From nobody Mon Jun 15 07:32:44 2026 Received: from mail-wr1-f44.google.com (mail-wr1-f44.google.com [209.85.221.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 95FEF3A16A8 for ; Wed, 8 Apr 2026 22:02:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.44 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775685749; cv=none; b=QW3PUZf5+8lVXEQ5oh3zEGhtLZNkxwpMyCcKKAgqpTbTPd8qSnR+0LDHeK76MH8+kzAwQkSiV6NX4LrSTMtKFv1eH9yiZUUjMvSDiZ4Pndj3Gg4x1lDbWQfUajpxXRdYQ6DA4Ksk7kkEERrFgRMY13B9Z9tZqaBo5otezErTU8o= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775685749; c=relaxed/simple; bh=Gtz6Zy4ik0FSYrAiCP0ZXu3drHvjNZobldt2yVX6OYY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=jr19h+G7zStIJEzvq6JHN+gwcr5u0bhApN5saZLXk4Kl10U0rj4nQjur1cxnPspFR40c1hwicdeSVNPAm7wH+1AXG26GQyy5zp0lyiBuFCIXx3PwkWFxKQKpnEISa4C0mfnkRJKrURb3IILvrenQXA7bwJS9EG7tzKe2meLTHZw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IQoXs+mM; arc=none smtp.client-ip=209.85.221.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IQoXs+mM" Received: by mail-wr1-f44.google.com with SMTP id ffacd0b85a97d-43b8e8e7432so162705f8f.1 for ; Wed, 08 Apr 2026 15:02:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775685734; x=1776290534; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=Y/wNq1qmjQxiqNtpEVenaKUauEvpMKc+7XYTfNVpOOk=; b=IQoXs+mMVYfELAbVTtKUI1USpjotXFvStZ7MEWTUPYoShYj20h1839blUwywLj4f0D IG65P8cBWqz4QkIraU0P9wF77NQWSA0itVm4FoImZ8KsWaMBEbJjEttSGkIj/ZH/FMNi tcwTg2OTWia38iIqctQqxN7SEQUseYschvkjg85HRyCo/EgYpAyNOarzJCscOLxjeh99 zAwBSvwCf70AAOW6ZYHhHhofxp+Cwm6QzMo6wpzIBEBk54K84Tqfmn7nqtmQpzmnDG9J efB6oPgHXV3U5b7TwyIBmczZFLVszebgHab7f0GwGB0lwnCcmLu4W7AtxZttRJzoNGIO GwFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775685734; x=1776290534; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Y/wNq1qmjQxiqNtpEVenaKUauEvpMKc+7XYTfNVpOOk=; b=OamMCZjU5ESBY1NrEYUopji2eRxdaQsPIOQR5CouG+yfTw1gHA7hifzPuBdivHunG6 JZ0kWeoRqfE5QX2DmOTb7K2h4RSJdZvkNVueWytTUjYEE8aCP/rDMB+wx2Ac8kFqDEFM oQKZt0Hi4Q3nblE2EueYw52mRnrKJQFgpGcknlO/GipPgBnh18RmzRignuUTr0WlGu3A DG9kvfIgHKq2YPasU1gUnSbGovgL8G8WMy/YH8XeeeVy1cMUSj0KqvlUl5L3rUZuIJ6+ qII2Sb2UQrsYkoGOLWjD4M8wh2GThrfSGMXcD1Y49daXkkJ6Uz/piql/aehJJ347+iNq 051g== X-Forwarded-Encrypted: i=1; AJvYcCVADygkkiSlH5jEr2Vx+VBS8kow89Lpskfci0BqXRKS/EaaPP6pPYfC+DKwP4Zgs2QzTnWnK8lLOFCl60w=@vger.kernel.org X-Gm-Message-State: AOJu0YzqQJjbcAHubQRiXFU2p6FhSddq7hqXZsK0tlLapTgpMdg+EFJg 2IfZXOM2N+Duvxc1bJaiLUlA4u4sUozWjLE3vdqKZhr89v7PkQ1Y2PgAgJGAso5ZY+I= X-Gm-Gg: AeBDievEOamBWVaF9PxW5o0UM0twik1FruSc5Hj0w7q28999trl8GucdhypU9z3+VOM 27cdg+gNO9yy3rF2usduleCZbYAP5WkzghFmDWO7OLZCG9Kwlrgfz3qfejz7Jr8SWE8H9C1cWIQ ypiRY7AfcZg8BBgCrqsD3YwN8A/eQerw4a02BOnhyX6A6eLHKzBmAvq3fJPOCYSuhssQ0SQ0H07 WFPWYX80MgJnHxubdRImnuA3s093+6Q34CHEwL4pj6hpf+/zUtcLFA/v69OaiMZoaV31XNq2Ff4 cei/QQ23Pbs9fw7IdUUqc7B3MrjRAUOm5AOZ8z5+fzJ1aWcCBRcdtDLL5Bs1/AUS6hs4U3nQ0Of opnQ9SFYRHAwsf1YVgifhrtHFEhBjQ83tUJdqake3XibPb8A4E5/IBnLqXtgkUdjVMn1mDxvxw5 +lUeuRrhCn+GCZB6mHOp01ZIsHFvlm+ccKMIRJVLuqm0VAQIY= X-Received: by 2002:a05:6000:4201:b0:43b:3d80:b0b9 with SMTP id ffacd0b85a97d-43d29295ed7mr34849194f8f.12.1775685734366; Wed, 08 Apr 2026 15:02:14 -0700 (PDT) Received: from DESKTOP-K4142FH.localdomain ([197.146.147.164]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-43d1e4d282esm61373268f8f.18.2026.04.08.15.02.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 Apr 2026 15:02:13 -0700 (PDT) From: Yassine Mounir To: joonas.lahtinen@linux.intel.com Cc: ville.syrjala@linux.intel.com, torvalds@linuxfoundation.org, intel-gfx@lists.freedesktop.org, linux-kernel@vger.kernel.org, Yassine Mounir Subject: [PATCH v3] drm/i915/gem: Fix relocation race and simplify VMA lookup Date: Wed, 8 Apr 2026 23:01:45 +0100 Message-ID: <20260408220145.4428-1-sosohero200@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Pin the object lifetime in eb_relocate_vma() using i915_gem_object_get() and i915_gem_object_put() to prevent a Use-After-Free (UAF) if the handle is closed concurrently during relocation. Additionally, simplify eb_lookup_vma() by removing the redundant vma->vm =3D=3D vm check. As noted by Joonas, this check is unnecessary since commit d4433c7600f7. Removing it also avoids the "insane" logic of returning a VMA without a reference, satisfying the sanity requirements requested by Linus. Fixes: d4433c7600f7 ("drm/i915: Multi-vm support") Suggested-by: Ville Syrj=C3=A4l=C3=A4 Suggested-by: Joonas Lahtinen Signed-off-by: Yassine Mounir --- drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/d= rm/i915/gem/i915_gem_execbuffer.c index 942f4eed8..65ce54b20 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c @@ -896,7 +896,7 @@ static struct i915_vma *eb_lookup_vma(struct i915_execb= uffer *eb, u32 handle) =20 rcu_read_lock(); vma =3D radix_tree_lookup(&eb->gem_context->handles_vma, handle); - if (likely(vma && vma->vm =3D=3D vm)) + if (likely(vma)) vma =3D i915_vma_tryget(vma); else vma =3D NULL; --=20 2.51.0