github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-23 23:51:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
03c19e449a
linux/drivers
History
Linus Torvalds 03c19e449a drm/i915/gem: Don't fault on presumed_offset write-back 
The execbuffer relocation fast path writes each updated presumed_offset
back to the user's relocation array with __put_user(), ignoring any
failure.  It does that while holding the objects' dma_resv locks, and
with page faults enabled unless the relocation cache happens to have an
atomic mapping active.  So if that write faults, for example on a
copy-on-write page after a fork(), the fault handler takes mmap_lock
under dma_resv.  That is the opposite of the order the i915 fault
handler uses, which takes the object lock under mmap_lock.

The comment above it claimed this could not happen, because "we did
previously check if the relocations were writable (access_ok)".
access_ok() is purely a range check.  The comment dates from when this
was access_ok(VERIFY_WRITE), and that only ever made a difference on the
original i386, whose write-protect bit did not stop supervisor writes.
So nothing has made sure the array was writable for decades.

Do the write with page faults disabled, and if it fails, fall back to
the slow path exactly as we already do when reading the relocations
fails part-way through.  We cannot just ignore the failure: the object
has already been relocated, and a stale presumed_offset could later
match again and skip a relocation that is needed.  The slow path
prefaults and retries.  If the write still fails, it copies the
relocations and marks every presumed_offset invalid with faults allowed
and no locks held, which breaks copy-on-write as needed.

One user-visible change: a relocation array in genuinely read-only
memory used to get through the fast path, silently losing the
presumed_offset updates.  It now gets -EFAULT from the slow path, as it
already did whenever anything else sent execbuffer there.  The uapi has
the kernel updating presumed_offset, so the array is expected to be
writable.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-10-20 08:07:28 -10:00
..
accel accel/rocket: search every core slot when looking up a scheduler 2026-10-13 13:54:27 +02:00
accessibility braille: nbcon: Allow to use a serial console with NBCON API as Braille console 2026-10-02 10:26:42 +02:00
acpi treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
amba
android rust_binderfs: add transaction_report feature entry 2026-09-16 19:33:40 +01:00
ata ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands 2026-09-30 10:42:26 +02:00
atm
auxdisplay auxdisplay for v7.3-1 2026-08-24 08:15:59 -07:00
base regmap: Fix cache lifecycle locking and teardown 2026-10-13 00:11:44 +01:00
bcma
block block-7.3-20261010 2026-10-11 09:00:33 -07:00
bluetooth Bluetooth: btintel_pcie: use managed IRQ teardown 2026-10-02 11:25:53 -04:00
bus Char/Misc/IIO/etc driver update for 7.3-rc1 2026-08-25 09:38:50 -07:00
cache
cdrom
cdx cdx: Fix double free when sysfs file creation fails 2026-07-31 14:21:20 +02:00
char drivers/char/mem: use get_user()/put_user() for /dev/port byte copies 2026-10-19 19:23:55 -10:00
clk soc: fixes for 7.3, part 2 2026-10-08 06:44:07 +02:00
clocksource hyperv-next for v7.3-rc1 2026-08-26 16:47:40 -07:00
comedi
connector
counter Char/Misc/IIO/etc driver update for 7.3-rc1 2026-08-25 09:38:50 -07:00
cpufreq cpufreq: intel_pstate: Fix max_freq fallback in cpufreq_update_pressure() 2026-09-29 12:23:20 +02:00
cpuidle cpuidle: dt_idle_genpd: kfree() the original name allocation 2026-09-01 17:28:56 +02:00
crypto This push fixes a regression in caam. 2026-09-18 10:01:31 -07:00
cxl Merge branch 'for-7.3/cxl-port-err-prep' into cxl-for-next 2026-08-05 13:55:07 -07:00
dax mm.git review status for mm-hotfixes-stable..mm-stable 2026-08-20 18:17:08 -07:00
dca
devfreq treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
dibs dibs: Unregister dibs_class after error 2026-09-04 16:12:24 -07:00
dio
dma dmaengine fixes for v7.3 2026-09-20 10:45:22 -07:00
dma-buf Revert "dma-buf: Make DMABUF_DEBUG default to y on DEBUG_KERNEL kernels" 2026-10-13 19:26:28 +05:30
dpll dpll: use exact lookup for reference sync pin id 2026-09-21 17:19:42 -07:00
edac EDAC/amd64: Mask UMC chip select to the four implemented selects 2026-10-05 11:02:42 -07:00
eisa EISA: Use str_plural() in eisa_probe() 2026-07-31 14:21:14 +02:00
extcon
firewire firewire: core: fix race condition in split transaction handling 2026-10-18 11:59:35 +09:00
firmware Arm firmware fixes for v7.3 2026-09-14 17:02:19 +02:00
fpga treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
fsi
fwctl rust: introduce abstractions for fwctl 2026-08-14 19:21:17 -03:00
gnss
gpib Char/Misc/IIO/etc driver update for 7.3-rc1 2026-08-25 09:38:50 -07:00
gpio gpio: mxc: fix race between gpiochip registration and IRQ domain setup 2026-10-15 14:21:15 +02:00
gpu drm/i915/gem: Don't fault on presumed_offset write-back 2026-10-20 08:07:28 -10:00
greybus
hid hid-for-linus-2026100201 2026-10-02 09:51:11 -07:00
hsi HSI changes for the 7.3 series 2026-08-21 12:01:23 -07:00
hte
hv mshv_vtl: Check per-CPU register page before mmap 2026-09-19 16:02:34 -07:00
hwmon hwmon: (hp-wmi-sensors) Improve raw WMI string handling 2026-09-16 17:08:19 -07:00
hwspinlock
hwtracing treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
i2c i2c: xiic: restore non-managed runtime PM to fix clk WARN flood 2026-10-15 22:34:34 +02:00
i3c treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
idle Merge branch 'intel-idle-lpi' 2026-08-07 21:22:50 +02:00
iio iio: adc: ad_sigma_delta: fix use-after-free on unbind 2026-09-30 18:59:56 +01:00
infiniband RDMA v7.3 first rc pull 2026-09-14 09:58:12 -07:00
input Input updates for v7.3-rc6 2026-10-11 08:10:43 -07:00
interconnect Revert "interconnect: qcom: x1e80100: enable QoS configuration" 2026-09-16 15:55:38 +03:00
iommu iommupt/kunit: Use if_changed_rule for the kunit 2026-10-14 15:42:12 +02:00
ipack Char/Misc/IIO/etc driver update for 7.3-rc1 2026-08-25 09:38:50 -07:00
irqchip irqchip/gic-v5: Preserve ICC_CR0_EL1 state 2026-09-07 21:44:17 +02:00
leds LEDs for v7.3 2026-08-27 11:05:51 -07:00
macintosh
mailbox treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
mcb
md dm-integrity: validate the superblock on resume 2026-10-01 13:18:00 +02:00
media [GIT PULL for v7.3-rc7] media fixes 2026-10-10 01:22:38 +02:00
memory * Raw NAND changes 2026-08-23 09:11:21 -07:00
memstick memstick: rtsx_usb_ms: complete requests after eject instead of dropping them 2026-09-30 17:53:31 +02:00
message
mfd treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
misc Merge drm/drm-fixes into drm-misc-fixes 2026-09-01 09:38:51 +02:00
mmc mmc: cavium-thunderx: destroy slot platform devices on remove 2026-09-28 17:57:23 +02:00
most
mtd ubi: use put_user() when filling the erase counter array 2026-10-19 19:24:03 -10:00
mux
net wifi: atk9k: Revert "wifi: ath9k: reject short WMI command responses" 2026-10-16 04:46:43 -07:00
nfc nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid() 2026-09-23 22:13:18 +02:00
ntb NTB: ntb_transport: Reject oversized TX buffers 2026-08-20 13:43:24 -07:00
nubus
nvdimm treewide: refresh kmalloc_obj() conversions 2026-09-04 21:37:00 -07:00
nvme block-7.3-20261010 2026-10-11 09:00:33 -07:00
nvmem Char/Misc/IIO/etc driver update for 7.3-rc1 2026-08-25 09:38:50 -07:00
of Devicetree fixes for v7.3, part 2: 2026-10-01 12:47:16 -07:00
opp OPP updates for 7.3-rc2 2026-09-09 19:03:00 +02:00
parisc parisc: eisa: Fix infinite loop when parsing invalid IRQ value 2026-08-18 11:43:05 +02:00
parport
pci PCI/proc: Use get_user()/put_user() for config space reads and writes 2026-10-19 19:23:58 -10:00
pcmcia
peci
perf Perf events fixes: 2026-09-27 08:15:58 -07:00
phy phy: mediatek: phy-mtk-hdmi-mt8195: Fix TMDS clk bit ratio setting 2026-09-13 16:05:23 +05:30
pinctrl pinctrl: sunxi: dt: do not accumulate npins across probe attempts 2026-10-12 11:30:12 +02:00
platform platform-drivers-x86 for v7.3-2 2026-09-11 12:52:48 -07:00
pmdomain pmdomain: rockchip: don't ignore clock lookup errors on attach 2026-09-28 15:36:50 +02:00
pnp PNP: isapnp: use put_user() in the proc read loop 2026-10-19 19:24:01 -10:00
power power sequencing fixes for v7.3 2026-10-16 08:17:30 -07:00
powercap More power management updates for 7.3-rc1 2026-08-26 14:13:26 -07:00
pps pps-gpio: remove dead capture_clear code 2026-08-03 21:10:10 -07:00
ps3
ptp ptp: ocp: fix PCIe delay estimation calculation 2026-10-08 11:01:02 -07:00
pwm Driver core changes for 7.3-rc1 2026-08-19 10:42:18 -07:00
rapidio rapidio: mport_cdev: fix use-after-free in dma_req_free() 2026-08-05 11:20:14 -07:00
ras - Mark the mpc85xx and ThunderX EDAC drivers as orphaned due to lack of 2026-08-31 20:10:39 -07:00
regulator regulator: ltc3676: don't read the write-only HRST and CLIRQ registers 2026-10-06 17:59:42 +02:00
remoteproc remoteproc: qcom_q6v5_pas: Fix error masking in qcom_pas_stop() 2026-08-31 11:45:00 -05:00
resctrl arm64 updates for 7.3 2026-08-18 11:57:17 -07:00
reset Mostly the usual clk driver updates and new SoC additions plus non-critical 2026-08-26 11:14:30 -07:00
rpmsg
rtc rtc: spear: initialize IRQ state before requesting alarm IRQ 2026-09-21 22:46:42 +02:00
s390 Arm: 2026-09-26 08:26:12 -07:00
sbus
scsi SCSI fixes on 20261018 2026-10-18 09:06:02 -10:00
sh
siox
slimbus
soc soc/tegra: Fixes for v7.3 2026-10-12 09:17:28 +02:00
soundwire soundwire: cadence_master: wait and cancel cdns->work before clock stop 2026-09-08 19:19:42 +05:30
spi spi: spi-fsl-lpspi: directly return ret in fsl_lpspi_transfer_one() 2026-10-15 22:37:15 +01:00
spmi
ssb
staging tty: fix saved termios reset race 2026-10-01 11:05:17 +02:00
target scsi: target: iscsi: Fix race in discovery auth updates 2026-10-13 23:08:43 -04:00
tc
tee Reject zero-sized allocations in tee_dyn_shm_alloc_helper() 2026-10-03 23:33:02 +02:00
thermal thermal: gov_step_wise: Fix stale mitigation vote with non-zero lower bounds 2026-09-22 21:16:11 +02:00
thunderbolt thunderbolt: Fixes for v7.3-rc6 2026-10-01 13:26:31 +02:00
tty printk fixes for 7.3-rc7 2026-10-06 11:32:54 +02:00
ufs SCSI fixes on 20261018 2026-10-18 09:06:02 -10:00
uio uio: fsl_elbc_gpcm: use platform helpers for resource and IRQ 2026-07-31 14:21:01 +02:00
usb usb: mtu3: Fix a double-dereference splat in TP_printk 2026-10-08 06:36:57 +02:00
vdpa vdpa_sim: disable page faults around vringh_need_notify_iotlb() 2026-10-20 08:05:08 -10:00
vfio mm.git review status for mm-hotfixes-stable..mm-stable 2026-08-20 18:17:08 -07:00
vhost vhost: vringh: use get_user()/put_user() for IOTLB 16-bit accesses 2026-10-20 08:06:57 -10:00
video fbdev fixes for 7.3-rc3: 2026-09-12 08:06:04 -07:00
virt Char/Misc/IIO fixes for 7.3-rc6 2026-10-03 09:05:47 -07:00
virtio virtio_input: stop callbacks before unregistering input device 2026-09-07 18:54:04 -04:00
w1 1-Wire bus drivers for v7.3 2026-08-06 11:08:37 +02:00
watchdog watchdog: da9063: fix suspend/resume handling of HW_RUNNING watchdog 2026-09-18 08:10:45 -07:00
xen xen: use get_user()/put_user() in gntdev and privcmd 2026-10-20 08:07:27 -10:00
zorro
Kconfig
Makefile