drm/xe/mmio_gem: forbid VMA split

The fault handler assumes it always operates on a VMA spanning the entire
GEM object. This does not hold when the VMA has been split, e.g. by a
partial munmap or mprotect. In that case the handler may map wrong
physical pages or cause SIGBUS.

Handle this by forbidding VMA split, as partial unmaps are not deemed
useful for MMIO GEMs.

Suggested-by: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Ilia Levi <ilia.levi@intel.com>
Fixes: 1ffcf8b8ae ("drm/xe: Support for mmap-ing mmio regions")
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patch.msgid.link/20260908165046.1393557-11-matthew.auld@intel.com
(cherry picked from commit f3391a0b12d7bf826a0b21600d2f294f3dce4c14)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
This commit is contained in:
Ilia Levi 2026-09-08 17:50:48 +01:00 committed by Rodrigo Vivi
parent fd73f4a665
commit 247a82da6f
No known key found for this signature in database
GPG Key ID: FA625F640EEB13CA

View File

@ -39,10 +39,20 @@ struct xe_mmio_gem {
phys_addr_t phys_addr;
};
static int xe_mmio_gem_vm_may_split(struct vm_area_struct *area, unsigned long addr)
{
/*
* Forbid splitting. Together with VM_DONTEXPAND, this keeps the VMA
* matching the GEM object exactly.
*/
return -EINVAL;
}
static const struct vm_operations_struct vm_ops = {
.open = drm_gem_vm_open,
.close = drm_gem_vm_close,
.fault = xe_mmio_gem_vm_fault,
.may_split = xe_mmio_gem_vm_may_split,
};
static const struct drm_gem_object_funcs xe_mmio_gem_funcs = {