On Thu, Nov 12, 2026 at 11:08:58PM +0100, David Hildenbrand (Arm) wrote:
> vm_access() treats the start of every VMA as the beginning of the GEM
> object. After a VMA split, vm_pgoff identifies a later part of the
> object. Debugger reads and writes through ptrace or /proc/<pid>/mem then
> access the wrong bytes.
>
> Properly consider vm_pgoff just like the fault handlers already do.
>
> Fixes: 9f909e215fea ("drm/i915: Implement vm_ops->access for gdb access into
> mmaps")
> Cc: [email protected]
> Signed-off-by: David Hildenbrand (Arm) <[email protected]>
And since this is an mmap-an-fd driver thing there's no need to worry about anon
pgoff etc.
Looks sensible to me so:
Acked-by: Lorenzo Stoakes (ARM) <[email protected]>
> ---
> drivers/gpu/drm/i915/gem/i915_gem_mman.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_mman.c
> b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
> index 6b337684dbfe8..e3b24dc8e94f5 100644
> --- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c
> +++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
> @@ -511,13 +511,15 @@ vm_access(struct vm_area_struct *area, unsigned long
> addr,
> struct i915_mmap_offset *mmo = area->vm_private_data;
> struct drm_i915_gem_object *obj = mmo->obj;
> struct i915_gem_ww_ctx ww;
> + unsigned long obj_offset;
> void *vaddr;
> int err = 0;
>
> if (i915_gem_object_is_readonly(obj) && write)
> return -EACCES;
>
> - addr -= area->vm_start;
> + obj_offset = area->vm_pgoff - drm_vma_node_start(&mmo->vma_node);
> + addr += (obj_offset << PAGE_SHIFT) - area->vm_start;
> if (range_overflows_t(u64, addr, len, obj->base.size))
> return -EINVAL;
>
>
> --
> 2.43.0
>
--
Cheers, Lorenzo
