]> git.baikalelectronics.ru Git - kernel.git/commit
drm/i915: Prevent use-after-free in invalidate_range_start callback
authorMichał Winiarski <michal.winiarski@intel.com>
Tue, 3 Feb 2015 14:48:17 +0000 (15:48 +0100)
committerJani Nikula <jani.nikula@intel.com>
Thu, 5 Feb 2015 14:31:30 +0000 (16:31 +0200)
commitca3139191c90ad45735a78e2ef08c29500715799
tree3f2e09686dc7e70d82a75c4d475e84f944606ebe
parent6b7f606f3da7ee4e26ca7e6d3fa1f6267b1f6217
drm/i915: Prevent use-after-free in invalidate_range_start callback

It's possible for invalidate_range_start mmu notifier callback to race
against userptr object release. If the gem object was released prior to
obtaining the spinlock in invalidate_range_start we're hitting null
pointer dereference.

Testcase: igt/gem_userptr_blits/stress-mm-invalidate-close
Testcase: igt/gem_userptr_blits/stress-mm-invalidate-close-overlap
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Michał Winiarski <michal.winiarski@intel.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: stable@vger.kernel.org
[Jani: added code comment suggested by Chris]
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
drivers/gpu/drm/i915/i915_gem_userptr.c