >= num_pages || WARN_ON_ONCE(!shmem->pages))
-               return VM_FAULT_SIGBUS;
+       mutex_lock(&shmem->pages_lock);
+
+       if (vmf->pgoff >= num_pages ||
+           WARN_ON_ONCE(!shmem->pages) ||
+           shmem->madv < 0) {
+               ret = VM_FAULT_SIGBUS;
+       } else {
+               page = shmem->pages[vmf->pgoff];
 
-       page = shmem->pages[vmf->pgoff];
+               ret = vmf_insert_page(vma, vmf->address, page);
+       }
 
-       return vmf_insert_page(vma, vmf->address, page);
+       mutex_unlock(&shmem->pages_lock);
+
+       return ret;
 }
 
 static void drm_gem_shmem_vm_open(struct vm_area_struct *vma)