From c3ad8bb7e56201362696f5b3d4ba8963771e6199 Mon Sep 17 00:00:00 2001
From: Martin Krastev <krastevm@vmware.com>
Date: Wed, 9 Jun 2021 13:23:05 -0400
Subject: drm/vmwgfx: Refactor vmw_mksstat_remove_ioctl to expect pgid match
 with vmw_mksstat_add_ioctl to authorise removal.
Git-commit: b7d0949f6ce691131323fafabd48bf2f5074ae8d
Patch-mainline: v5.15-rc1
References: jsc#PED-1166 jsc#PED-1168 jsc#PED-1170 jsc#PED-1218 jsc#PED-1220 jsc#PED-1222 jsc#PED-1223 jsc#PED-1225

Original vmw_mksstat_remove_ioctl expected pid to match the corresponding vmw_mksstat_add_ioctl.
That made impossible en-masse removals by one pid, which is a valid use case, so pid match was
discarded. Current change enforces a broader pgid match as a form of protection from arbitrary
processes interrupting an ongoing mks-guest-stats.

Reviewed-by: Zack Rusin <zackr@vmware.com>
Signed-off-by: Martin Krastev <krastevm@vmware.com>
Signed-off-by: Zack Rusin <zackr@vmware.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210609172307.131929-8-zackr@vmware.com
Acked-by: Patrik Jakobsson <pjakobsson@suse.de>
---
 drivers/gpu/drm/vmwgfx/vmwgfx_msg.c | 32 ++++++++++++-----------------
 1 file changed, 13 insertions(+), 19 deletions(-)

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
index 12df4c634075..74a3f09ad664 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.c
@@ -1111,7 +1111,7 @@ int vmw_mksstat_add_ioctl(struct drm_device *dev, void *data,
 	hypervisor_ppn_add((PPN64)page_to_pfn(page));
 
 	dev_priv->mksstat_user_pages[slot] = page;
-	atomic_set(&dev_priv->mksstat_user_pids[slot], current->pid);
+	atomic_set(&dev_priv->mksstat_user_pids[slot], task_pgrp_vnr(current));
 
 	arg->id = slot;
 
@@ -1158,37 +1158,31 @@ int vmw_mksstat_remove_ioctl(struct drm_device *dev, void *data,
 	struct vmw_private *const dev_priv = vmw_priv(dev);
 
 	const size_t slot = arg->id;
-	pid_t pid0;
+	pid_t pgid, pid;
 
 	if (slot >= ARRAY_SIZE(dev_priv->mksstat_user_pids))
 		return -EINVAL;
 
 	DRM_DEV_INFO(dev->dev, "pid=%d arg.id=%lu\n", current->pid, slot);
 
-	pid0 = atomic_read(&dev_priv->mksstat_user_pids[slot]);
+	pgid = task_pgrp_vnr(current);
+	pid = atomic_cmpxchg(&dev_priv->mksstat_user_pids[slot], pgid, MKSSTAT_PID_RESERVED);
 
-	if (!pid0)
+	if (!pid)
 		return 0;
 
-	if (pid0 != MKSSTAT_PID_RESERVED) {
-		const pid_t pid1 = atomic_cmpxchg(&dev_priv->mksstat_user_pids[slot], pid0, MKSSTAT_PID_RESERVED);
+	if (pid == pgid) {
+		struct page *const page = dev_priv->mksstat_user_pages[slot];
 
-		if (!pid1)
-			return 0;
-
-		if (pid1 == pid0) {
-			struct page *const page = dev_priv->mksstat_user_pages[slot];
+		BUG_ON(!page);
 
-			BUG_ON(!page);
-
-			dev_priv->mksstat_user_pages[slot] = NULL;
-			atomic_set(&dev_priv->mksstat_user_pids[slot], 0);
+		dev_priv->mksstat_user_pages[slot] = NULL;
+		atomic_set(&dev_priv->mksstat_user_pids[slot], 0);
 
-			hypervisor_ppn_remove((PPN64)page_to_pfn(page));
+		hypervisor_ppn_remove((PPN64)page_to_pfn(page));
 
-			vmw_mksstat_cleanup_descriptor(page);
-			return 0;
-		}
+		vmw_mksstat_cleanup_descriptor(page);
+		return 0;
 	}
 
 	return -EAGAIN;
-- 
2.38.1