Zhenghang Xiao 7164d78559 drm/gem: fix race between change_handle and handle_delete ... drm_gem_change_handle_ioctl leaves the old handle live in the IDR during the window between spin_unlock(table_lock) and the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle succeeds in this window, decrements handle_count to 0, and frees the GEM object while the new handle's IDR entry still references it. NULL the old handle's IDR entry before dropping table_lock so that any concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL. Restore the old entry on the prime-bookkeeping error path. Fixes: 5e28b7b944 ("drm: Set old handle to NULL before prime swap in change_handle") Signed-off-by: Zhenghang Xiao <kipreyyy@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com> Link: https://patch.msgid.link/20260526085313.26791-1-kipreyyy@gmail.com		2026-05-30 07:01:39 +10:00
..
drm	drm/gem: fix race between change_handle and handle_delete	2026-05-30 07:01:39 +10:00
host1x	gpu: host1x: convert MIPI to use operation function pointers	2026-03-19 08:18:36 +01:00
ipu-v3	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
nova-core	drm for v7.1-rc1	2026-04-15 08:45:00 -07:00
tests	gpu/tests/gpu_buddy: Add gpu_test_buddy_alloc_range for exact-range allocation	2026-03-09 13:58:12 +05:30
trace
vga	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
buddy.c	drm/buddy: Improve offset-aligned allocation handling	2026-03-09 12:36:10 +05:30
Kconfig
Makefile	gpu: Fix uninitialized buddy for built-in drivers	2026-02-24 13:40:59 +10:00