[PATCH] drm/radeon: fix potential racing issue due to mmap_lock

[Dawei Li]

Both find_vma() and get_user_pages() need explicit protection of
mmap lock, fix them by mmap_lock and get_user_pages_fast().

Fixes: ddd00e33e17a ("drm/radeon: add userptr flag to limit it to anonymous 
memory v2")
Fixes: f72a113a71ab ("drm/radeon: add userptr support v8")
Signed-off-by: Dawei Li <set_pte...@outlook.com>
---
 drivers/gpu/drm/radeon/radeon_ttm.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c 
b/drivers/gpu/drm/radeon/radeon_ttm.c
index d33fec488713..741ea64b9402 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -351,7 +351,10 @@ static int radeon_ttm_tt_pin_userptr(struct ttm_device 
*bdev, struct ttm_tt *ttm
                   to prevent problems with writeback */
                unsigned long end = gtt->userptr + (u64)ttm->num_pages * 
PAGE_SIZE;
                struct vm_area_struct *vma;
+
+               mmap_read_lock(gtt->usermm);
                vma = find_vma(gtt->usermm, gtt->userptr);
+               mmap_read_unlock(gtt->usermm);
                if (!vma || vma->vm_file || vma->vm_end < end)
                        return -EPERM;
        }
@@ -361,8 +364,7 @@ static int radeon_ttm_tt_pin_userptr(struct ttm_device 
*bdev, struct ttm_tt *ttm
                uint64_t userptr = gtt->userptr + pinned * PAGE_SIZE;
                struct page **pages = ttm->pages + pinned;
 
-               r = get_user_pages(userptr, num_pages, write ? FOLL_WRITE : 0,
-                                  pages, NULL);
+               r = get_user_pages_fast(userptr, num_pages, write ? FOLL_WRITE 
: 0, pages);
                if (r < 0)
                        goto release_pages;
 
-- 
2.25.1