video: tegra: nvmap: export dma_buf as RO when NVMAP_HANDLE_RO is set

Following kernel BUG is encountered when closing the file whose mode is
overridden to RO throgh fmode field as inode->i_readcount is not
initialized for the file. This is seen when running the test
NvRmGpuTest_Channel_SimplestPb_RoMappedBuffer_From_CPUVA on
K5.9.

The correct way to set the file mode as RO is to export the dma_buf as
RO that will initialize inode->i_readcount properly.

[ 1228.027800] kernel BUG at kernel/kernel-5.9/include/linux/fs.h:2842!
[ 1228.035330] Internal error: Oops - BUG: 0 [#3] PREEMPT SMP
[ 1228.115034] Hardware name: Jetson-AGX (DT)
[ 1228.119234] pstate: 60400009 (nZCv daif +PAN -UAO BTYPE=--)
[ 1228.125023] pc : __fput+0x22c/0x230
[ 1228.128690] lr : __fput+0xa4/0x230
[ 1228.216800] Call trace:
[ 1228.219258]  __fput+0x22c/0x230
[ 1228.222407]  ____fput+0x20/0x30
[ 1228.225388]  task_work_run+0x88/0x140
[ 1228.228886]  do_notify_resume+0x204/0x868
[ 1228.233080]  work_pending+0x8/0x204
[ 1228.236583] Code: 17ffff8e aa1703e0 9400b26f 17ffffa6 (d4210000)
[ 1228.242702] ---[ end trace af706a6663eb46e5 ]---
[ 1228.247252] note: nvrm_gpu_tests[1156] exited with preempt_count 1

Bug 200660013

Change-Id: Ie238f59a46aa7b016249a01e39e7bbd73ecfab02
Signed-off-by: Sagar Kamble <skamble@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2515024
(cherry picked from commit 891dc46b2e85424fc81544a83d6752eb1ea57dae)
Reviewed-on: https://git-master.nvidia.com/r/c/linux-nvidia/+/2521315
Reviewed-by: svc-mobile-coverity <svc-mobile-coverity@nvidia.com>
Reviewed-by: Puneet Saxena <puneets@nvidia.com>
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-by: mobile promotions <svcmobile_promotions@nvidia.com>
Tested-by: Amulya Yarlagadda <ayarlagadda@nvidia.com>
Tested-by: mobile promotions <svcmobile_promotions@nvidia.com>
GVS: Gerrit_Virtual_Submit

4 files changed, 17 insertions, 17 deletions

diff --git a/drivers/video/tegra/nvmap/nvmap_dmabuf.c b/drivers/video/tegra/nvmap/nvmap_dmabuf.c
index 3424bb7f8..54f514546 100644
--- a/drivers/video/tegra/nvmap/nvmap_dmabuf.c
+++ b/drivers/video/tegra/nvmap/nvmap_dmabuf.c
@@ -607,14 +607,20 @@ EXPORT_SYMBOL(dmabuf_is_nvmap);
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)
 static struct dma_buf *__dma_buf_export(struct nvmap_handle_info *info,
-                                        size_t size)
+                                        size_t size, bool ro_buf)
 {
         DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
 
         exp_info.priv = info;
         exp_info.ops = &nvmap_dma_buf_ops;
         exp_info.size = size;
-        exp_info.flags = O_RDWR;
+
+        if (ro_buf) {
+                exp_info.flags = O_RDONLY;
+        } else {
+                exp_info.flags = O_RDWR;
+        }
+
         exp_info.exp_flags = DMABUF_CAN_DEFER_UNMAP |
                                 DMABUF_SKIP_CACHE_SYNC;
 
@@ -629,7 +635,7 @@ static struct dma_buf *__dma_buf_export(struct nvmap_handle_info *info,
  * Make a dmabuf object for an nvmap handle.
  */
 struct dma_buf *__nvmap_make_dmabuf(struct nvmap_client *client,
-                                    struct nvmap_handle *handle)
+                                    struct nvmap_handle *handle, bool ro_buf)
 {
         int err;
         struct dma_buf *dmabuf;
@@ -644,7 +650,7 @@ struct dma_buf *__nvmap_make_dmabuf(struct nvmap_client *client,
         INIT_LIST_HEAD(&info->maps);
         mutex_init(&info->maps_lock);
 
-        dmabuf = __dma_buf_export(info, handle->size);
+        dmabuf = __dma_buf_export(info, handle->size, ro_buf);
         if (IS_ERR(dmabuf)) {
                 err = PTR_ERR(dmabuf);
                 goto err_export;
@@ -689,12 +695,6 @@ int nvmap_get_dmabuf_fd(struct nvmap_client *client, struct nvmap_handle *h)
         dmabuf = __nvmap_dmabuf_export(client, h);
         if (IS_ERR(dmabuf))
                 return PTR_ERR(dmabuf);
-        /*
-         * If the user allocated buffer is ReadOnly, make
-         * dma_buf ReadOnly.
-         */
-        if (h->is_ro)
-                dmabuf->file->f_mode &= ~(FMODE_WRITE | FMODE_PWRITE);
 
         fd = __nvmap_dmabuf_fd(client, dmabuf, O_CLOEXEC);
         if (IS_ERR_VALUE((uintptr_t)fd))
diff --git a/drivers/video/tegra/nvmap/nvmap_handle.c b/drivers/video/tegra/nvmap/nvmap_handle.c
index 8df4b3a71..7a58f1c68 100644
--- a/drivers/video/tegra/nvmap/nvmap_handle.c
+++ b/drivers/video/tegra/nvmap/nvmap_handle.c
@@ -186,7 +186,7 @@ struct nvmap_handle_ref *nvmap_create_handle_from_va(struct nvmap_client *client
         if (!(vm_flags & VM_WRITE) && !(flags & NVMAP_HANDLE_RO))
                 return ERR_PTR(-EINVAL);
 
-        ref = nvmap_create_handle(client, size);
+        ref = nvmap_create_handle(client, size, flags & NVMAP_HANDLE_RO);
         if (!IS_ERR(ref))
                 ref->handle->orig_size = size;
 
@@ -194,7 +194,7 @@ struct nvmap_handle_ref *nvmap_create_handle_from_va(struct nvmap_client *client
 }
 
 struct nvmap_handle_ref *nvmap_create_handle(struct nvmap_client *client,
-                                             size_t size)
+                                             size_t size, bool ro_buf)
 {
         void *err = ERR_PTR(-ENOMEM);
         struct nvmap_handle *h;
@@ -231,7 +231,7 @@ struct nvmap_handle_ref *nvmap_create_handle(struct nvmap_client *client,
          * This takes out 1 ref on the dambuf. This corresponds to the
          * handle_ref that gets automatically made by nvmap_create_handle().
          */
-        h->dmabuf = __nvmap_make_dmabuf(client, h);
+        h->dmabuf = __nvmap_make_dmabuf(client, h, ro_buf);
         if (IS_ERR(h->dmabuf)) {
                 err = h->dmabuf;
                 goto make_dmabuf_fail;
diff --git a/drivers/video/tegra/nvmap/nvmap_ioctl.c b/drivers/video/tegra/nvmap/nvmap_ioctl.c
index e67077768..a6a29b9e0 100644
--- a/drivers/video/tegra/nvmap/nvmap_ioctl.c
+++ b/drivers/video/tegra/nvmap/nvmap_ioctl.c
@@ -223,7 +223,7 @@ int nvmap_ioctl_create(struct file *filp, unsigned int cmd, void __user *arg)
                 op.size64 = op.size;
 
         if ((cmd == NVMAP_IOC_CREATE) || (cmd == NVMAP_IOC_CREATE_64)) {
-                ref = nvmap_create_handle(client, op.size64);
+                ref = nvmap_create_handle(client, op.size64, false);
                 if (!IS_ERR(ref))
                         ref->handle->orig_size = op.size64;
         } else if (cmd == NVMAP_IOC_FROM_FD) {
@@ -632,7 +632,7 @@ int nvmap_ioctl_create_from_ivc(struct file *filp, void __user *arg)
                         ((1ULL << NVMAP_IVM_LENGTH_WIDTH) - 1)) << PAGE_SHIFT;
                 peer = (op.ivm_id >> NVMAP_IVM_IVMID_SHIFT);
 
-                ref = nvmap_create_handle(client, size);
+                ref = nvmap_create_handle(client, size, false);
                 if (IS_ERR(ref)) {
                         nvmap_heap_free(block);
                         return PTR_ERR(ref);
diff --git a/drivers/video/tegra/nvmap/nvmap_priv.h b/drivers/video/tegra/nvmap/nvmap_priv.h
index 1e7b01f1f..0d6ea52f1 100644
--- a/drivers/video/tegra/nvmap/nvmap_priv.h
+++ b/drivers/video/tegra/nvmap/nvmap_priv.h
@@ -382,7 +382,7 @@ struct nvmap_handle_ref *__nvmap_validate_locked(struct nvmap_client *priv,
 struct nvmap_handle *nvmap_validate_get(struct nvmap_handle *h);
 
 struct nvmap_handle_ref *nvmap_create_handle(struct nvmap_client *client,
-                                             size_t size);
+                                             size_t size, bool ro_buf);
 
 struct nvmap_handle_ref *nvmap_create_handle_from_va(struct nvmap_client *client,
                                                      ulong addr, size_t size,
@@ -468,7 +468,7 @@ int nvmap_cache_debugfs_init(struct dentry *nvmap_root);
 struct dma_buf *__nvmap_dmabuf_export(struct nvmap_client *client,
                                  struct nvmap_handle *handle);
 struct dma_buf *__nvmap_make_dmabuf(struct nvmap_client *client,
-                                    struct nvmap_handle *handle);
+                                    struct nvmap_handle *handle, bool ro_buf);
 struct sg_table *__nvmap_sg_table(struct nvmap_client *client,
                                   struct nvmap_handle *h);
 void __nvmap_free_sg_table(struct nvmap_client *client,