[PATCH V1] accel/amdxdna: Fix user buffer VMA checking and page pinning locking

[Lizhi Hou]

From: Max Zhen <max.z...@amd.com>

Holding mmap_read_lock across user buffer VMA checking and page pinning.
This keeps VMA validation and user page pinning synchronized with mmap
updates.

Also adding the check for VM_MAYWRITE to make sure the mapping can't be
updated to writable after pinning of the pages.

Fixes: f649e63d4a64 ("accel/amdxdna: Support read-only user-pointer BO 
mappings")
Signed-off-by: Max Zhen <max.z...@amd.com>
Signed-off-by: Lizhi Hou <lizhi....@amd.com>
---
 drivers/accel/amdxdna/amdxdna_ubuf.c | 34 ++++++++++++++++------------
 1 file changed, 19 insertions(+), 15 deletions(-)

diff --git a/drivers/accel/amdxdna/amdxdna_ubuf.c 
b/drivers/accel/amdxdna/amdxdna_ubuf.c
index df4ab225fbf9..85c3d6f46845 100644
--- a/drivers/accel/amdxdna/amdxdna_ubuf.c
+++ b/drivers/accel/amdxdna/amdxdna_ubuf.c
@@ -99,17 +99,13 @@ static int readonly_va_entry(struct amdxdna_drm_va_entry 
*va_ent)
        struct vm_area_struct *vma;
        int ret;
 
-       mmap_read_lock(mm);
-
        vma = find_vma(mm, va_ent->vaddr);
        if (!vma ||
            vma->vm_start > va_ent->vaddr ||
            vma->vm_end - va_ent->vaddr < va_ent->len)
                ret = -ENOENT;
        else
-               ret = vma->vm_flags & VM_WRITE ? 0 : 1;
-
-       mmap_read_unlock(mm);
+               ret = vma->vm_flags & (VM_WRITE | VM_MAYWRITE) ? 0 : 1;
        return ret;
 }
 
@@ -123,7 +119,7 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev,
        u32 npages, start = 0;
        struct dma_buf *dbuf;
        bool readonly = true;
-       int i, ret;
+       int i, ret = 0;
        DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
 
        if (!can_do_mlock())
@@ -161,10 +157,6 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev,
                        ret = -EINVAL;
                        goto free_ent;
                }
-
-               /* Pin pages as writable as long as not all entries are 
read-only. */
-               if (readonly && readonly_va_entry(&va_ent[i]) != 1)
-                       readonly = false;
        }
 
        ubuf->nr_pages = exp_info.size >> PAGE_SHIFT;
@@ -183,25 +175,37 @@ struct dma_buf *amdxdna_get_ubuf(struct drm_device *dev,
                goto sub_pin_cnt;
        }
 
+       mmap_read_lock(current->mm);
+
+       for (i = 0; i < num_entries; i++) {
+               /* Pin pages as writable as long as not all entries are 
read-only. */
+               if (readonly && readonly_va_entry(&va_ent[i]) != 1)
+                       readonly = false;
+       }
        for (i = 0; i < num_entries; i++) {
                npages = va_ent[i].len >> PAGE_SHIFT;
 
-               ret = pin_user_pages_fast(va_ent[i].vaddr, npages,
-                                         (readonly ? 0 : FOLL_WRITE) | 
FOLL_LONGTERM,
-                                         &ubuf->pages[start]);
+               ret = pin_user_pages(va_ent[i].vaddr, npages,
+                                    (readonly ? 0 : FOLL_WRITE) | 
FOLL_LONGTERM,
+                                    &ubuf->pages[start]);
                if (ret >= 0) {
                        start += ret;
                        if (ret != npages) {
                                XDNA_ERR(xdna, "Partially pinned pages %d/%u", 
ret, npages);
                                ret = -ENOMEM;
-                               goto destroy_pages;
+                               break;
                        }
                } else {
                        XDNA_ERR(xdna, "Failed to pin pages ret %d", ret);
-                       goto destroy_pages;
+                       break;
                }
        }
 
+       mmap_read_unlock(current->mm);
+
+       if (ret < 0)
+               goto destroy_pages;
+
        exp_info.ops = &amdxdna_ubuf_dmabuf_ops;
        exp_info.priv = ubuf;
        exp_info.flags = (readonly ? O_RDONLY : O_RDWR) | O_CLOEXEC;
-- 
2.34.1