Edward Adam Davis dc366607c4 drm: Replace old pointer to new idr ... Commit 5e28b7b944 introduced a logical error by failing to replace the newly generated IDR pointer to old id's pointer at the correct location within the "change handle" logic; this resulted in the issue reported by syzbot [1]. Specifically, the new IDR object pointer is intended to replace the original id's pointer during the normal execution flow. Additionally, an unnecessary conditional check for the ret exit path has been removed. [1] !RB_EMPTY_ROOT(&prime_fpriv->dmabufs) WARNING: drivers/gpu/drm/drm_prime.c:224 at drm_prime_destroy_file_private+0x48/0x60 drivers/gpu/drm/drm_prime.c:224, CPU#0: syz.0.17/5833 Call Trace: drm_file_free.part.0+0x7e6/0xcc0 drivers/gpu/drm/drm_file.c:269 drm_file_free drivers/gpu/drm/drm_file.c:237 [inline] drm_close_helper.isra.0+0x186/0x200 drivers/gpu/drm/drm_file.c:290 drm_release+0x1ab/0x360 drivers/gpu/drm/drm_file.c:438 Fixes: 5e28b7b944 ("drm: Set old handle to NULL before prime swap in change_handle") Reported-by: syzbot+d7c9eed171647e421013@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d7c9eed171647e421013 Cc: stable@vger.kernel.org Tested-by: syzbot+d7c9eed171647e421013@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis@qq.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Link: https://patch.msgid.link/tencent_C267296443AAA4567771176886DFF364A305@qq.com		2026-05-16 09:32:43 +10:00
..
drm	drm: Replace old pointer to new idr	2026-05-16 09:32:43 +10:00
host1x	gpu: host1x: convert MIPI to use operation function pointers	2026-03-19 08:18:36 +01:00
ipu-v3	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
nova-core	drm for v7.1-rc1	2026-04-15 08:45:00 -07:00
tests	gpu/tests/gpu_buddy: Add gpu_test_buddy_alloc_range for exact-range allocation	2026-03-09 13:58:12 +05:30
trace
vga	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
buddy.c	drm/buddy: Improve offset-aligned allocation handling	2026-03-09 12:36:10 +05:30
Kconfig	gpu: Move DRM buddy allocator one level up (part two)	2026-02-06 11:38:35 +10:00
Makefile	gpu: Fix uninitialized buddy for built-in drivers	2026-02-24 13:40:59 +10:00