From nobody Tue Sep 29 07:41:47 2026 Received: from mail-pf1-f171.google.com (mail-pf1-f171.google.com [209.85.210.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8EC7C374A16 for ; Mon, 10 Aug 2026 20:38:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786394334; cv=none; b=k5DrE42v/gmeYCV8QLByXprlVfeOX13HJI908OrliiKIwyz6KxuI33K0UC6oo/9CqT0g4qTWoiUYWMU68Wc1O/46NjC2kNAa2NbiQWs1oazpKTEcBuPuxR737p4mDMB22yyXM/zA3EW797IChoWE4PduEkqdN/L+xiV3ICsjVAw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786394334; c=relaxed/simple; bh=+VNmEkXChlpNLC2AYrdH2/Brvmpt3yR/AE4J9z9THqs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=TzILK/rBPuyUOzDZCUAkG2Ydj1oxtnQe+Ko7f3aHfNcSke2C4URa0OE08TP9NBqCZ5cnNullLTmKKCTWBt/DeN3XUiySG6uE+HpwZi4k8f6dTgxj72PshDHpPwWEeHrmG/1c8DWWMrmcysT/QeOqTYYYiXOL6yvbIeSGaj2f3ec= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=XjWzjuwD; arc=none smtp.client-ip=209.85.210.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="XjWzjuwD" Received: by mail-pf1-f171.google.com with SMTP id d2e1a72fcca58-84a4d8fd6ecso2593361b3a.1 for ; Mon, 10 Aug 2026 13:38:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786394333; x=1786999133; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=vyASNIeLKFmcfAoI/F9+fyrmwfgxdyCWxlnFqPLO/WQ=; b=XjWzjuwDer5XSrHfRIRRJdOQlrbfJCxfTdywX1FVrDnoqM9wPtZTSMRJ8YG5LEUfKR Zr8YO+d/pv0NWK84OSiNNPh4Rdp190NqpTmZmSbRON/Qw7UBXfPqNLwbpclqxhDBKXy+ 7fmj8xq+YL5Hf8PvQniWLJ6WZ8NGmLUVXAjy9riqPvg676MsNB9s8G/j5TjITmIK7P1D GV56V39VKDRc1aoiXgO6Fiw+xBNPGdjXgXWEvcihScQBvR/fcYPV65X3MXDn95eS/tyt pqw7+guUmFZ71kwmaeeJlj+f5O/4xKCPahDRkxqo6YU/a5WQGWATE34ObGzkdDA/hB0H stDQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786394333; x=1786999133; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=vyASNIeLKFmcfAoI/F9+fyrmwfgxdyCWxlnFqPLO/WQ=; b=KN4Rh9ZOLZATi/G1DmvSp5u2H/n7zPSNW4m34znHC1XrEhaXTSgTngQf2pNtojEIYa gFQJHnZh2dUepvVdUFLiFEg04wm+ueMdOdbv9SRzyFK5VB0onzmUTeTCuFRN3GAMIXaZ cyaZR1i0zIiLDZ4bxdC2X+XIsuMjz3ev6KE+NqDnpa4VSGWseYOClRKcUkCzc/ZKXnVx N0R7VaRonwTwwm9fhIqgaz4FoXaX/3yHfm8aSdDQENYTEW0acPvgW4xf4+JKZpGgMKEB 4ky4CuBCI1lGm45oESFjWqaMPZukEn/KO/Wg1LVtVS2WMH/UOoHPGKfc3FgyhbzguFqE 5siA== X-Forwarded-Encrypted: i=1; AHgh+RpIDtmVexkul2TVgeCcBJxYCuh0YNg0Xct3cXk9er+inAt+QJ+Th82IjYM+7Pck+J6MXjpMr/WHdKxv91E=@vger.kernel.org X-Gm-Message-State: AOJu0YwtgBHkL68DNg/tOT3oKf76QCIExuLAAe2hLN/uJIOU/blVlyHV j1CHrrM8wgJHtHm5+tXjsu1G455QlK8vA98F4Gcv3lM2DTlFXZ2kwOi+ X-Gm-Gg: AR+sD13JqmAXR9Ch1bUk5vrVwxOx8yUmXeoJenU8qI8MqTFPNGMXjjMr391vrA2OjdG ug5PvuD+77ux0lO6G3X1b1Eo6HJyasvbZ5jl2zNtAQXSA5j18UC5YsMCC/setp7FDdSU9AydM4N /XW+lXAmojbP7gtRyI/OH46pxITl13BOJOKBy46fcLSbfeFduJXsiBySi9JtlSDejlQPSnvDXsF QzKBMlBfAsFMQK72OByOGZ2i42cFiBW3rofIQJquz2cw2IoLHbAo5TWJzxhMdEw3SqUBtjIZGYe XDOEaCjT3q1hjuKONkFT1BoawsY7orOT6Ck21rHX6wrpfklxK/B4CpXssy9+LTvyVVlUcVeNC1C RHubX232pCwkC/apZ+41nPZKCOIs1P8yThYT2Y0Xr4Iw5um+X7dkgGg7AINMPjHi+Uo1LTnwuqx JeWt/Ck2tf9RxHo88wYQAUjWw3E9TreVpIsqHMujEnOXoK5wmIylxIr15JCSHB X-Received: by 2002:a05:6a00:a16:b0:845:e9e8:645c with SMTP id d2e1a72fcca58-84f694201bemr23429295b3a.6.1786394332889; Mon, 10 Aug 2026 13:38:52 -0700 (PDT) Received: from LAPTOP-N3B6U5LC.localdomain ([117.147.100.52]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84f5a553071sm4324001b3a.43.2026.08.10.13.38.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 10 Aug 2026 13:38:52 -0700 (PDT) From: Zhenhao Wan Date: Tue, 11 Aug 2026 04:38:19 +0800 Subject: [PATCH 1/3] drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260811-nouveau-uvmm-vmbind-fixes-v1-1-40df1c046b49@gmail.com> References: <20260811-nouveau-uvmm-vmbind-fixes-v1-0-40df1c046b49@gmail.com> In-Reply-To: <20260811-nouveau-uvmm-vmbind-fixes-v1-0-40df1c046b49@gmail.com> To: Lyude Paul , Danilo Krummrich , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Dave Airlie Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Zhenhao Wan , Yuhao Jiang , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1786394315; l=1520; i=whi4ed0g@gmail.com; h=from:subject:message-id; bh=+VNmEkXChlpNLC2AYrdH2/Brvmpt3yR/AE4J9z9THqs=; b=2NVSFVBq7bbrQhlqYPoKCXTQi2womiUgrJtriPaq6KwXJpxK/aMIt6Q0SRgkjDUwQ4FsKnysG 32+jbbJ1TuXArtF2le4b7Uu4n1tGts8GEPg7Dc/xL8VuPg1ju8U6qyn X-Developer-Key: i=whi4ed0g@gmail.com; a=ed25519; pk=zRTKlstE0LmilshGwJsFYEVjiT6RiXMBXK8Og6VmuVQ= Each bind_job_op is zeroed by kzalloc_obj() in bind_job_op_from_uop(), and the OP_MAP_SPARSE case in nouveau_uvmm_bind_job_submit() only creates a region, so op->ops stays NULL for a successfully processed sparse map. If a later op in the same job fails, the reverse unwind loop revisits that op and calls drm_gpuva_ops_free(&uvmm->base, op->ops) unconditionally. drm_gpuva_ops_free() dereferences its argument right away (list_for_each_entry_safe on &ops->list), so a NULL op->ops oopses. The path is reachable by any render-node fd holder, since NOUVEAU_VM_BIND is DRM_RENDER_ALLOW. Guard the free with IS_ERR_OR_NULL(), as nouveau_uvmm_bind_job_cleanup() already does for the identical free. Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Zhenhao Wan --- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_uvmm.c b/drivers/gpu/drm/nouve= au/nouveau_uvmm.c index 36445915aa58..849bf42c124e 100644 --- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c +++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c @@ -1489,7 +1489,8 @@ nouveau_uvmm_bind_job_submit(struct nouveau_job *job, break; } =20 - drm_gpuva_ops_free(&uvmm->base, op->ops); + if (!IS_ERR_OR_NULL(op->ops)) + drm_gpuva_ops_free(&uvmm->base, op->ops); op->ops =3D NULL; op->reg =3D NULL; } --=20 2.34.1 From nobody Tue Sep 29 07:41:47 2026 Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com [209.85.215.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E578B442FA7 for ; Mon, 10 Aug 2026 20:39:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786394342; cv=none; b=Yi/3FJYByBt0qcbUCShJhmSM2BdXm+akOiBWq7o1Q0UrVBhNEOovw32IGmh3UBcjF/x15QwSveMiDAtu6aqWkr1RuVANOJr9FwMPgXkXCWapwTTXB55DKVPLxum340Mk8CuT7OQenchKpfaQxtRe+K6NQ2/+ZmNKmXYPus7hvbc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786394342; c=relaxed/simple; bh=Os1DpKb5DvVXnV4vccSHoH512pnwHk/C+aJ0z4dVEGA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ifs2Gp6hMN1HQDoB3oNBynMz8IPNhMNCOgkAyI8bHe3/STdG2hyA4TmH2rehRH/KSVCGLjEpb+OzBJTHaWCuDF7X2Zp8akPGCz8OXWgr1UUNRlkr02Rsq3ya5f1aRgnyzTPZUggfqcO6xQUXdJ53DEsc0YybHF/QEfzF2/h2ydI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=lMLqWyXi; arc=none smtp.client-ip=209.85.215.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="lMLqWyXi" Received: by mail-pg1-f170.google.com with SMTP id 41be03b00d2f7-ca957432c7fso2253804a12.1 for ; Mon, 10 Aug 2026 13:39:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786394340; x=1786999140; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=qGxAuLzZZuFS+OONE5xJE8lS88pl+UeA90EgJEUUW6g=; b=lMLqWyXi7/0bBp0Cfeli4PqiAOgcl4vmFc41upU6XAGFSMyJmgUO62UplOYmlwR/T0 u90oZMekcTtgC/8bVjgfUCBEBXmeXljZ5EcvodyyEweWUUmk71B9aFKGZIaaX8PqgV2d VjsKdQX/pc+04sAq2u97n31h7vyINuyjJBg7E0Z7Ov/ZuTJxSmBGOkQ2eBPR/fQZIF10 pnGCEQFz8aorLSRgSFt9AJHQyE9/YgBxvfR6ueBYs00D6dJjhHXK/1nQD2Mw54Z8byuw tZxDdh796y8IV4FMkseTI+qh0wdLdrZ59z8lyovqFZ+KdT5QaLHFPdcjQJQWMumOCkfJ WBfQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786394340; x=1786999140; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=qGxAuLzZZuFS+OONE5xJE8lS88pl+UeA90EgJEUUW6g=; b=qwiLAJFI+RrA0MLX+tvMvC0uDqjHaZeHtEeeQgx6d9l8PH76F3miNHOLFLd4+lpTKk 64tg6LgB8+L8lY/B9Nej7/QjqsexKk6rWXCMXcU5VG4F2eKC+aPT3bNpQcIGHOJP51RY Drlr7mzvq0Bjjs5XuupLYa1pO6LbyjhDlWRM4CPq9UelVZmo2Ri1XeypdhDuGyP8yYUa NCgiRDp0tjHTum8BV2Zj+YQ2F1/jUIKqNJ9pO2qc29do6ORNI5YAC+1crjgVhzKS/iTC +flZzI70uymEBlhGM0v3jizeFiqjp5G4HJyeRKbF6WAFqQ/oxYLuw5oe4LDFDEVmu0tg P9dg== X-Forwarded-Encrypted: i=1; AHgh+Rq2OnnmlatKPp7h1r4kCO3SMU9Krj4yX3Z/b1EyUvuRB6Kg3/UWNU0GIdDdYY2174yNBfNtlWleWUCXBtM=@vger.kernel.org X-Gm-Message-State: AOJu0YywHxSeOF/r0uHUphD3g6aTFk6fzLcCtpmS/4r890pH06SGzLql 21hp2Qy8RTl3CZNOrJxSLlAqMcyr77W6WMUkkPzqOiat+Vj+faoUIluH X-Gm-Gg: AR+sD12bjSE+IcqWFZdBAA+0TdQS18pcrSJ9nGc185XydeWCtxmUE3DFGJN5d6+mJwx G9NnvZFzdgKBpZFG1N3fZnJj1v58YKgvuzM36+/hfoW4E2oGFsfLcuUVaniIQZf5/MlLov7IuWh 0oL7C0Xck3GX56eASSzNzYzeaqvZ3Ld4YfTj+IWvdZL1vNlbqUXV9nM6z0bxegM8f1rOOiMcxoP mJKoN+3HAuCBKvBPGK7V1eSW2jIn5MDXJg5pMe2YHjIC/sqOwb2FZf44oJRyipBiR+bTNUYzX3b fs3BfP7B8uovSp8+G0MnED85iRKykKHFWniXQtYZVdJ/ZLJWI9YzWPuixptXV4X2Mk/yjDeqEhG 05oebkiUY7a01keNAdpHtULQJpfb8qwmdT/QC59FpEK6c9+sN8p25o+ovLDzW8DnjoJ5OZBqEOy /LOatdUrladt/wripuOfzABQ8Q6ausONpWtaBPbblm3ZP+FIP1hhbOqma6dgoG9qeRMbLVGw== X-Received: by 2002:a05:6a00:809:b0:84e:915:d7eb with SMTP id d2e1a72fcca58-84f9c9b2da1mr4339437b3a.37.1786394340150; Mon, 10 Aug 2026 13:39:00 -0700 (PDT) Received: from LAPTOP-N3B6U5LC.localdomain ([117.147.100.52]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84f5a553071sm4324001b3a.43.2026.08.10.13.38.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 10 Aug 2026 13:38:59 -0700 (PDT) From: Zhenhao Wan Date: Tue, 11 Aug 2026 04:38:20 +0800 Subject: [PATCH 2/3] drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260811-nouveau-uvmm-vmbind-fixes-v1-2-40df1c046b49@gmail.com> References: <20260811-nouveau-uvmm-vmbind-fixes-v1-0-40df1c046b49@gmail.com> In-Reply-To: <20260811-nouveau-uvmm-vmbind-fixes-v1-0-40df1c046b49@gmail.com> To: Lyude Paul , Danilo Krummrich , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Dave Airlie Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Zhenhao Wan , Yuhao Jiang , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1786394315; l=2150; i=whi4ed0g@gmail.com; h=from:subject:message-id; bh=Os1DpKb5DvVXnV4vccSHoH512pnwHk/C+aJ0z4dVEGA=; b=02MtHdx4r3dcWF4OJYpzk/u7l1R5qAALQu/9EvZjdicY+x1blHF50oc+amQtWtok05bowqco2 GB8XXhKK5NaCpHbdzLxx9r4Ic66enivHaHfyhRMZvNxhLhbx+KR24fL X-Developer-Key: i=whi4ed0g@gmail.com; a=ed25519; pk=zRTKlstE0LmilshGwJsFYEVjiT6RiXMBXK8Og6VmuVQ= In nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, op->reg is set from nouveau_uvma_region_find(), which only looks the region up and takes no reference; a region's sole reference is its membership in uvmm->region_mt. Two failure paths leave op->reg set: the -ENOENT check when the region is busy, and the drm_gpuvm_sm_unmap_ops_create() failure. The sibling nouveau_uvmm_sm_unmap_prepare() failure just below clears op->reg; these two do not. unwind_continue steps back one op, so the failing op is skipped by the unwind loop and its op->reg stays set. nouveau_uvmm_bind_job_cleanup() then enters its if (op->reg) branch and calls nouveau_uvma_region_remove() and nouveau_uvma_region_put() on it, dropping the tree's sole reference and freeing a region this job never created. The comment above the cleanup loop documents the broken invariant: op->reg must be NULL on submit failure. This frees a live region on an unrelated failure, reachable single-job when drm_gpuvm_sm_unmap_ops_create() returns -ENOMEM; if another job owns the same region, its cleanup then removes and puts the freed region, a use-after-free. Clear op->reg on both failure paths. Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Zhenhao Wan --- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/nouveau/nouveau_uvmm.c b/drivers/gpu/drm/nouve= au/nouveau_uvmm.c index 849bf42c124e..3412200b21fd 100644 --- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c +++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c @@ -1319,6 +1319,7 @@ nouveau_uvmm_bind_job_submit(struct nouveau_job *job, op->va.range); if (!op->reg || op->reg->dirty) { ret =3D -ENOENT; + op->reg =3D NULL; goto unwind_continue; } =20 @@ -1327,6 +1328,7 @@ nouveau_uvmm_bind_job_submit(struct nouveau_job *job, op->va.range); if (IS_ERR(op->ops)) { ret =3D PTR_ERR(op->ops); + op->reg =3D NULL; goto unwind_continue; } =20 --=20 2.34.1 From nobody Tue Sep 29 07:41:47 2026 Received: from mail-pf1-f175.google.com (mail-pf1-f175.google.com [209.85.210.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3DC5034D901 for ; Mon, 10 Aug 2026 20:39:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.175 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786394349; cv=none; b=cJ7DLqr2rhPbGwFtZqLtNSLUKFZJYTcvUIeySMXHpXPaytTcmTQeRbHU08Ytnph8AksLcf39DYt05QCgQ+eeaiFIxRhK6GdJLJLhWnxC8AC6JYywn7mNYPz542MzFKx69rjZPtuCatMsqsl7i2V2LFR1IWCz5SL2CCLb5ixErck= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786394349; c=relaxed/simple; bh=EkPEKXF+/UaDvmD1DSJT1a9iDr68rR/Sq93UlMmDacU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Yq7O51QD7S3iL2tri2+6CYBY3BLv6GqZ/s6XXz/FWmUp+DBRqHorAYZlBMSOc9NipCGegYj8OkpuvGdlwTH8Mo0km0x+hHiiTZuKZaa3+/q+pCSr9c4Du6mgtwkkSo8imAB0L8TGftrivFsT6WcCWyoxuDXOxuS7tcW13IDP8bs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=oUzCrlYJ; arc=none smtp.client-ip=209.85.210.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="oUzCrlYJ" Received: by mail-pf1-f175.google.com with SMTP id d2e1a72fcca58-84eb992a881so1735093b3a.2 for ; Mon, 10 Aug 2026 13:39:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786394347; x=1786999147; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=eYLBNqXF1zNAZBvL6Z7VZZKJwlYWKUq5oR45TMWjugk=; b=oUzCrlYJtOHTQ885ks3y9kYZicKST2Ilsg27nTZBMCtDUYUHCb1ZK/87sMvNeWxWi9 h9ikkM7rR5CbLpoD0ZrJ/SNSSFtnA5q8pokGYwIui4vYOrxuH3btBoD505RiAetFl96I aRcPYFKDqN5NtlitJROdRbWxiq7znbjsUc0yf8jwjvydtolZ/D5ZXtcuF6shIwKEAalG tgBLPjXjs1pgvXv9OKmm6Ikcf9PPpxRE4qMHGuP0q7D6n0DO2JovrrkFkqLBjrpiGvtu kXsqyYWP9ddgBtnBbPjrwFACveNfnhXXjMwrSv/RZZ/TrIaFB2wodPVP4/EDYA78Oz1L V4xA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786394347; x=1786999147; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=eYLBNqXF1zNAZBvL6Z7VZZKJwlYWKUq5oR45TMWjugk=; b=k1WzntZyPz3uyN+5m5BI2H1P+Lhy37HzmZdFRlSqSyF4B7sRO2iTp5VE3lDfshelp1 tirN4HjJ4lFtw6I4QNTUPgNN6MidnuyqZDQIjRW3fy9fxP8Y2/XktETvLWsk4Zml8fRt 64IVbr93KRZY/51yRY6Cfpy8rrPPycIJ3mNjyLrGiKibpdBT2nAvNzR8hhYQoFqzyQMo wNtKIFOuOsksPHqhJ+a4P5QdznKFwhROXPQyyaQs5vSHxvdveFQLjqOZmKWT4cQjFyJ2 bqOLUJDjpPZdcpkvesOSmMUX0K5Nfpf1/1hGxQCneG21IUyx65CcB0dOoeYt1WkjMWwM 4O3g== X-Forwarded-Encrypted: i=1; AHgh+RpthpgPeRdXZa05M+WkWlAyc2t2BDZa89pN7imhN8lMv1ZwnZ34d8zvIa1S1Yf3lkDaQ+rPl7qH3C8vZoU=@vger.kernel.org X-Gm-Message-State: AOJu0YwIyl5ZF3D0zKd1iCYtrOc3VlVMLZNGenEZQQky5tg1W1MV/sv1 aaIUIozfOtDbiBk+jOkMznN6JatoZICeyD+qgHswtDo7KRSkdVvaZ0I4 X-Gm-Gg: AR+sD11mFxKMZnFvJ9o8QifaTnr+kk7AGZtib1QW8lyRQfAiI52rcQptuQ+thRYQnCp 50VTx2quN0cCuY+hVYqfuzevf6Z/9sRMb/4ajAx8F6uhdZnyAjYj3RYqXLP/T41Hxx7+zm7oX6J 0S2VIj76Vedw9D7fOts98QwHaZDE22zwfEisIwvcWT7nqzsX2Aaz5l0jCYIam1brHjCN0Xbu/pN CUZMVREWimdPzIU9BhBF15zxJSBmY2J59kqAHkQ8j5+Cl45j6rzlbviyIGy/dmhtEGg8/13fN8B u0W2EM+cW1bVLrqfeUnOwsEam90TO1azrnQZ30ENyh7VhOvUVDPxunkZTcMuOwkdXqGRxUpIIJ7 We7pxs0A5Va6ZEWeyufEnglLYQT9LXJtThgJ8QxVl1SRpR7/JMa8266jmARPLxAlot0tSQdpRJA tbtl6RprB/3evAHXpmoN5LZ5OcRxAbnhVx4GvRIOS5ksbYUY9tkQ/pRSh9NPo= X-Received: by 2002:a05:6a00:399f:b0:848:42a7:1854 with SMTP id d2e1a72fcca58-84f4fee21bemr33610373b3a.39.1786394347422; Mon, 10 Aug 2026 13:39:07 -0700 (PDT) Received: from LAPTOP-N3B6U5LC.localdomain ([117.147.100.52]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84f5a553071sm4324001b3a.43.2026.08.10.13.39.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 10 Aug 2026 13:39:07 -0700 (PDT) From: Zhenhao Wan Date: Tue, 11 Aug 2026 04:38:21 +0800 Subject: [PATCH 3/3] drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260811-nouveau-uvmm-vmbind-fixes-v1-3-40df1c046b49@gmail.com> References: <20260811-nouveau-uvmm-vmbind-fixes-v1-0-40df1c046b49@gmail.com> In-Reply-To: <20260811-nouveau-uvmm-vmbind-fixes-v1-0-40df1c046b49@gmail.com> To: Lyude Paul , Danilo Krummrich , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Dave Airlie Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Zhenhao Wan , Yuhao Jiang , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1786394315; l=1588; i=whi4ed0g@gmail.com; h=from:subject:message-id; bh=EkPEKXF+/UaDvmD1DSJT1a9iDr68rR/Sq93UlMmDacU=; b=xvwCAsSALBfo+gvo3ZaHDs3yC6zp/pyKzQwwXyN0p3W5AseCOv1a26TdDXBFUuDwtF8D64GKY ptfwp0aTPmpDgfsO50bna4ltQAqDVyxcUVxtlWFJ9TQe4/CGG/JkW1W X-Developer-Key: i=whi4ed0g@gmail.com; a=ed25519; pk=zRTKlstE0LmilshGwJsFYEVjiT6RiXMBXK8Og6VmuVQ= A successful OP_UNMAP_SPARSE marks its region dirty with nouveau_uvma_region_dirty() and defers the teardown to nouveau_uvmm_bind_job_cleanup(); it does not remove the region from uvmm->region_mt. If a later op in the job fails, the unwind path never clears reg->dirty (set in one place, cleared nowhere) and sets op->reg =3D NULL, so cleanup skips the teardown. The region is left in the tree with dirty set and its completion never signalled. Later binds over that range then fail permanently -- -ENOENT or -EINVAL from the dirty checks, or an unkillable wait_for_completion() in bind_validate_region() -- for the lifetime of the uvmm. Clear reg->dirty when the unwind reverts the sparse unmap, restoring the region to the state it was found in. Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI") Reported-by: Yuhao Jiang Cc: stable@vger.kernel.org Signed-off-by: Zhenhao Wan --- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/nouveau/nouveau_uvmm.c b/drivers/gpu/drm/nouve= au/nouveau_uvmm.c index 3412200b21fd..76ab377f0e2c 100644 --- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c +++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c @@ -1475,6 +1475,7 @@ nouveau_uvmm_bind_job_submit(struct nouveau_job *job, op->va.range); break; case OP_UNMAP_SPARSE: + op->reg->dirty =3D false; __nouveau_uvma_region_insert(uvmm, op->reg); nouveau_uvmm_sm_unmap_prepare_unwind(uvmm, &op->new, op->ops); --=20 2.34.1