drm/xe/userptr: Unmap userptrs in the mmu notifier

Browse source

If userptr pages are freed after a call to the xe mmu notifier,
the device will not be blocked out from theoretically accessing
these pages unless they are also unmapped from the iommu, and
this violates some aspects of the iommu-imposed security.

Ensure that userptrs are unmapped in the mmu notifier to
mitigate this. A naive attempt would try to free the sg table, but
the sg table itself may be accessed by a concurrent bind
operation, so settle for only unmapping.

v3:
- Update lockdep asserts.
- Fix a typo (Matthew Auld)

Fixes: 81e058a3e7 ("drm/xe: Introduce helper to populate userptr")
Cc: Oak Zeng <oak.zeng@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Cc: <stable@vger.kernel.org> # v6.10+
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Acked-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250304173342.22009-4-thomas.hellstrom@linux.intel.com
(cherry picked from commit ba767b9d01)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

...

This commit is contained in:

Thomas Hellström 2025-03-04 18:33:42 +01:00 • committed by Rodrigo Vivi

parent 0a98219bcc

commit 333b890633

No known key found for this signature in database

GPG key ID: FA625F640EEB13CA

4 changed files with 52 additions and 9 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

51

drivers/gpu/drm/xe/xe_hmm.c

View file

2

drivers/gpu/drm/xe/xe_hmm.h

View file

4

drivers/gpu/drm/xe/xe_vm.c

View file

4

drivers/gpu/drm/xe/xe_vm_types.h

View file