On Fri, Sep 13, 2019 at 11:03 AM Steven Price <steven.price@xxxxxxx> wrote: > > When handling a GPU page fault addr_to_drm_mm_node() is used to > translate the GPU address to a buffer object. However it is possible for > the buffer object to be freed after the function has returned resulting > in a use-after-free of the BO. > > Change addr_to_drm_mm_node to return the panfrost_gem_object with an > extra reference on it, preventing the BO from being freed until after > the page fault has been handled. > > Signed-off-by: Steven Price <steven.price@xxxxxxx> > --- > Changes since v1: > * Hold the mm_lock around drm_mm_for_each_node() > > I've also posted a new IGT test for this: > https://patchwork.freedesktop.org/patch/330513/ > > drivers/gpu/drm/panfrost/panfrost_mmu.c | 55 ++++++++++++++++--------- > 1 file changed, 36 insertions(+), 19 deletions(-) Applied. Rob _______________________________________________ dri-devel mailing list dri-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.freedesktop.org/mailman/listinfo/dri-devel
