mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-24 00:10:10 +07:00
65e51e30d8
When handling a GPU page fault addr_to_drm_mm_node() is used to translate the GPU address to a buffer object. However it is possible for the buffer object to be freed after the function has returned resulting in a use-after-free of the BO. Change addr_to_drm_mm_node to return the panfrost_gem_object with an extra reference on it, preventing the BO from being freed until after the page fault has been handled. Signed-off-by: Steven Price <steven.price@arm.com> Signed-off-by: Rob Herring <robh@kernel.org> Link: https://patchwork.freedesktop.org/patch/msgid/20190913160310.50444-1-steven.price@arm.com |
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| panfrost_devfreq.c | ||
| panfrost_devfreq.h | ||
| panfrost_device.c | ||
| panfrost_device.h | ||
| panfrost_drv.c | ||
| panfrost_features.h | ||
| panfrost_gem_shrinker.c | ||
| panfrost_gem.c | ||
| panfrost_gem.h | ||
| panfrost_gpu.c | ||
| panfrost_gpu.h | ||
| panfrost_issues.h | ||
| panfrost_job.c | ||
| panfrost_job.h | ||
| panfrost_mmu.c | ||
| panfrost_mmu.h | ||
| panfrost_perfcnt.c | ||
| panfrost_perfcnt.h | ||
| panfrost_regs.h | ||
| TODO | ||