ee25841221
commit dbe97cff7dd9f0f75c524afdd55ad46be3d15295 upstream.
unmap_grant_pages() currently waits for the pages to no longer be used.
In https://github.com/QubesOS/qubes-issues/issues/7481, this lead to a
deadlock against i915: i915 was waiting for gntdev's MMU notifier to
finish, while gntdev was waiting for i915 to free its pages. I also
believe this is responsible for various deadlocks I have experienced in
the past.
Avoid these problems by making unmap_grant_pages async. This requires
making it return void, as any errors will not be available when the
function returns. Fortunately, the only use of the return value is a
WARN_ON(), which can be replaced by a WARN_ON when the error is
detected. Additionally, a failed call will not prevent further calls
from being made, but this is harmless.
Because unmap_grant_pages is now async, the grant handle will be sent to
INVALID_GRANT_HANDLE too late to prevent multiple unmaps of the same
handle. Instead, a separate bool array is allocated for this purpose.
This wastes memory, but stuffing this information in padding bytes is
too fragile. Furthermore, it is necessary to grab a reference to the
map before making the asynchronous call, and release the reference when
the call returns.
It is also necessary to guard against reentrancy in gntdev_map_put(),
and to handle the case where userspace tries to map a mapping whose
contents have not all been freed yet.
Fixes: 745282256c ("xen/gntdev: safely unmap grants in case they are still in use")
Cc: stable@vger.kernel.org
Signed-off-by: Demi Marie Obenour <demi@invisiblethingslab.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/20220622022726.2538-1-demi@invisiblethingslab.com
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
103 lines
2.5 KiB
C
103 lines
2.5 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
|
|
/*
|
|
* Common functionality of grant device.
|
|
*
|
|
* Copyright (c) 2006-2007, D G Murray.
|
|
* (c) 2009 Gerd Hoffmann <kraxel@redhat.com>
|
|
* (c) 2018 Oleksandr Andrushchenko, EPAM Systems Inc.
|
|
*/
|
|
|
|
#ifndef _GNTDEV_COMMON_H
|
|
#define _GNTDEV_COMMON_H
|
|
|
|
#include <linux/mm.h>
|
|
#include <linux/mman.h>
|
|
#include <linux/mmu_notifier.h>
|
|
#include <linux/types.h>
|
|
#include <xen/interface/event_channel.h>
|
|
#include <xen/grant_table.h>
|
|
|
|
struct gntdev_dmabuf_priv;
|
|
|
|
struct gntdev_priv {
|
|
/* Maps with visible offsets in the file descriptor. */
|
|
struct list_head maps;
|
|
/*
|
|
* Maps that are not visible; will be freed on munmap.
|
|
* Only populated if populate_freeable_maps == 1
|
|
*/
|
|
struct list_head freeable_maps;
|
|
/* lock protects maps and freeable_maps. */
|
|
struct mutex lock;
|
|
struct mm_struct *mm;
|
|
struct mmu_notifier mn;
|
|
|
|
#ifdef CONFIG_XEN_GRANT_DMA_ALLOC
|
|
/* Device for which DMA memory is allocated. */
|
|
struct device *dma_dev;
|
|
#endif
|
|
|
|
#ifdef CONFIG_XEN_GNTDEV_DMABUF
|
|
struct gntdev_dmabuf_priv *dmabuf_priv;
|
|
#endif
|
|
};
|
|
|
|
struct gntdev_unmap_notify {
|
|
int flags;
|
|
/* Address relative to the start of the gntdev_grant_map. */
|
|
int addr;
|
|
int event;
|
|
};
|
|
|
|
struct gntdev_grant_map {
|
|
struct list_head next;
|
|
struct vm_area_struct *vma;
|
|
int index;
|
|
int count;
|
|
int flags;
|
|
refcount_t users;
|
|
struct gntdev_unmap_notify notify;
|
|
struct ioctl_gntdev_grant_ref *grants;
|
|
struct gnttab_map_grant_ref *map_ops;
|
|
struct gnttab_unmap_grant_ref *unmap_ops;
|
|
struct gnttab_map_grant_ref *kmap_ops;
|
|
struct gnttab_unmap_grant_ref *kunmap_ops;
|
|
bool *being_removed;
|
|
struct page **pages;
|
|
unsigned long pages_vm_start;
|
|
|
|
#ifdef CONFIG_XEN_GRANT_DMA_ALLOC
|
|
/*
|
|
* If dmabuf_vaddr is not NULL then this mapping is backed by DMA
|
|
* capable memory.
|
|
*/
|
|
|
|
struct device *dma_dev;
|
|
/* Flags used to create this DMA buffer: GNTDEV_DMA_FLAG_XXX. */
|
|
int dma_flags;
|
|
void *dma_vaddr;
|
|
dma_addr_t dma_bus_addr;
|
|
/* Needed to avoid allocation in gnttab_dma_free_pages(). */
|
|
xen_pfn_t *frames;
|
|
#endif
|
|
|
|
/* Number of live grants */
|
|
atomic_t live_grants;
|
|
/* Needed to avoid allocation in __unmap_grant_pages */
|
|
struct gntab_unmap_queue_data unmap_data;
|
|
};
|
|
|
|
struct gntdev_grant_map *gntdev_alloc_map(struct gntdev_priv *priv, int count,
|
|
int dma_flags);
|
|
|
|
void gntdev_add_map(struct gntdev_priv *priv, struct gntdev_grant_map *add);
|
|
|
|
void gntdev_put_map(struct gntdev_priv *priv, struct gntdev_grant_map *map);
|
|
|
|
bool gntdev_account_mapped_pages(int count);
|
|
|
|
int gntdev_map_grant_pages(struct gntdev_grant_map *map);
|
|
|
|
#endif
|