mirror of
https://github.com/torvalds/linux.git
synced 2026-07-27 01:32:21 +02:00
17e2030f37
The drm gpuvm code doesn't protect find operation against map operation, and the driver needs to ensure a map operation shouldn't happen when a find operation is in progress. In some cases a find operation will be in progress when doing map/unmap operations, and the find operation will do a NULL pointer dereference. An example of the stack trace of such NULL dereference is shown below: ``` Unable to handle kernel access to user memory without uaccess routines at virtual address 0000000000000010 [<ffffffff01e989d4>] drm_gpuva_find+0x28/0x6c [drm_gpuvm] [<ffffffff01ed3a40>] pvr_vm_unmap+0x34/0x68 [powervr] [<ffffffff01ec69da>] pvr_ioctl_vm_unmap+0x2e/0x50 [powervr] [<ffffffff8080ce0a>] drm_ioctl_kernel+0x8e/0xdc [<ffffffff8080d016>] drm_ioctl+0x1be/0x3e0 [<ffffffff802bec3e>] __riscv_sys_ioctl+0xba/0xc4 [<ffffffff80d858b2>] do_trap_ecall_u+0x23e/0x3f4 [<ffffffff80d92288>] handle_exception+0x168/0x174 ``` As all occurences of drm_gpuva_find*() are already guarded by vm_ctx->lock, make pvr_vm_map() to acquire this lock to prevent disturbing any find operation. This fixes the NULL deference problem in drm_gpuva_find*(). Cc: stable@vger.kernel.org Fixes: |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| pvr_ccb.c | ||
| pvr_ccb.h | ||
| pvr_cccb.c | ||
| pvr_cccb.h | ||
| pvr_context.c | ||
| pvr_context.h | ||
| pvr_debugfs.c | ||
| pvr_debugfs.h | ||
| pvr_device_info.c | ||
| pvr_device_info.h | ||
| pvr_device.c | ||
| pvr_device.h | ||
| pvr_drv.c | ||
| pvr_drv.h | ||
| pvr_dump.c | ||
| pvr_dump.h | ||
| pvr_free_list.c | ||
| pvr_free_list.h | ||
| pvr_fw_info.h | ||
| pvr_fw_meta.c | ||
| pvr_fw_meta.h | ||
| pvr_fw_mips.c | ||
| pvr_fw_mips.h | ||
| pvr_fw_riscv.c | ||
| pvr_fw_startstop.c | ||
| pvr_fw_startstop.h | ||
| pvr_fw_trace.c | ||
| pvr_fw_trace.h | ||
| pvr_fw_util.c | ||
| pvr_fw.c | ||
| pvr_fw.h | ||
| pvr_gem.c | ||
| pvr_gem.h | ||
| pvr_hwrt.c | ||
| pvr_hwrt.h | ||
| pvr_job.c | ||
| pvr_job.h | ||
| pvr_mmu.c | ||
| pvr_mmu.h | ||
| pvr_power.c | ||
| pvr_power.h | ||
| pvr_queue.c | ||
| pvr_queue.h | ||
| pvr_rogue_cr_defs_client.h | ||
| pvr_rogue_cr_defs.h | ||
| pvr_rogue_defs.h | ||
| pvr_rogue_fwif_check.h | ||
| pvr_rogue_fwif_client_check.h | ||
| pvr_rogue_fwif_client.h | ||
| pvr_rogue_fwif_common.h | ||
| pvr_rogue_fwif_dev_info.h | ||
| pvr_rogue_fwif_resetframework.h | ||
| pvr_rogue_fwif_sf.h | ||
| pvr_rogue_fwif_shared_check.h | ||
| pvr_rogue_fwif_shared.h | ||
| pvr_rogue_fwif_stream.h | ||
| pvr_rogue_fwif.h | ||
| pvr_rogue_heap_config.h | ||
| pvr_rogue_meta.h | ||
| pvr_rogue_mips_check.h | ||
| pvr_rogue_mips.h | ||
| pvr_rogue_mmu_defs.h | ||
| pvr_rogue_riscv.h | ||
| pvr_stream_defs.c | ||
| pvr_stream_defs.h | ||
| pvr_stream.c | ||
| pvr_stream.h | ||
| pvr_sync.c | ||
| pvr_sync.h | ||
| pvr_test.c | ||
| pvr_trace_points.c | ||
| pvr_trace.h | ||
| pvr_vm_mips.c | ||
| pvr_vm_mips.h | ||
| pvr_vm.c | ||
| pvr_vm.h | ||