diff options
| author | Wentao Liang <vulab@iscas.ac.cn> | 2026-09-16 17:55:48 +0000 |
|---|---|---|
| committer | Rob Clark <robin.clark@oss.qualcomm.com> | 2026-09-27 08:18:22 -0700 |
| commit | 81878aa1a2f551f51a3d3aef2a9509503ec34d8b (patch) | |
| tree | 57072b2440c59b112bcac6ffb7ab92d4ca7195b2 /drivers/gpu/drm/msm | |
| parent | dbec5e6191bee37117382e4e7b7220167f1f3f18 (diff) | |
| download | linux-next-81878aa1a2f551f51a3d3aef2a9509503ec34d8b.tar.gz linux-next-81878aa1a2f551f51a3d3aef2a9509503ec34d8b.zip | |
drm/msm: Fix vm_bo use-after-free in with_vm_locks()
The unwind loop drops the vm_bo reference taken while locking before
advancing to the next entry. drm_gpuvm_bo_put() may drop the last
reference, removing and freeing the vm_bo, after which the plain list
iterator dereferences freed memory to advance.
Use the safe iterator, which saves the next entry before the body runs.
Fixes: fe4952b5f27cca5d ("drm/msm: Convert vm locking")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Patchwork: https://patchwork.freedesktop.org/patch/754331/
Message-ID: <20260916175548.2089821-1-vulab@iscas.ac.cn>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Diffstat (limited to 'drivers/gpu/drm/msm')
| -rw-r--r-- | drivers/gpu/drm/msm/msm_gem_shrinker.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/gpu/drm/msm/msm_gem_shrinker.c b/drivers/gpu/drm/msm/msm_gem_shrinker.c index 9d2788f79ace..a626fbb869db 100644 --- a/drivers/gpu/drm/msm/msm_gem_shrinker.c +++ b/drivers/gpu/drm/msm/msm_gem_shrinker.c @@ -51,6 +51,7 @@ with_vm_locks(void (*fn)(struct drm_gem_object *obj), * success paths */ struct drm_gpuvm_bo *vm_bo, *last_locked = NULL; + struct drm_gpuvm_bo *next; bool locked = true; drm_gem_for_each_gpuvm_bo (vm_bo, obj) { @@ -82,7 +83,7 @@ with_vm_locks(void (*fn)(struct drm_gem_object *obj), out_unlock: if (last_locked) { - drm_gem_for_each_gpuvm_bo (vm_bo, obj) { + drm_gem_for_each_gpuvm_bo_safe(vm_bo, next, obj) { struct dma_resv *resv = drm_gpuvm_resv(vm_bo->vm); if (resv == obj->resv) |