github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-20 01:20:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
185a4caeec
linux/drivers/gpu/drm/imagination
History
Icenowy Zheng 17e2030f37 drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM 
The drm gpuvm code doesn't protect find operation against map operation,
and the driver needs to ensure a map operation shouldn't happen when a
find operation is in progress.

In some cases a find operation will be in progress when doing map/unmap
operations, and the find operation will do a NULL pointer dereference.

An example of the stack trace of such NULL dereference is shown below:

```
Unable to handle kernel access to user memory without uaccess routines at
virtual address 0000000000000010

[<ffffffff01e989d4>] drm_gpuva_find+0x28/0x6c [drm_gpuvm]
[<ffffffff01ed3a40>] pvr_vm_unmap+0x34/0x68 [powervr]
[<ffffffff01ec69da>] pvr_ioctl_vm_unmap+0x2e/0x50 [powervr]
[<ffffffff8080ce0a>] drm_ioctl_kernel+0x8e/0xdc
[<ffffffff8080d016>] drm_ioctl+0x1be/0x3e0
[<ffffffff802bec3e>] __riscv_sys_ioctl+0xba/0xc4
[<ffffffff80d858b2>] do_trap_ecall_u+0x23e/0x3f4
[<ffffffff80d92288>] handle_exception+0x168/0x174
```

As all occurences of drm_gpuva_find*() are already guarded by
vm_ctx->lock, make pvr_vm_map() to acquire this lock to prevent
disturbing any find operation. This fixes the NULL deference problem in
drm_gpuva_find*().

Cc: stable@vger.kernel.org
Fixes: ff5f643de0 ("drm/imagination: Add GEM and VM related code")
Fixes: 4bc736f890 ("drm/imagination: vm: make use of GPUVM's drm_exec helper")
Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn>
Reviewed-by: Alessio Belle <alessio.belle@imgtec.com>
Link: https://patch.msgid.link/20260714073641.1935075-1-zhengxingda@iscas.ac.cn
Signed-off-by: Alessio Belle <alessio.belle@imgtec.com>
2026-07-20 15:01:14 +01:00
..
Kconfig drm/imagination: KUnit test for pvr_gpuid_decode_string() 2026-01-19 11:20:22 +00:00
Makefile drm/imagination: Add support for trace points 2026-05-19 12:47:19 +01:00
pvr_ccb.c drm/imagination: Implement handling of context reset notification 2026-03-24 08:22:21 +00:00
pvr_ccb.h drm/imagination: Implement firmware infrastructure and META FW support 2023-11-23 09:01:46 +01:00
pvr_cccb.c drm/imagination: Implement context creation/destruction ioctls 2023-11-23 09:01:46 +01:00
pvr_cccb.h drm/imagination: Numerous documentation fixes. 2023-11-28 18:56:03 +01:00
pvr_context.c drm/imagination: fix error checking of pvr_vm_context_lookup() 2026-07-09 15:07:32 +01:00
pvr_context.h drm/imagination: Break an object reference loop 2024-11-04 09:41:38 +00:00
pvr_debugfs.c drm/imagination: Simplify module parameters 2026-01-19 11:20:21 +00:00
pvr_debugfs.h drm/imagination: Add firmware trace to debugfs 2023-11-23 09:01:47 +01:00
pvr_device_info.c drm/imagination: Fixed warning due to implicit cast to bool 2023-12-04 09:41:34 +01:00
pvr_device_info.h drm/imagination: Add GPU ID parsing and firmware loading 2023-11-23 09:01:46 +01:00
pvr_device.c drm/imagination: Access FW initialised state with READ/WRITE_ONCE 2026-05-19 12:40:15 +01:00
pvr_device.h drm/imagination: Use dev_pm_domain_attach_list() 2026-02-06 10:18:30 +00:00
pvr_drv.c drm fixes for 7.2-rc2 2026-07-03 15:42:20 -10:00
pvr_drv.h drm: remove driver date from struct drm_driver and all drivers 2024-12-05 12:35:42 +02:00
pvr_dump.c drm/imagination: Implement handling of context reset notification 2026-03-24 08:22:21 +00:00
pvr_dump.h drm/imagination: Implement handling of context reset notification 2026-03-24 08:22:21 +00:00
pvr_free_list.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pvr_free_list.h drm/imagination: Implement free list and HWRT create and destroy ioctls 2023-11-23 09:01:46 +01:00
pvr_fw_info.h drm/imagination: Numerous documentation fixes. 2023-11-28 18:56:03 +01:00
pvr_fw_meta.c drm: include drm_print.h where needed 2025-10-31 10:34:52 +02:00
pvr_fw_meta.h drm/imagination: Implement firmware infrastructure and META FW support 2023-11-23 09:01:46 +01:00
pvr_fw_mips.c drm/imagination: Move ELF fw utils to common file 2025-04-15 12:21:52 +01:00
pvr_fw_mips.h drm/imagination: Ensure PVR_MIPS_PT_PAGE_COUNT is never zero 2024-04-29 12:31:28 +01:00
pvr_fw_riscv.c drm/imagination: Add RISC-V firmware processor support 2025-04-15 12:21:52 +01:00
pvr_fw_startstop.c drm/imagination: Skip 2nd thread DM association for non META Firmware 2026-03-23 15:02:05 +00:00
pvr_fw_startstop.h drm/imagination: Implement firmware infrastructure and META FW support 2023-11-23 09:01:46 +01:00
pvr_fw_trace.c drm/imagination: make pvr_fw_trace_init_mask_ops static 2026-07-09 15:07:23 +01:00
pvr_fw_trace.h drm/imagination: Simplify module parameters 2026-01-19 11:20:21 +00:00
pvr_fw_util.c drm/imagination: Move ELF fw utils to common file 2025-04-15 12:21:52 +01:00
pvr_fw.c drm/imagination: Access FW initialised state with READ/WRITE_ONCE 2026-05-19 12:40:15 +01:00
pvr_fw.h drm/imagination: Rename FW booted to FW initialised 2026-05-19 12:40:15 +01:00
pvr_gem.c drm/gem-shmem: Track folio accessed/dirty status in vmap 2026-03-11 09:33:43 +01:00
pvr_gem.h drm/imagination: Use cached memory with dma_coherent 2025-04-15 12:21:52 +01:00
pvr_hwrt.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pvr_hwrt.h drm/imagination: Numerous documentation fixes. 2023-11-28 18:56:03 +01:00
pvr_job.c drm/imagination: Add support for trace points 2026-05-19 12:47:19 +01:00
pvr_job.h drm/imagination: Implement job submission and scheduling 2023-11-23 09:01:47 +01:00
pvr_mmu.c drm/imagination: Access FW initialised state with READ/WRITE_ONCE 2026-05-19 12:40:15 +01:00
pvr_mmu.h drm/imagination: Add GEM and VM related code 2023-11-23 09:01:46 +01:00
pvr_power.c drm/imagination: Fix missing argument in pvr_power_fw_{en,dis}able() 2026-05-20 10:52:10 +02:00
pvr_power.h drm/imagination: Discard pm_runtime_put() return value 2026-01-08 15:19:15 +01:00
pvr_queue.c drm/imagination: Fix double call to drm_sched_entity_fini() 2026-07-02 11:15:35 +01:00
pvr_queue.h drm/imagination: Fix double call to drm_sched_entity_fini() 2026-07-02 11:15:35 +01:00
pvr_rogue_cr_defs_client.h drm/imagination: Add GPU register headers 2023-11-23 09:01:45 +01:00
pvr_rogue_cr_defs.h drm/imagination: Update register defs for newer GPUs 2025-04-15 12:21:50 +01:00
pvr_rogue_defs.h drm/imagination: Add GPU register headers 2023-11-23 09:01:45 +01:00
pvr_rogue_fwif_check.h drm/imagination: Add FWIF headers 2023-11-23 09:01:46 +01:00
pvr_rogue_fwif_client_check.h drm/imagination: Add FWIF headers 2023-11-23 09:01:46 +01:00
pvr_rogue_fwif_client.h drm/imagination: Add FWIF headers 2023-11-23 09:01:46 +01:00
pvr_rogue_fwif_common.h drm/imagination: Add FWIF headers 2023-11-23 09:01:46 +01:00
pvr_rogue_fwif_dev_info.h drm/imagination: Add FWIF headers 2023-11-23 09:01:46 +01:00
pvr_rogue_fwif_resetframework.h drm/imagination: Add FWIF headers 2023-11-23 09:01:46 +01:00
pvr_rogue_fwif_sf.h drm/imagination: Fix a couple of spelling mistakes in literal strings 2023-11-28 13:55:37 +01:00
pvr_rogue_fwif_shared_check.h drm/imagination: Add FWIF headers 2023-11-23 09:01:46 +01:00
pvr_rogue_fwif_shared.h drm/imagination: Minor improvements to job submission code documentation 2026-04-08 11:17:14 +01:00
pvr_rogue_fwif_stream.h drm/imagination: Add FWIF headers 2023-11-23 09:01:46 +01:00
pvr_rogue_fwif.h drm/imagination: Switch reset_reason fields from enum to u32 2026-03-24 08:19:59 +00:00
pvr_rogue_heap_config.h drm/imagination: Add firmware and MMU related headers 2023-11-23 09:01:45 +01:00
pvr_rogue_meta.h drm/imagination: Add firmware and MMU related headers 2023-11-23 09:01:45 +01:00
pvr_rogue_mips_check.h drm/imagination: Add firmware and MMU related headers 2023-11-23 09:01:45 +01:00
pvr_rogue_mips.h drm/imagination: Add firmware and MMU related headers 2023-11-23 09:01:45 +01:00
pvr_rogue_mmu_defs.h drm/imagination: Add firmware and MMU related headers 2023-11-23 09:01:45 +01:00
pvr_rogue_riscv.h drm/imagination: Add RISC-V firmware processor support 2025-04-15 12:21:52 +01:00
pvr_stream_defs.c drm/imagination: Implement job submission and scheduling 2023-11-23 09:01:47 +01:00
pvr_stream_defs.h drm/imagination: Implement context creation/destruction ioctls 2023-11-23 09:01:46 +01:00
pvr_stream.c drm/imagination: loop counters moved to loop scope 2025-04-07 10:09:40 +01:00
pvr_stream.h drm/imagination: Implement context creation/destruction ioctls 2023-11-23 09:01:46 +01:00
pvr_sync.c drm/imagination: Rename fence returned by pvr_queue_job_arm() 2026-04-08 11:17:13 +01:00
pvr_sync.h drm/imagination: Rename fence returned by pvr_queue_job_arm() 2026-04-08 11:17:13 +01:00
pvr_test.c drm/imagination: KUnit test for pvr_gpuid_decode_string() 2026-01-19 11:20:22 +00:00
pvr_trace_points.c drm/imagination: Add support for trace points 2026-05-19 12:47:19 +01:00
pvr_trace.h drm/imagination: Add support for trace points 2026-05-19 12:47:19 +01:00
pvr_vm_mips.c drm/imagination: loop counters moved to loop scope 2025-04-07 10:09:40 +01:00
pvr_vm_mips.h drm/imagination: Implement MIPS firmware processor and MMU support 2023-11-23 09:01:46 +01:00
pvr_vm.c drm/imagination: acquire vm_ctx->lock before mapping memory to GPU VM 2026-07-20 15:01:14 +01:00
pvr_vm.h drm/imagination: Hold drm_gem_gpuva lock for unmap 2025-03-03 12:09:00 +00:00