Files
linux/drivers
Steven Price 65e51e30d8 drm/panfrost: Prevent race when handling page fault
When handling a GPU page fault addr_to_drm_mm_node() is used to
translate the GPU address to a buffer object. However it is possible for
the buffer object to be freed after the function has returned resulting
in a use-after-free of the BO.

Change addr_to_drm_mm_node to return the panfrost_gem_object with an
extra reference on it, preventing the BO from being freed until after
the page fault has been handled.

Signed-off-by: Steven Price <steven.price@arm.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190913160310.50444-1-steven.price@arm.com
2019-09-19 11:48:57 -05:00
..
2019-07-18 09:49:30 +02:00
2019-07-15 09:42:32 -07:00
2019-07-22 15:31:00 +02:00
2019-06-15 13:43:06 -07:00
2019-06-08 17:40:28 +02:00
2019-08-19 15:52:29 +02:00
2019-06-12 14:23:50 +02:00
2019-06-12 14:23:50 +02:00