Re: [PATCH v2] drm/panfrost: Prevent race when handling page fault

On Fri, Sep 13, 2019 at 11:03 AM Steven Price steven.price@arm.com wrote:

When handling a GPU page fault addr_to_drm_mm_node() is used to translate the GPU address to a buffer object. However it is possible for the buffer object to be freed after the function has returned resulting in a use-after-free of the BO.

Change addr_to_drm_mm_node to return the panfrost_gem_object with an extra reference on it, preventing the BO from being freed until after the page fault has been handled.

Signed-off-by: Steven Price steven.price@arm.com

Changes since v1:

• Hold the mm_lock around drm_mm_for_each_node()

I've also posted a new IGT test for this: https://patchwork.freedesktop.org/patch/330513/

drivers/gpu/drm/panfrost/panfrost_mmu.c | 55 ++++++++++++++++--------- 1 file changed, 36 insertions(+), 19 deletions(-)

Applied.

Rob