On Thu, Sep 5, 2019 at 1:11 PM Steven Price steven.price@arm.com wrote:
When handling a GPU page fault addr_to_drm_mm_node() is used to translate the GPU address to a buffer object. However it is possible for the buffer object to be freed after the function has returned resulting in a use-after-free of the BO.
Change addr_to_drm_mm_node to return the panfrost_gem_object with an extra reference on it, preventing the BO from being freed until after the page fault has been handled.
Signed-off-by: Steven Price steven.price@arm.com
I've managed to trigger this, generating the following stack trace.
Humm, the assumption was that a fault could only happen during a job and so a reference would already be held. Otherwise, couldn't the GPU also be accessing the BO after it is freed?
Also, looking at this again, I think we need to hold the mm_lock around the drm_mm_for_each_node().
Rob