diff options
| author | Steven Price <steven.price@arm.com> | 2019-09-13 17:03:10 +0100 |
|---|---|---|
| committer | Rob Herring <robh@kernel.org> | 2019-09-19 11:48:57 -0500 |
| commit | 65e51e30d8625c82ddfe405da46124e9bbffaa71 (patch) | |
| tree | e43d8815de1f0a981d4b05c8b9b2b875fe0f7270 /drivers/gpu/drm/tilcdc/Makefile | |
| parent | d18a96620411298f7925bf9a9e26e9e7add8ea2b (diff) | |
drm/panfrost: Prevent race when handling page fault
When handling a GPU page fault addr_to_drm_mm_node() is used to
translate the GPU address to a buffer object. However it is possible for
the buffer object to be freed after the function has returned resulting
in a use-after-free of the BO.
Change addr_to_drm_mm_node to return the panfrost_gem_object with an
extra reference on it, preventing the BO from being freed until after
the page fault has been handled.
Signed-off-by: Steven Price <steven.price@arm.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190913160310.50444-1-steven.price@arm.com
Diffstat (limited to 'drivers/gpu/drm/tilcdc/Makefile')
0 files changed, 0 insertions, 0 deletions