github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 04:34:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

nouveau/gem: reserve the bo in the info ioctl around the vma lookup

Browse Source 
In the non-uvmm path, there could be a race between the info lookup
finding the vma, and the gem close path closing the vma leading
to a use-after-free.

Spotted with the help of Opus 4.6.

Signed-off-by: Dave Airlie <airlied@redhat.com>
Fixes: e758a31119 ("drm/nouveau: fixup gem_info ioctl to return client-specific bo virtual")
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260612020658.3176270-1-airlied@gmail.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
This commit is contained in:
Dave Airlie 2026-06-12 12:06:58 +10:00 committed by Danilo Krummrich
parent 98b46e693b
commit 5e17160d41
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/gpu/drm/nouveau/nouveau_gem.c
View File

@ -313,11 +313,20 @@ nouveau_gem_info(struct drm_file *file_priv, struct drm_gem_object *gem,
rep->offset = nvbo->offset;
if (vmm->vmm.object.oclass >= NVIF_CLASS_VMM_NV50 &&
!nouveau_cli_uvmm(cli)) {
int ret;
ret = ttm_bo_reserve(&nvbo->bo, false, false, NULL);
if (ret)
return ret;
vma = nouveau_vma_find(nvbo, vmm);
if (!vma)
if (!vma) {
ttm_bo_unreserve(&nvbo->bo);
return -EINVAL;
}
rep->offset = vma->addr;
ttm_bo_unreserve(&nvbo->bo);
} else
rep->offset = 0;