[PATCH] drm/virtio: Propagate errors from deferred blob mapping

[Changyul Lee]

virtio_gpu_vram_map_deferred() ignores errors from
virtio_gpu_vram_map(). If mapping fails before RESOURCE_MAP_BLOB
is queued, virtio_gpu_vram_mmap() still waits for a response
that will never arrive.

This can happen when drm_mm_insert_node() finds no room in
host_visible_mm. Since no command is sent, map_state remains
STATE_INITIALIZING. The task then waits indefinitely while holding
mmap_lock, and SIGKILL cannot terminate it. Any user with render
node access can trigger this by mmapping a deferred-mapping blob
larger than the host visible region.

Propagate the error so mmap() returns instead of waiting.

Tested on Linux v7.3 with QEMU (virtio-gpu-gl, blob=true,
hostmem=256M).

Fixes: 4c26e162947f ("drm/virtio: Extend blob UAPI with deferred-mapping 
hinting")
Signed-off-by: Changyul Lee <lcy8...@gmail.com>
---
 drivers/gpu/drm/virtio/virtgpu_drv.h  |  2 +-
 drivers/gpu/drm/virtio/virtgpu_vram.c | 14 ++++++++++----
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h 
b/drivers/gpu/drm/virtio/virtgpu_drv.h
index f3bbbe4468bf..a3c52aa17ed8 100644
--- a/drivers/gpu/drm/virtio/virtgpu_drv.h
+++ b/drivers/gpu/drm/virtio/virtgpu_drv.h
@@ -561,7 +561,7 @@ struct sg_table *virtio_gpu_vram_map_dma_buf(struct 
virtio_gpu_object *bo,
 void virtio_gpu_vram_unmap_dma_buf(struct device *dev,
                                   struct sg_table *sgt,
                                   enum dma_data_direction dir);
-void virtio_gpu_vram_map_deferred(struct virtio_gpu_object_vram *vram);
+int virtio_gpu_vram_map_deferred(struct virtio_gpu_object_vram *vram);
 
 /* virtgpu_submit.c */
 int virtio_gpu_execbuffer_ioctl(struct drm_device *dev, void *data,
diff --git a/drivers/gpu/drm/virtio/virtgpu_vram.c 
b/drivers/gpu/drm/virtio/virtgpu_vram.c
index 01241ce4d07c..7e0fab7fb2eb 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vram.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vram.c
@@ -45,7 +45,9 @@ static int virtio_gpu_vram_mmap(struct drm_gem_object *obj,
        if (!(bo->blob_flags & VIRTGPU_BLOB_FLAG_USE_MAPPABLE))
                return -EINVAL;
 
-       virtio_gpu_vram_map_deferred(vram);
+       ret = virtio_gpu_vram_map_deferred(vram);
+       if (ret)
+               return ret;
 
        if (vram->map_state == STATE_INITIALIZING)
                virtio_gpu_notify(vgdev);
@@ -243,13 +245,17 @@ int virtio_gpu_vram_create(struct virtio_gpu_device 
*vgdev,
        return ret;
 }
 
-void virtio_gpu_vram_map_deferred(struct virtio_gpu_object_vram *vram)
+int virtio_gpu_vram_map_deferred(struct virtio_gpu_object_vram *vram)
 {
+       int ret = 0;
+
        if (!(vram->base.blob_flags & VIRTGPU_BLOB_FLAG_USE_MAPPABLE))
-               return;
+               return 0;
 
        mutex_lock(&map_lock);
        if (!drm_mm_node_allocated(&vram->vram_node))
-               virtio_gpu_vram_map(&vram->base);
+               ret = virtio_gpu_vram_map(&vram->base);
        mutex_unlock(&map_lock);
+
+       return ret;
 }

base-commit: c339f4010dea8b0d754f84ace70cd1b089878ef8
-- 
2.43.0