Zhenghang Xiao 7164d78559 drm/gem: fix race between change_handle and handle_delete ...

drm_gem_change_handle_ioctl leaves the old handle live in the IDR
during the window between spin_unlock(table_lock) and the final
spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old
handle succeeds in this window, decrements handle_count to 0, and frees
the GEM object while the new handle's IDR entry still references it.

NULL the old handle's IDR entry before dropping table_lock so that any
concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL.
Restore the old entry on the prime-bookkeeping error path.

Fixes: 5e28b7b944 ("drm: Set old handle to NULL before prime swap in change_handle")
Signed-off-by: Zhenghang Xiao <kipreyyy@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>
Link: https://patch.msgid.link/20260526085313.26791-1-kipreyyy@gmail.com

2026-05-30 07:01:39 +10:00

..

adp

drm: include drm_print.h where needed

2025-10-31 10:34:52 +02:00

amd

drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx

2026-05-27 12:06:26 -04:00

arm

drm/komeda: Add support for Arm China Linlon-D6

2026-03-24 16:08:54 +00:00

armada

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

aspeed

…

ast

drm/ast: dp501: Fix initialization of SCU2C

2026-03-30 10:38:11 +02:00

atmel-hlcdc

drm: atmel-hlcdc: add LCD controller layer definition for sama7d65

2026-02-25 09:20:45 +05:30

bridge

drm/bridge: megachips: remove bridge when irq request fails

2026-05-19 10:46:33 +02:00

ci

Merge tag 'drm-msm-next-2026-04-02' of https://gitlab.freedesktop.org/drm/msm into drm-next

2026-04-03 18:57:00 +10:00

clients

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

display

drm/display: hdmi: Use drm_output_color_format instead of hdmi_colorspace

2026-03-24 13:54:35 +01:00

etnaviv

drm/etnaviv: Fix armed job not being pushed to the DRM scheduler

2026-05-05 11:40:16 +02:00

exynos

drm/exynos: remove bridge when component_add fails

2026-05-05 16:50:42 +02:00

fsl-dcu

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

gma500

drm/gma500/oaktrail_lvds: fix i2c adapter leaks on init

2026-05-13 20:15:17 +02:00

gud

Merge drm/drm-fixes into drm-misc-next-fixes

2026-03-30 10:05:36 +02:00

hisilicon

drm/hisilicon/hibmc: Adding reset colorbar cfg in dp init.

2026-01-20 10:53:14 +02:00

hyperv

drm/hyperv: validate VMBus packet size in receive callback

2026-05-25 07:31:53 -04:00

i915

drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable

2026-05-26 09:31:48 +01:00

imagination

drm/imagination: Fix segfault when updating ftrace mask

2026-04-27 14:22:52 +01:00

imx

drm/imx: ipuv3-plane: support underlay plane

2026-03-13 16:27:06 +01:00

ingenic

drm/atomic: Remove state argument to drm_atomic_private_obj_init

2026-03-20 10:03:11 +01:00

kmb

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

lima

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

logicvc

drm/logicvc: Fix device node reference leak in logicvc_drm_config_parse()

2026-02-10 15:18:36 +01:00

loongson

drm/loongson: Use managed KMS polling

2026-05-15 08:50:54 +02:00

mcde

drm/mcde: dsi: convert to of_drm_find_and_get_bridge()

2026-02-23 10:10:34 +01:00

mediatek

drm/mediatek: mtk_hdmi_ddc: Fix non-static global variable

2026-05-18 14:21:39 +00:00

meson

Merge tag 'drm-msm-next-2026-04-02' of https://gitlab.freedesktop.org/drm/msm into drm-next

2026-04-03 18:57:00 +10:00

mgag200

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

msm

drm/msm: Restore second parameter name in purge() and evict()

2026-05-24 10:31:24 -07:00

mxsfb

drm: lcdif: Use dev_err_probe()

2026-03-10 09:42:09 +08:00

nouveau

Revert "drm/nouveau/gsp: add support for GA100"

2026-05-01 01:08:00 +02:00

nova

rust: gem: Introduce DriverObject::Args

2026-03-26 02:08:04 +01:00

omapdrm

drm/atomic: Remove state argument to drm_atomic_private_obj_init

2026-03-20 10:03:11 +01:00

panel

drm/panel: himax-hx83102: restore MODE_LPM after sending disable cmds

2026-05-05 14:43:36 +02:00

panfrost

drm/panfrost: Fix wait_bo ioctl leaking positive return from dma_resv_wait_timeout()

2026-05-07 14:52:55 +01:00

panthor

Merge tag 'drm-fixes-2026-04-24' of https://gitlab.freedesktop.org/drm/kernel

2026-04-24 11:44:52 -07:00

pl111

BackMerge tag 'v6.19-rc7' into drm-next

2026-01-28 12:44:28 +10:00

qxl

drm/qxl: Fix missing KMS poll cleanup

2026-05-04 14:54:44 +02:00

radeon

drm/radeon/evergreen_cs: Add missing NULL prefix check in surface check

2026-05-19 12:16:16 -04:00

renesas

drm: rcar-du: Fix crash when no CMM is available

2026-04-23 15:53:46 +03:00

rockchip

drm/rockchip: analogix: Convert to drm_output_color_format

2026-03-24 13:54:34 +01:00

scheduler

Merge v7.0-rc3 into drm-next

2026-03-11 11:18:31 +01:00

sitronix

Merge drm/drm-fixes into drm-misc-next-fixes

2026-03-30 10:05:36 +02:00

solomon

drm/solomon: Fix page start when updating rectangle in page addressing mode

2026-02-26 13:42:09 +01:00

sprd

…

sti

drm/sti: remove bridge when sti_hda component_add fails

2026-05-04 22:52:39 +02:00

stm

drm/bridge: stm_lvds: Do not fail atomic_check on disabled connector

2026-04-13 12:52:33 +02:00

sun4i

drm/display: hdmi: Use drm_output_color_format instead of hdmi_colorspace

2026-03-24 13:54:35 +01:00

sysfb

drm/sysfb: ofdrm: fix PCI device reference leaks

2026-04-27 11:30:49 +02:00

tegra

Merge tag 'drm-next-2026-04-15' of https://gitlab.freedesktop.org/drm/kernel

2026-04-15 08:45:00 -07:00

tests

drm/display: hdmi: Use drm_output_color_format instead of hdmi_colorspace

2026-03-24 13:54:35 +01:00

tidss

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

tilcdc

drm/tilcdc: Fix type mismatch

2026-03-17 17:50:49 +01:00

tiny

drm/bochs: Drop manual put on probe error path

2026-05-07 10:51:18 +02:00

ttm

drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure

2026-05-14 15:32:29 +02:00

tve200

drm: include drm_print.h where needed

2025-10-31 10:34:52 +02:00

tyr

Merge tag 'drm-next-2026-04-15' of https://gitlab.freedesktop.org/drm/kernel

2026-04-15 08:45:00 -07:00

udl

drm/udl: Increase GET_URB_TIMEOUT

2026-04-28 10:50:41 +02:00

v3d

drm/v3d: Release indirect CSD GEM reference on CPU job free

2026-05-18 19:59:51 -03:00

vboxvideo

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

vc4

Merge tag 'drm-next-2026-04-15' of https://gitlab.freedesktop.org/drm/kernel

2026-04-15 08:45:00 -07:00

verisilicon

drm: verisilicon: make vs_dc_platform_driver static

2026-03-25 15:21:23 +01:00

vgem

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

virtio

drm/virtio: use uninterruptible resv lock for plane updates

2026-05-20 18:12:11 +03:00

vkms

drm/vkms: Support setting custom background color

2026-03-18 09:59:57 +00:00

vmwgfx

BackMerge tag 'v7.0-rc6' into drm-next

2026-03-31 07:51:02 +10:00

xe

drm/xe: Restore IDLEDLY regiter on engine reset

2026-05-27 11:27:22 -04:00

xen

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

xlnx

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_atomic_helper.c

Merge tag 'drm-fixes-2026-04-24' of https://gitlab.freedesktop.org/drm/kernel

2026-04-24 11:44:52 -07:00

drm_atomic_state_helper.c

drm: Add CRTC background color property

2026-03-18 09:59:57 +00:00

drm_atomic_uapi.c

drm: Add CRTC background color property

2026-03-18 09:59:57 +00:00

drm_atomic.c

drm/atomic: Remove state argument to drm_atomic_private_obj_init

2026-03-20 10:03:11 +01:00

drm_auth.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_blend.c

drm: Add CRTC background color property

2026-03-18 09:59:57 +00:00

drm_bridge_helper.c

…

drm_bridge.c

Merge v7.0-rc7 into drm-next

2026-04-07 12:36:31 +02:00

drm_buddy.c

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

drm_cache.c

…

drm_client_event.c

drm/client: Pass force parameter to client restore

2025-11-25 08:43:46 +01:00

drm_client_modeset.c

drm/client: Do not destroy NULL modes

2026-02-25 09:31:54 +02:00

drm_client_sysrq.c

drm/client: Support emergency restore via sysrq for all clients

2025-11-25 08:43:47 +01:00

drm_client.c

drm/client: Export drm_client_buffer_create()

2026-03-03 09:28:31 +01:00

drm_color_mgmt.c

drm/color-mgmt: Typo s/R332/RGB332/

2026-04-27 11:36:05 +02:00

drm_colorop.c

drm/colorop: Preserve bypass value in duplicate_state()

2026-03-16 08:33:05 +05:30

drm_connector.c

drm/display: hdmi: Use drm_output_color_format instead of hdmi_colorspace

2026-03-24 13:54:35 +01:00

drm_crtc_helper_internal.h

…

drm_crtc_helper.c

Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses

2026-02-22 08:26:33 -08:00

drm_crtc_internal.h

drm/colorop: Introduce DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE

2025-11-26 23:03:32 +01:00

drm_crtc.c

drm/simple-kms: Deprecate simple-kms helpers

2026-03-25 15:05:22 +01:00

drm_damage_helper.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_debugfs_crc.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_debugfs.c

drm/debug: don't register files for unsupported HDMI InfoFrames

2026-01-19 13:11:47 +02:00

drm_displayid_internal.h

drm/displayid: add quirk to ignore DisplayID checksum errors

2025-11-04 14:49:30 +02:00

drm_displayid.c

drm/displayid: add quirk to ignore DisplayID checksum errors

2025-11-04 14:49:30 +02:00

drm_draw_internal.h

drm/draw: add drm_draw_can_convert_from_xrgb8888

2025-12-19 23:06:41 +01:00

drm_draw.c

drm/draw: add drm_draw_can_convert_from_xrgb8888

2025-12-19 23:06:41 +01:00

drm_drv.c

drm/gem: Make the GEM LRU lock part of drm_device

2026-05-18 15:16:47 +02:00

drm_dumb_buffers.c

drm: prevent integer overflows in dumb buffer creation helpers

2026-05-29 08:30:47 +02:00

drm_edid_load.c

…

drm_edid.c

drm/edid: Parse AMD Vendor-Specific Data Block

2026-04-03 13:45:49 -04:00

drm_eld.c

…

drm_encoder.c

…

drm_exec.c

…

drm_fb_dma_helper.c

…

drm_fb_helper.c

drm/fb-helper: Fix clipping when damage area spans a single scanline

2026-05-04 14:55:40 +02:00

drm_fbdev_dma.c

drm/fb-helper: Allocate and release fb_info in single place

2025-11-25 11:02:43 +01:00

drm_fbdev_shmem.c

drm/fb-helper: Allocate and release fb_info in single place

2025-11-25 11:02:43 +01:00

drm_fbdev_ttm.c

drm/fb-helper: Allocate and release fb_info in single place

2025-11-25 11:02:43 +01:00

drm_file.c

Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"

2026-03-26 14:09:26 +01:00

drm_flip_work.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

drm_format_helper.c

drm/format-helper: Remove drm_fb_blit()

2025-09-23 15:06:06 +02:00

drm_format_internal.h

…

drm_fourcc.c

…

drm_framebuffer.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_gem_atomic_helper.c

drm/simple-kms: Deprecate simple-kms helpers

2026-03-25 15:05:22 +01:00

drm_gem_dma_helper.c

drm/gem-dma: set VM_DONTDUMP for mmap

2026-03-26 14:35:18 +08:00

drm_gem_framebuffer_helper.c

drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs()

2026-04-27 11:27:22 +02:00

drm_gem_shmem_helper.c

drm/shmem_helper: Make sure PMD entries get the writeable upgrade

2026-04-03 10:11:04 +02:00

drm_gem_ttm_helper.c

drm: include drm_print.h where needed

2025-10-31 10:34:52 +02:00

drm_gem_vram_helper.c

drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs

2026-04-09 09:34:28 +02:00

drm_gem.c

drm/gem: fix race between change_handle and handle_delete

2026-05-30 07:01:39 +10:00

drm_gpusvm.c

drm/pagemap: Add helper to access zone_device_data

2026-03-13 18:12:07 -07:00

drm_gpuvm.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_internal.h

drm/client: Support emergency restore via sysrq for all clients

2025-11-25 08:43:47 +01:00

drm_ioc32.c

drm/ioc32: stop speculation on the drm_compat_ioctl path

2026-04-02 08:24:55 +02:00

drm_ioctl.c

drm/colorop: Introduce DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE

2025-11-26 23:03:32 +01:00

drm_kms_helper_common.c

…

drm_lease.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

drm_managed.c

…

drm_mipi_dbi.c

drm/mipi-dbi: Remove simple-display helpers from mipi-dbi

2026-03-25 15:05:17 +01:00

drm_mipi_dsi.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_mm.c

drm: include drm_print.h where needed

2025-10-31 10:34:52 +02:00

drm_mode_config.c

Merge v7.0-rc7 into drm-next

2026-04-07 12:36:31 +02:00

drm_mode_object.c

drm/mode_object: add drm_object_immutable_property_get_value()

2026-01-14 02:18:31 +02:00

drm_modes.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_modeset_helper.c

drm/simple-kms: Deprecate simple-kms helpers

2026-03-25 15:05:22 +01:00

drm_modeset_lock.c

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21 01:02:28 -08:00

drm_of.c

drm: of: fix documentation reference

2025-08-21 16:21:08 +02:00

drm_pagemap_util.c

drm/pagemap_util: Ensure proper cache lock management on free

2026-03-17 15:39:07 +01:00

drm_pagemap.c

drm/pagemap: Enable THP support for GPU memory migration

2026-03-13 18:12:59 -07:00

drm_panel_backlight_quirks.c

drm: panel-backlight-quirks: Add Steam Deck brightness quirk

2025-09-03 10:23:03 -05:00

drm_panel_orientation_quirks.c

…

drm_panel.c

drm/panel: Allow powering on panel follower after panel is enabled

2025-08-25 09:17:49 -07:00

drm_panic_qr.rs

drm/panic: use core::ffi::CStr method names

2025-09-16 09:26:59 +02:00

drm_panic.c

drm/panic: Fix expected string for QR_CODE in drm_panic_type_map

2026-01-09 08:53:27 +00:00

drm_pci.c

…

drm_plane_helper.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

drm_plane.c

Convert more 'alloc_obj' cases to default GFP_KERNEL arguments

2026-02-21 20:03:00 -08:00

drm_prime.c

drm/prime: Limit scatter list size with dedicated DMA device

2026-03-23 13:23:29 +08:00

drm_print.c

…

drm_privacy_screen_x86.c

…

drm_privacy_screen.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_probe_helper.c

drm/probe-helper: replace use of system_wq with system_percpu_wq

2026-02-09 09:41:09 +01:00

drm_property.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_ras_genl_family.c

drm/ras: Introduce the DRM RAS infrastructure over generic netlink

2026-03-05 19:38:55 -05:00

drm_ras_nl.c

drm/ras: Introduce the DRM RAS infrastructure over generic netlink

2026-03-05 19:38:55 -05:00

drm_ras_nl.h

drm/ras: Introduce the DRM RAS infrastructure over generic netlink

2026-03-05 19:38:55 -05:00

drm_ras.c

drm/ras: Introduce the DRM RAS infrastructure over generic netlink

2026-03-05 19:38:55 -05:00

drm_rect.c

…

drm_self_refresh_helper.c

Merge drm/drm-next into drm-misc-next

2026-02-23 11:48:20 +01:00

drm_simple_kms_helper.c

drm/simple-kms: Deprecate simple-kms helpers

2026-03-25 15:05:22 +01:00

drm_suballoc.c

Merge tag 'drm-xe-next-2026-03-02' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next

2026-03-03 10:37:29 +10:00

drm_syncobj.c

drm/syncobj: Fix xa_alloc allocation flags

2026-03-25 08:05:35 +00:00

drm_sysfs.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_trace_points.c

…

drm_trace.h

…

drm_vblank_helper.c

drm/vblank: Add CRTC helpers for simple use cases

2025-10-01 08:32:00 +02:00

drm_vblank_work.c

drm/vblank: use drm_crtc_vblank_crtc() in workers

2025-11-10 13:22:58 +02:00

drm_vblank.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_vma_manager.c

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-21 17:09:51 -08:00

drm_writeback.c

dma-buf: inline spinlock for fence protection v5

2026-02-23 16:14:19 +01:00

Kconfig

Merge tag 'drm-rust-next-2026-03-30' of https://gitlab.freedesktop.org/drm/rust/kernel into drm-next

2026-04-01 07:32:05 +10:00

Kconfig.debug

drm: fix dead default for DRM_TTM_KUNIT_TEST

2026-03-24 16:19:04 +01:00

Makefile

Merge drm/drm-next into drm-xe-next

2026-03-12 07:23:23 -07:00