[v2] drm/nouveau/uvmm: fix VM_BIND submit/unwind error-path bugs

[PATCH v2 0/3] drm/nouveau/uvmm: fix VM_BIND submit/unwind error-path bugs

Posted by Zhenhao Wan 1 month, 2 weeks ago

Three bugs on the nouveau VM_BIND submit/unwind/cleanup error path, all
introduced by the original VM_BIND uAPI (Fixes: b88baab82871) and all
reachable by an unprivileged render-node client:

  1/3 NULL deref when the unwind loop frees a never-populated
      OP_MAP_SPARSE op's ops list.
  2/3 premature free of a region on a failed OP_UNMAP_SPARSE, because
      op->reg is left set on the failure paths.
  3/3 a sparse region left permanently marked dirty after unwind,
      wedging later binds over that range.

Each fix is minimal and self-contained; all are Cc: stable.

Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
---
Changes in v2:
- Add an Assisted-by: trailer to each patch; no code changes.
- Link to v1: https://patch.msgid.link/20260811-nouveau-uvmm-vmbind-fixes-v1-0-40df1c046b49@gmail.com

---
Zhenhao Wan (3):
      drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
      drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
      drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE

 drivers/gpu/drm/nouveau/nouveau_uvmm.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
---
base-commit: ba3e43a9e601636f5edb54e259a74f96ca3b8fd8
change-id: 20260811-nouveau-uvmm-vmbind-fixes-c2dfab359df2

Best regards,
--  
Zhenhao Wan <whi4ed0g@gmail.com>

Re: [PATCH v2 0/3] drm/nouveau/uvmm: fix VM_BIND submit/unwind error-path bugs

Posted by Danilo Krummrich 3 weeks, 6 days ago

On Tue, 11 Aug 2026 16:46:27 +0800, Zhenhao Wan wrote:
> [PATCH v2 0/3] drm/nouveau/uvmm: fix VM_BIND submit/unwind error-path bugs

Applied, thanks!

  Branch: drm-misc-fixes
  Tree:   https://gitlab.freedesktop.org/drm/misc/kernel.git

[1/3] drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
      commit: 412a6ceb56d5
[2/3] drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
      commit: ccf930812f23
[3/3] drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
      commit: 38a62306c426

The patches will appear in the next linux-next integration (typically within 24
hours on weekdays).

The patches are queued up for Linus's tree and should land in the next -rc
release.

Re: [PATCH v2 0/3] drm/nouveau/uvmm: fix VM_BIND submit/unwind error-path bugs

Posted by lyude@redhat.com 1 month, 2 weeks ago

This patch series is:

Reviewed-by: Lyude Paul <lyude@redhat.com>

On Tue, 2026-08-11 at 16:46 +0800, Zhenhao Wan wrote:
> Three bugs on the nouveau VM_BIND submit/unwind/cleanup error path,
> all
> introduced by the original VM_BIND uAPI (Fixes: b88baab82871) and all
> reachable by an unprivileged render-node client:
> 
>   1/3 NULL deref when the unwind loop frees a never-populated
>       OP_MAP_SPARSE op's ops list.
>   2/3 premature free of a region on a failed OP_UNMAP_SPARSE, because
>       op->reg is left set on the failure paths.
>   3/3 a sparse region left permanently marked dirty after unwind,
>       wedging later binds over that range.
> 
> Each fix is minimal and self-contained; all are Cc: stable.
> 
> Signed-off-by: Zhenhao Wan <whi4ed0g@gmail.com>
> ---
> Changes in v2:
> - Add an Assisted-by: trailer to each patch; no code changes.
> - Link to v1:
> https://patch.msgid.link/20260811-nouveau-uvmm-vmbind-fixes-v1-0-40df1c046b49@gmail.com
> 
> ---
> Zhenhao Wan (3):
>       drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
>       drm/nouveau/uvmm: fix premature region free on failed
> OP_UNMAP_SPARSE
>       drm/nouveau/uvmm: clear the dirty flag when unwinding an
> OP_UNMAP_SPARSE
> 
>  drivers/gpu/drm/nouveau/nouveau_uvmm.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> ---
> base-commit: ba3e43a9e601636f5edb54e259a74f96ca3b8fd8
> change-id: 20260811-nouveau-uvmm-vmbind-fixes-c2dfab359df2
> 
> Best regards,
> --  
> Zhenhao Wan <whi4ed0g@gmail.com>