summaryrefslogtreecommitdiffstats
path: root/drivers/dma-buf/udmabuf.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* udmabuf: validate ubuf->pagecountPavel Skripkin2022-01-181-0/+4
| | | | | | | | | | | | | | | | | | Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The problem was in ubuf->pages == ZERO_PTR. ubuf->pagecount is calculated from arguments passed from user-space. If user creates udmabuf with list.size == 0 then ubuf->pagecount will be also equal to zero; it causes kmalloc_array() to return ZERO_PTR. Fix it by validating ubuf->pagecount before passing it to kmalloc_array(). Fixes: fbb0de795078 ("Add udmabuf misc device") Reported-and-tested-by: syzbot+2c56b725ec547fa9cb29@syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Link: http://patchwork.freedesktop.org/patch/msgid/20211230142649.23022-1-paskripkin@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* udmabuf: fix general protection fault in udmabuf_createPavel Skripkin2021-08-121-2/+2
| | | | | | | | | | | | | | | | | | Syzbot reported general protection fault in udmabuf_create. The problem was in wrong error handling. In commit 16c243e99d33 ("udmabuf: Add support for mapping hugepages (v4)") shmem_read_mapping_page() call was replaced with find_get_page_flags(), but find_get_page_flags() returns NULL on failure instead PTR_ERR(). Wrong error checking was causing GPF in get_page(), since passed page was equal to NULL. Fix it by changing if (IS_ER(!hpage)) to if (!hpage) Reported-by: syzbot+e9cd3122a37c5d6c51e8@syzkaller.appspotmail.com Fixes: 16c243e99d33 ("udmabuf: Add support for mapping hugepages (v4)") Signed-off-by: Pavel Skripkin <paskripkin@gmail.com> Link: http://patchwork.freedesktop.org/patch/msgid/20210811175052.21254-1-paskripkin@gmail.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* udmabuf: configurable list_limit and size_limit_mbDongwon Kim2021-06-231-2/+7
| | | | | | | | | | | | | | Default list_limit and size_limit_mb are not big enough to cover all possible use cases. For example, list_limit could be well over its default, 1024 if only one or several pages are chained in all individual list entries when creating dmabuf backed by >4MB buffer. list_limit and size_limit_mb are now defined as module parameters so that those can be optionally configured by root with proper values to remove these constraints. Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Link: http://patchwork.freedesktop.org/patch/msgid/20210611212107.9876-1-dongwon.kim@intel.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* udmabuf: Add support for mapping hugepages (v4)Vivek Kasireddy2021-06-101-7/+43
| | | | | | | | | | | | | | | | | | | | | | | | If the VMM's (Qemu) memory backend is backed up by memfd + Hugepages (hugetlbfs and not THP), we have to first find the hugepage(s) where the Guest allocations are located and then extract the regular 4k sized subpages from them. v2: Ensure that the subpage and hugepage offsets are calculated correctly when the range of subpage allocations cuts across multiple hugepages. v3: Instead of repeatedly looking up the hugepage for each subpage, only do it when the subpage allocation crosses over into a different hugepage. (suggested by Gerd and DW) v4: Fix the following warning identified by checkpatch: CHECK:OPEN_ENDED_LINE: Lines should not end with a '(' Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com> Signed-off-by: Dongwon Kim <dongwon.kim@intel.com> Link: http://patchwork.freedesktop.org/patch/msgid/20210609182915.592743-1-vivek.kasireddy@intel.com [ kraxel: one more checkpatch format tweak ] Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* Merge tag 'drm-misc-next-2020-09-21' of ↵Dave Airlie2020-09-231-0/+3
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://anongit.freedesktop.org/drm/drm-misc into drm-next drm-misc-next for 5.10: UAPI Changes: Cross-subsystem Changes: - virtio: Merged a PR for patches that will affect drm/virtio Core Changes: - dev: More devm_drm convertions and removal of drm_dev_init - atomic: Split out drm_atomic_helper_calc_timestamping_constants of drm_atomic_helper_update_legacy_modeset_state - ttm: More rework Driver Changes: - i915: selftests improvements - panfrost: support for Amlogic SoC - vc4: one fix - tree-wide: conversions to devm_drm_dev_alloc, - ast: simplifications of the atomic modesetting code - panfrost: multiple fixes - vc4: multiple fixes Signed-off-by: Dave Airlie <airlied@redhat.com> From: Maxime Ripard <maxime@cerno.tech> Link: https://patchwork.freedesktop.org/patch/msgid/20200921152956.2gxnsdgxmwhvjyut@gilmour.lan
| * udmabuf: Add missing compact_ioctlKristian H. Kristensen2020-09-071-0/+3
| | | | | | | | | | | | | | | | Make sure we can use this on mixed systems. Signed-off-by: Kristian H. Kristensen <hoegsberg@google.com> Link: http://patchwork.freedesktop.org/patch/msgid/20200903181652.432067-1-hoegsberg@google.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* | dmabuf: fix common struct sg_table related issuesMarek Szyprowski2020-09-101-4/+3
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | The Documentation/DMA-API-HOWTO.txt states that the dma_map_sg() function returns the number of the created entries in the DMA address space. However the subsequent calls to the dma_sync_sg_for_{device,cpu}() and dma_unmap_sg must be called with the original number of the entries passed to the dma_map_sg(). struct sg_table is a common structure used for describing a non-contiguous memory buffer, used commonly in the DRM and graphics subsystems. It consists of a scatterlist with memory pages and DMA addresses (sgl entry), as well as the number of scatterlist entries: CPU pages (orig_nents entry) and DMA mapped pages (nents entry). It turned out that it was a common mistake to misuse nents and orig_nents entries, calling DMA-mapping functions with a wrong number of entries or ignoring the number of mapped entries returned by the dma_map_sg() function. To avoid such issues, lets use a common dma-mapping wrappers operating directly on the struct sg_table objects and use scatterlist page iterators where possible. This, almost always, hides references to the nents and orig_nents entries, making the code robust, easier to follow and copy/paste safe. Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com>
* udmabuf: fix dma-buf cpu accessGurchetan Singh2019-12-181-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | I'm just going to put Chia's review comment here since it sums the issue rather nicely: "(1) Semantically, a dma-buf is in DMA domain. CPU access from the importer must be surrounded by {begin,end}_cpu_access. This gives the exporter a chance to move the buffer to the CPU domain temporarily. (2) When the exporter itself has other means to do CPU access, it is only reasonable for the exporter to move the buffer to the CPU domain before access, and to the DMA domain after access. The exporter can potentially reuse {begin,end}_cpu_access for that purpose. Because of (1), udmabuf does need to implement the {begin,end}_cpu_access hooks. But "begin" should mean dma_sync_sg_for_cpu and "end" should mean dma_sync_sg_for_device. Because of (2), if userspace wants to continuing accessing through the memfd mapping, it should call udmabuf's {begin,end}_cpu_access to avoid cache issues." Reported-by: Chia-I Wu <olvaffe@gmail.com> Suggested-by: Chia-I Wu <olvaffe@gmail.com> Fixes: 284562e1f348 ("udmabuf: implement begin_cpu_access/end_cpu_access hooks") Signed-off-by: Gurchetan Singh <gurchetansingh@chromium.org> Link: http://patchwork.freedesktop.org/patch/msgid/20191217230228.453-1-gurchetansingh@chromium.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* udmabuf: implement begin_cpu_access/end_cpu_access hooksGurchetan Singh2019-12-051-0/+39
| | | | | | | | | | | | With the misc device, we should end up using the result of get_arch_dma_ops(..) or dma-direct ops. This can allow us to have WC mappings in the guest after synchronization. Signed-off-by: Gurchetan Singh <gurchetansingh@chromium.org> Link: http://patchwork.freedesktop.org/patch/msgid/20191203013627.85991-4-gurchetansingh@chromium.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* udmabuf: separate out creating/destroying scatter-tableGurchetan Singh2019-12-051-7/+19
| | | | | | | | These are nice functions and can be re-used. Signed-off-by: Gurchetan Singh <gurchetansingh@chromium.org> Link: http://patchwork.freedesktop.org/patch/msgid/20191203013627.85991-3-gurchetansingh@chromium.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* udmabuf: add a pointer to the miscdevice in dma-buf private dataGurchetan Singh2019-12-051-4/+7
| | | | | | | | | | Will be used later. v2: rename 'udmabuf_misc' to 'device' (kraxel) Signed-off-by: Gurchetan Singh <gurchetansingh@chromium.org> Link: http://patchwork.freedesktop.org/patch/msgid/20191203013627.85991-2-gurchetansingh@chromium.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* udmabuf: use cache_sgt_mapping optionGurchetan Singh2019-12-051-4/+5
| | | | | | | | | The GEM prime helpers do it, so should we. It's also possible to make it optional later. Signed-off-by: Gurchetan Singh <gurchetansingh@chromium.org> Link: http://patchwork.freedesktop.org/patch/msgid/20191203013627.85991-1-gurchetansingh@chromium.org Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* udmabuf: Remove deleted map/unmap handlers.Maarten Lankhorst2019-11-261-16/+0
| | | | | | | | | | | | | | | Commit 7f0de8d80816 ("dma-buf: Drop dma_buf_k(un)map") removed map/unmap handlers, but they still existed in udmabuf. Remove them there as well Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com> Fixes: 7f0de8d80816 ("dma-buf: Drop dma_buf_k(un)map") Cc: Sumit Semwal <sumit.semwal@linaro.org> Cc: Daniel Vetter <daniel.vetter@intel.com> Cc: linux-media@vger.kernel.org Cc: linaro-mm-sig@lists.linaro.org Cc: dri-devel@lists.freedesktop.org Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20191126142516.630200-1-maarten.lankhorst@linux.intel.com
* udmabuf: actually unmap the scatterlistLucas Stach2019-06-051-0/+1
| | | | | | | | | | unmap_udmabuf fails to actually unmap the scatterlist, leaving dangling mappings around. Fixes: fbb0de795078 ("Add udmabuf misc device") Signed-off-by: Lucas Stach <l.stach@pengutronix.de> Link: http://patchwork.freedesktop.org/patch/msgid/20190604202331.17482-1-l.stach@pengutronix.de Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* drivers/dma-buf/udmabuf.c: convert to use vm_fault_tSouptick Joarder2019-01-041-1/+1
| | | | | | | | | | | Use new return type vm_fault_t for fault handler. Link: http://lkml.kernel.org/r/20181106173628.GA12989@jordon-HP-15-Notebook-PC Signed-off-by: Souptick Joarder <jrdr.linux@gmail.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Sumit Semwal <sumit.semwal@linaro.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* udmabuf: set read/write flag when exportingGerd Hoffmann2018-11-161-0/+1
| | | | | | | | | | Otherwise, mmap fails when done with PROT_WRITE. Suggested-by: Gurchetan Singh <gurchetansingh@chromium.org> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Gurchetan Singh <gurchetansingh@chromium.org> Tested-by: Gurchetan Singh <gurchetansingh@chromium.org> Link: http://patchwork.freedesktop.org/patch/msgid/20181114122029.16766-1-kraxel@redhat.com
* udmabuf: fix error code in map_udmabuf()Dan Carpenter2018-09-141-1/+3
| | | | | | | | | | We accidentally forgot to set "ret" on this error path so it means we return NULL instead of an error pointer. The caller checks for NULL and changes it to an error pointer so it doesn't cause an issue at run time. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Link: http://patchwork.freedesktop.org/patch/msgid/20180914065615.GA12043@mwanda Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* udmabuf: use sizeof(variable) instead of sizeof(type)Gerd Hoffmann2018-09-121-3/+3
| | | | | | | Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: http://patchwork.freedesktop.org/patch/msgid/20180911134216.9760-13-kraxel@redhat.com
* udmabuf: drop WARN_ON() check.Gerd Hoffmann2018-09-121-3/+0
| | | | | | | Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Link: http://patchwork.freedesktop.org/patch/msgid/20180911134216.9760-12-kraxel@redhat.com
* udmabuf: use ENOTTY for invalid ioctlsGerd Hoffmann2018-09-121-1/+1
| | | | | | | | Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/20180911134216.9760-11-kraxel@redhat.com
* udmabuf: use EBADFD in case we didn't got a memfdGerd Hoffmann2018-09-121-2/+5
| | | | | | | Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/20180911134216.9760-10-kraxel@redhat.com
* udmabuf: improve udmabuf_create error handlingGerd Hoffmann2018-09-121-13/+12
| | | | | | | | Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/20180911134216.9760-9-kraxel@redhat.com
* udmabuf: rework limitsGerd Hoffmann2018-09-121-2/+8
| | | | | | | | | | | Create variable for the list length limit. Serves as documentation, also allows to make it a module parameter if needed. Also add a total size limit. Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/20180911134216.9760-8-kraxel@redhat.com
* udmabuf: constify udmabuf_create argsGerd Hoffmann2018-09-121-2/+2
| | | | | | | | Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/20180911134216.9760-6-kraxel@redhat.com
* udmabuf: constify udmabuf_opsGerd Hoffmann2018-09-121-1/+1
| | | | | | | | Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/20180911134216.9760-5-kraxel@redhat.com
* udmabuf: use pgoff_t for pagecountGerd Hoffmann2018-09-121-1/+1
| | | | | | | Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/20180911134216.9760-4-kraxel@redhat.com
* udmabuf: improve map_udmabuf error handlingGerd Hoffmann2018-09-121-11/+10
| | | | | | | | Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/20180911134216.9760-3-kraxel@redhat.com
* udmabuf: sort headers, drop uapi/ path prefixGerd Hoffmann2018-09-121-9/+8
| | | | | | | | Reported-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/20180911134216.9760-2-kraxel@redhat.com
* dma-buf/udmabuf: Fix NULL pointer dereference in udmabuf_createGustavo A. R. Silva2018-09-051-1/+2
| | | | | | | | | | | | | | There is a potential execution path in which pointer memfd is NULL when passed as argument to fput(), hence there is a NULL pointer dereference in fput(). Fix this by null checking *memfd* before calling fput(). Addresses-Coverity-ID: 1473174 ("Explicit null dereferenced") Fixes: fbb0de795078 ("Add udmabuf misc device") Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Link: http://patchwork.freedesktop.org/patch/msgid/20180904190749.GA9308@embeddedor.com Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
* Add udmabuf misc deviceGerd Hoffmann2018-09-031-0/+287
A driver to let userspace turn memfd regions into dma-bufs. Use case: Allows qemu create dmabufs for the vga framebuffer or virtio-gpu ressources. Then they can be passed around to display those guest things on the host. To spice client for classic full framebuffer display, and hopefully some day to wayland server for seamless guest window display. qemu test branch: https://git.kraxel.org/cgit/qemu/log/?h=sirius/udmabuf Cc: David Airlie <airlied@linux.ie> Cc: Tomeu Vizoso <tomeu.vizoso@collabora.com> Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Cc: Daniel Vetter <daniel@ffwll.ch> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: http://patchwork.freedesktop.org/patch/msgid/20180827093444.23623-1-kraxel@redhat.com
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-28 09:28:22 +0100