diff options
| author | Wentao Liang <vulab@iscas.ac.cn> | 2026-09-16 17:55:48 +0000 |
|---|---|---|
| committer | Rob Clark <robin.clark@oss.qualcomm.com> | 2026-09-27 08:18:22 -0700 |
| commit | 81878aa1a2f551f51a3d3aef2a9509503ec34d8b (patch) | |
| tree | 57072b2440c59b112bcac6ffb7ab92d4ca7195b2 /tools/lib/python | |
| parent | dbec5e6191bee37117382e4e7b7220167f1f3f18 (diff) | |
drm/msm: Fix vm_bo use-after-free in with_vm_locks()
The unwind loop drops the vm_bo reference taken while locking before
advancing to the next entry. drm_gpuvm_bo_put() may drop the last
reference, removing and freeing the vm_bo, after which the plain list
iterator dereferences freed memory to advance.
Use the safe iterator, which saves the next entry before the body runs.
Fixes: fe4952b5f27cca5d ("drm/msm: Convert vm locking")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Patchwork: https://patchwork.freedesktop.org/patch/754331/
Message-ID: <20260916175548.2089821-1-vulab@iscas.ac.cn>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions