lkml.org 
[lkml]   [2019]   [Sep]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH v2] drm/panfrost: Prevent race when handling page fault
On Fri, Sep 13, 2019 at 11:03 AM Steven Price <steven.price@arm.com> wrote:
>
> When handling a GPU page fault addr_to_drm_mm_node() is used to
> translate the GPU address to a buffer object. However it is possible for
> the buffer object to be freed after the function has returned resulting
> in a use-after-free of the BO.
>
> Change addr_to_drm_mm_node to return the panfrost_gem_object with an
> extra reference on it, preventing the BO from being freed until after
> the page fault has been handled.
>
> Signed-off-by: Steven Price <steven.price@arm.com>
> ---
> Changes since v1:
> * Hold the mm_lock around drm_mm_for_each_node()
>
> I've also posted a new IGT test for this:
> https://patchwork.freedesktop.org/patch/330513/
>
> drivers/gpu/drm/panfrost/panfrost_mmu.c | 55 ++++++++++++++++---------
> 1 file changed, 36 insertions(+), 19 deletions(-)

Applied.

Rob

\
 
 \ /
  Last update: 2019-09-19 18:55    [W:0.058 / U:0.008 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site