[PATCH] drm/virtio: Propagate errors from deferred blob mapping

[PATCH] drm/virtio: Propagate errors from deferred blob mapping

[Changyul Lee]

virtio_gpu_vram_map_deferred() ignores errors from
virtio_gpu_vram_map(). If mapping fails before RESOURCE_MAP_BLOB
is queued, virtio_gpu_vram_mmap() still waits for a response
that will never arrive.

This can happen when drm_mm_insert_node() finds no room in
host_visible_mm. Since no command is sent, map_state remains
STATE_INITIALIZING. The task then waits indefinitely while holding
mmap_lock, and SIGKILL cannot terminate it. Any user with render
node access can trigger this by mmapping a deferred-mapping blob
larger than the host visible region.

Propagate the error so mmap() returns instead of waiting.

Tested on Linux v7.3 with QEMU (virtio-gpu-gl, blob=true,
hostmem=256M).

Fixes: 4c26e162947f ("drm/virtio: Extend blob UAPI with deferred-mapping hinting")
Signed-off-by: Changyul Lee <lcy8047@gmail.com>
---
 drivers/gpu/drm/virtio/virtgpu_drv.h  |  2 +-
 drivers/gpu/drm/virtio/virtgpu_vram.c | 14 ++++++++++----
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/virtgpu_drv.h
index f3bbbe4468bf..a3c52aa17ed8 100644
--- a/drivers/gpu/drm/virtio/virtgpu_drv.h
+++ b/drivers/gpu/drm/virtio/virtgpu_drv.h
@@ -561,7 +561,7 @@ struct sg_table *virtio_gpu_vram_map_dma_buf(struct virtio_gpu_object *bo,
 void virtio_gpu_vram_unmap_dma_buf(struct device *dev,
 				   struct sg_table *sgt,
 				   enum dma_data_direction dir);
-void virtio_gpu_vram_map_deferred(struct virtio_gpu_object_vram *vram);
+int virtio_gpu_vram_map_deferred(struct virtio_gpu_object_vram *vram);
 
 /* virtgpu_submit.c */
 int virtio_gpu_execbuffer_ioctl(struct drm_device *dev, void *data,
diff --git a/drivers/gpu/drm/virtio/virtgpu_vram.c b/drivers/gpu/drm/virtio/virtgpu_vram.c
index 01241ce4d07c..7e0fab7fb2eb 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vram.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vram.c
@@ -45,7 +45,9 @@ static int virtio_gpu_vram_mmap(struct drm_gem_object *obj,
 	if (!(bo->blob_flags & VIRTGPU_BLOB_FLAG_USE_MAPPABLE))
 		return -EINVAL;
 
-	virtio_gpu_vram_map_deferred(vram);
+	ret = virtio_gpu_vram_map_deferred(vram);
+	if (ret)
+		return ret;
 
 	if (vram->map_state == STATE_INITIALIZING)
 		virtio_gpu_notify(vgdev);
@@ -243,13 +245,17 @@ int virtio_gpu_vram_create(struct virtio_gpu_device *vgdev,
 	return ret;
 }
 
-void virtio_gpu_vram_map_deferred(struct virtio_gpu_object_vram *vram)
+int virtio_gpu_vram_map_deferred(struct virtio_gpu_object_vram *vram)
 {
+	int ret = 0;
+
 	if (!(vram->base.blob_flags & VIRTGPU_BLOB_FLAG_USE_MAPPABLE))
-		return;
+		return 0;
 
 	mutex_lock(&map_lock);
 	if (!drm_mm_node_allocated(&vram->vram_node))
-		virtio_gpu_vram_map(&vram->base);
+		ret = virtio_gpu_vram_map(&vram->base);
 	mutex_unlock(&map_lock);
+
+	return ret;
 }

base-commit: c339f4010dea8b0d754f84ace70cd1b089878ef8
-- 
2.43.0