From nobody Tue Sep 29 06:59:57 2026 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7E85A355F5F for ; Tue, 11 Aug 2026 08:47:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786438036; cv=none; b=HfDIWIYXy7P0z0ugHDPo7XFfq1oZLcPpJqBfyj/95aI4cRkTlFFUaQjVGs/nw3OrGJmeLBt9gRMMFllWP8n/4kZAnkc5HQUCDlM7zOIdRLd3UJlgsD5yn7zZJcIz8yPXyGpYY7jNczq8/Lb//li0zg/A7pftczb79t8s8LLtGis= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786438036; c=relaxed/simple; bh=aTMGC8jjrMAmwoT5PX4XMFYEw8rXZ5oYEJn7jPDkksQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=M9qVSGq9yVLMVI97MHTxVgkLjEP0I66EZVyOja7LcUqBSEmw1RnEYOcCJ8RIPNerDfyB07L53JyFHNc1ZwCf0mDRwahllnOPP6ZUBdh3mw3prjRg2AOTM1cbhoQPpa5ewZfLmIbKQOg5FsBraXvAZaQbtAP5Z9w+lp5KPeA07zI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=kJ48Y5Ze; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="kJ48Y5Ze" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-38e347638adso3147714a91.0 for ; Tue, 11 Aug 2026 01:47:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786438035; x=1787042835; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=KkN28cbnuxaTZnJUJR8D84k2R0Wy2RMXuquI0epiuqE=; b=kJ48Y5ZeKLxE/Xg+Uj5krTq+eLkh0rkhwoeAjOZLrBanIQHUVYuPKAZ1ec7Msua+wE wA4wqLT69QZN93SyVRfb8lQTB8A9G+Rr06f+jlm0LoL0Nr+NaIqr+5HW06u2rn/ovcqT yyhbvouby5A2TYfhOTHvtUXMpE/HYdgBEhwArA9JjM7r/kyJTB9U4keyJ8mcwA8D2AAz mfuxGsBEzCCf4iZe5O+2PQ/3PfMAFxRcYgiHnlPUohJUOO572G6JyVYGb+qXsfVyGMmx b1keMQHUpKVHh7j+sfNym22evJZcNuyKCBPXaTh4zlM8NnbDcH/hLGweTcwVxUZBLMrg EOAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786438035; x=1787042835; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=KkN28cbnuxaTZnJUJR8D84k2R0Wy2RMXuquI0epiuqE=; b=RdTdx2AH+ARkb6qD+CRKMmZ1K/Jbio08NqJIvSTk62hY5FpLqpTBLzyI6LU1JtzYec 0QpU/OkPOM8Wx7/w/2Vv2sR4vHwdCX6hvLn+9Fl9bppglDhCVk5kZcZjlC/WBeFj62XU cWsp+p8fQpO5esgRE3GK9w4k4Q6LobVs26j1KQyYApPg2beIuut0LBgg3Ro0kBGo6/y+ C2I+chZyEa8CeaLMux6lWVg93yJZcp156ijw92DcORZucFQbA8u15ackbZlbStfSM53c 2kvPa7BMPITfoQRkZS92L3ANfUwC8rAQLpYf1nOXVoTerAqRFEMbr+CpzlNwZvJf+EQo +Trw== X-Forwarded-Encrypted: i=1; AHgh+Rq4hvwovQQsZo2WdMLratb+VxPwGJVrhY1D5yveUNF57qocbm3+2Pjcfgj0VxlQ8CB7dH65xUF/iXUNgw0=@vger.kernel.org X-Gm-Message-State: AOJu0Yz4dcS+tNYfG3SyDXxOJ6ZYnvRaIRfFPjCbv1JO+dXejISuPEnM kbDYAhEWbF6DNI/0FIJ+dm7KtPH7kyo3ZleYlWB7hiVVmtsGRrPYHL+9 X-Gm-Gg: AR+sD108Aj3gKTIeYoa2yIvE4p1UOYV2++/ULk0JGRzKQjAh8s3B5DjpV4mWKFO/Ftf /PR2hCasvqcCdWXkWMCB6Mk7ggxMrgNB77HqkXFiPJ3SGBXjYYmBPVmnAFAAHjtJw8cfTBO3gnP OjfBAOJ1GqpgKH2NRAg8KjsBRqT0Xe6JF6xFgzjeiHP+pXbnfOvdXG7RIgfmR90OFzfJnV4Y6iH K5NEtINkZ1OOLkgT0l7wMDuI0kmbcga0CHB1bWiP0xhyw0QQu4ErdSVHL+Buk67kmzuP8HwuM9d jFPMLuzpTKMpT/UYydK+9vSNbGO1jVp1xJAJICTiwi7SBp/MBEe72qm5FO4+qFYP35lor3MOfxo NWnwJsqzvPLfgtSUji2AA/Kc+aLkNa9c/6oA89ZD8wH8LZWrE0sl527U78evQV7DvQEQ33eZIqv X/L64AQytKJUq7pDMTE+OB574a+SOJsenN9cjEKvr4I8X8YM51gvaqPVPBkZivsrHMe2pmfQ== X-Received: by 2002:a17:90b:4c85:b0:381:c500:b0d1 with SMTP id 98e67ed59e1d1-392ec721e34mr1597056a91.20.1786438034735; Tue, 11 Aug 2026 01:47:14 -0700 (PDT) Received: from LAPTOP-N3B6U5LC.localdomain ([117.147.100.52]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-392e58a94aasm633058a91.4.2026.08.11.01.46.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Aug 2026 01:47:14 -0700 (PDT) From: Zhenhao Wan Date: Tue, 11 Aug 2026 16:46:28 +0800 Subject: [PATCH v2 1/3] drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260811-nouveau-uvmm-vmbind-fixes-v2-1-aaee4b395d04@gmail.com> References: <20260811-nouveau-uvmm-vmbind-fixes-v2-0-aaee4b395d04@gmail.com> In-Reply-To: <20260811-nouveau-uvmm-vmbind-fixes-v2-0-aaee4b395d04@gmail.com> To: Lyude Paul , Danilo Krummrich , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Dave Airlie Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Zhenhao Wan , Yuhao Jiang , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1786438000; l=1555; i=whi4ed0g@gmail.com; h=from:subject:message-id; bh=aTMGC8jjrMAmwoT5PX4XMFYEw8rXZ5oYEJn7jPDkksQ=; b=09+Yjqqdood4dmBPaNI3zbuyE6yGr25iSeGlJ5xSWwhUElspOvJ/vCMx+lzUAZY2pEewE1dB5 vJ9nHlmaFQyCawnfpg4WkYn3EBEqRGtDwKFngsk5epJfxu5IZAgYp4B X-Developer-Key: i=whi4ed0g@gmail.com; a=ed25519; pk=zRTKlstE0LmilshGwJsFYEVjiT6RiXMBXK8Og6VmuVQ= Each bind_job_op is zeroed by kzalloc_obj() in bind_job_op_from_uop(), and the OP_MAP_SPARSE case in nouveau_uvmm_bind_job_submit() only creates a region, so op->ops stays NULL for a successfully processed sparse map. If a later op in the same job fails, the reverse unwind loop revisits that op and calls drm_gpuva_ops_free(&uvmm->base, op->ops) unconditionally. drm_gpuva_ops_free() dereferences its argument right away (list_for_each_entry_safe on &ops->list), so a NULL op->ops oopses. The path is reachable by any render-node fd holder, since NOUVEAU_VM_BIND is DRM_RENDER_ALLOW. Guard the free with IS_ERR_OR_NULL(), as nouveau_uvmm_bind_job_cleanup() already does for the identical free. Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI") Reported-by: Yuhao Jiang Assisted-by: Claude:claude-opus-5 Cc: stable@vger.kernel.org Signed-off-by: Zhenhao Wan Reviewed-by: Lyude Paul --- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_uvmm.c b/drivers/gpu/drm/nouve= au/nouveau_uvmm.c index 36445915aa58..849bf42c124e 100644 --- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c +++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c @@ -1489,7 +1489,8 @@ nouveau_uvmm_bind_job_submit(struct nouveau_job *job, break; } =20 - drm_gpuva_ops_free(&uvmm->base, op->ops); + if (!IS_ERR_OR_NULL(op->ops)) + drm_gpuva_ops_free(&uvmm->base, op->ops); op->ops =3D NULL; op->reg =3D NULL; } --=20 2.34.1 From nobody Tue Sep 29 06:59:57 2026 Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D23AB421236 for ; Tue, 11 Aug 2026 08:47:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.43 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786438040; cv=none; b=CU9E+OHMY5heD2MPcKESQXsdZwaaAaeYb1LtL/yB7Lk00LKcS+zne0NkMcBFLNafcuLrw8/6VLM2EU7WpKIgx5FXmZQYWpAMdr63u4vnmK+I7PJxLPzqa5e+LDgZvbR6U9OR2KxWG8mx5TXqxXL1ib8kQbl3MLe/kx0i1+JEKFU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786438040; c=relaxed/simple; bh=fKwS8hLuASUBBkfhmQft0t9owMYTP3CSXRQ1mDs9JW0=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Y9kzlvohlfEnfvaRI/GINVfsD9d0sbMl24AxSb6TAm68NKqpoRtjo8Q3j4sVENRLJCXtX/BQTP/j1pomNWeB8M81GdF4kzNuk5TyeSbOGrrZjKzjp0fJhP33a8eydec7XhQmZZ65sXIbZwFAOLAOtnlQgJCcNiedPHQcb5qq1rs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=M0xluFKs; arc=none smtp.client-ip=209.85.216.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="M0xluFKs" Received: by mail-pj1-f43.google.com with SMTP id 98e67ed59e1d1-3900e39d935so2812070a91.0 for ; Tue, 11 Aug 2026 01:47:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786438038; x=1787042838; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ly/Mo1nbCV/oSok4ztJy2PbfdvW3bZVZXW3Etcdsh1I=; b=M0xluFKsxP2h9vvHw2eUj7aVjO89T6gdwlX2rX9oEbBye0KrrO5/NMXK7b9a39AQeI /vfwqnTNcys2Hl+/kxUY+z83JR+CHnTynee+v9BfEJoh1KOs2deQogo2GaNrQXU5FL1A sR30CjIQU1HzNlXXnMIgCHcZWINhvrArab3VWH6kyM9QQ3lcGLLoCtKRgJPSJ08mLXsX G6lh4yC2wvapyYo4rMTfvT3nCq8PT2003YhdJCcoSYWK0z3P7PJMfxhcNLx+nF3oTX3A fBRHxSH+iu3pNHLXBQiMQkcq2385kV4rit0U6B6V4vIlvG4tnIR/8OCjbJq1KNyxE+YP ekFA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786438038; x=1787042838; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=ly/Mo1nbCV/oSok4ztJy2PbfdvW3bZVZXW3Etcdsh1I=; b=On+EB+LJPTWZKWzByze+XJk8/koSSrYwovOQ8oRwkMB/yLNtcKUprvf3a549C17Cxf sCxqkhjKcPrllBVvQoYN9Pl+ZhAoCECBsE7SKHyA8uPE/y0K9qbp5hQ126gzvlj4AXF4 ELOmRVzOOHQvE/8WlokhaIeOn1riApFWobWixgMvzKD1AsRJ7h1Zh2b4qdpMK5rdhLUR +FyNUJQ3kKpsqSPJuP7r0jRzboYAiTnHWp+mUcbe5qVjB6FIT/CoVKcHtCE78L67klch dkiLs+uOZ6WaKmYMEvgWujdOk3IAVzLH0Rv4trVM+bZHbciGRkJLA9xa5RLm0TjzzIB7 ZNUA== X-Forwarded-Encrypted: i=1; AHgh+RooqxA2mZp06kYhv9a0ViIRvElP+bNVY3GecDxUjuZIu1kJPtr7Fcjce6WlYqgmoElriTd+z9qZThKTrAk=@vger.kernel.org X-Gm-Message-State: AOJu0YzzdC0vz1F0y8iaRufrBH5a2UGva5ZKNlnjrI8RvCX8DP9vO0Mf m6+V6hAVIScTZdoZd7mnJwVITOzqorYtBFcL2HFRGHKePype4XoSPjae X-Gm-Gg: AR+sD11q+DtXlSWNoF8i59jBFG4+oJGf8uBrJ8IfgcQZHGe12umU9t/JovEvSmcar3u H6iRrNA+Uz6Rp1SVzina5/bwzvkda5vJF4e75FqKBRBfEz+L1SNZ//CBm/kziayDmz7kZhvGLuF Yp/kRRyEr11WjhXKq9GxZteXHK7a30LWOWvGGhAAhfn3479KmwPYCMFZTMsZRyrCVr8K8P0SQ7i WtWwKq+e7wWQsVTFb6/PRImSYifHCPqw/jO6Bgo5TpscsGN5QZfNCEP0fxhv5SPnd/zplW0MJpX wYb3dtVPBsEnkAXz1jW/r/a1tfTqDaLY/m0IJj/EnNR9A1az/vdX+9B3YB5xhVLg26E2kp+MSEF REGCIlQOxwo6f79eKv9QhaOsYfZbd5r2vTWqgmqTq5JOCoU8cbrsaxftZKzoCTRvJBLbWqLc1sb d9bnCwpinpN8JRBOaTdnr31o5KTYOMGr5S1DCCr7L/T9N+undjgFohmIawhZE= X-Received: by 2002:a17:90a:ec90:b0:38e:2860:253f with SMTP id 98e67ed59e1d1-392ec53e6c1mr1809410a91.12.1786438038162; Tue, 11 Aug 2026 01:47:18 -0700 (PDT) Received: from LAPTOP-N3B6U5LC.localdomain ([117.147.100.52]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-392e58a94aasm633058a91.4.2026.08.11.01.47.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Aug 2026 01:47:17 -0700 (PDT) From: Zhenhao Wan Date: Tue, 11 Aug 2026 16:46:29 +0800 Subject: [PATCH v2 2/3] drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260811-nouveau-uvmm-vmbind-fixes-v2-2-aaee4b395d04@gmail.com> References: <20260811-nouveau-uvmm-vmbind-fixes-v2-0-aaee4b395d04@gmail.com> In-Reply-To: <20260811-nouveau-uvmm-vmbind-fixes-v2-0-aaee4b395d04@gmail.com> To: Lyude Paul , Danilo Krummrich , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Dave Airlie Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Zhenhao Wan , Yuhao Jiang , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1786438000; l=2185; i=whi4ed0g@gmail.com; h=from:subject:message-id; bh=fKwS8hLuASUBBkfhmQft0t9owMYTP3CSXRQ1mDs9JW0=; b=yrXi/GfTrG95r3RXD9fwP33siW9x0kLUCR1OkBk7w2hfnn9/lRMc+wLYmEKPbf+pCazGFbf1e HvXu2K4qPhFBTyDVzpUhsUqHjP6hqOL8DT8dLd6LvcoE6Kq50n4Egw2 X-Developer-Key: i=whi4ed0g@gmail.com; a=ed25519; pk=zRTKlstE0LmilshGwJsFYEVjiT6RiXMBXK8Og6VmuVQ= In nouveau_uvmm_bind_job_submit()'s OP_UNMAP_SPARSE arm, op->reg is set from nouveau_uvma_region_find(), which only looks the region up and takes no reference; a region's sole reference is its membership in uvmm->region_mt. Two failure paths leave op->reg set: the -ENOENT check when the region is busy, and the drm_gpuvm_sm_unmap_ops_create() failure. The sibling nouveau_uvmm_sm_unmap_prepare() failure just below clears op->reg; these two do not. unwind_continue steps back one op, so the failing op is skipped by the unwind loop and its op->reg stays set. nouveau_uvmm_bind_job_cleanup() then enters its if (op->reg) branch and calls nouveau_uvma_region_remove() and nouveau_uvma_region_put() on it, dropping the tree's sole reference and freeing a region this job never created. The comment above the cleanup loop documents the broken invariant: op->reg must be NULL on submit failure. This frees a live region on an unrelated failure, reachable single-job when drm_gpuvm_sm_unmap_ops_create() returns -ENOMEM; if another job owns the same region, its cleanup then removes and puts the freed region, a use-after-free. Clear op->reg on both failure paths. Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI") Reported-by: Yuhao Jiang Assisted-by: Claude:claude-opus-5 Cc: stable@vger.kernel.org Signed-off-by: Zhenhao Wan Reviewed-by: Lyude Paul --- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/nouveau/nouveau_uvmm.c b/drivers/gpu/drm/nouve= au/nouveau_uvmm.c index 849bf42c124e..3412200b21fd 100644 --- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c +++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c @@ -1319,6 +1319,7 @@ nouveau_uvmm_bind_job_submit(struct nouveau_job *job, op->va.range); if (!op->reg || op->reg->dirty) { ret =3D -ENOENT; + op->reg =3D NULL; goto unwind_continue; } =20 @@ -1327,6 +1328,7 @@ nouveau_uvmm_bind_job_submit(struct nouveau_job *job, op->va.range); if (IS_ERR(op->ops)) { ret =3D PTR_ERR(op->ops); + op->reg =3D NULL; goto unwind_continue; } =20 --=20 2.34.1 From nobody Tue Sep 29 06:59:57 2026 Received: from mail-pl1-f170.google.com (mail-pl1-f170.google.com [209.85.214.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2895E4229D9 for ; Tue, 11 Aug 2026 08:47:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786438043; cv=none; b=H7glIKycDtCnIsajt3U3mu3bCq2ilUvsL0+NAFTOGd5mZRymTK/5o2uqhHfuDnwxTLgkxOtygS9H2la92vK2MrsSugrGaslSivLptQCtfl55Qf678JHy9pROmK4rD3C5TKL8ndhjjGQ56wvNZTlcgiZ/WeDcb2O7tghlH+Djuo4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786438043; c=relaxed/simple; bh=lIptHHN9gxorlm/NvGtJXIbFnkM/mVFweQW+foQRg4s=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=e5ddgNlQRU1ipfavV7J6XEBkY3Tz7X1Rta2+hK+TrhxzYTf8N8Lsr2HMK2QFr109a6N5h736D5QDXeyOYGgDFMgYGjwJD7j6EhYFIYBHl45JkjgFh4DtTjC/a4YADOS4OABWg80/e8Cfp0580LBYJoDzDeqJ2Q3rZEV454590EU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SRsqQS5W; arc=none smtp.client-ip=209.85.214.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SRsqQS5W" Received: by mail-pl1-f170.google.com with SMTP id d9443c01a7336-2cf27856f9cso33307785ad.2 for ; Tue, 11 Aug 2026 01:47:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786438041; x=1787042841; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=FHAeoyo5cMJf1W0mZYzZjfd/SrG8usIZS6fsxweLRlk=; b=SRsqQS5WCI8mVw51RuYcG8PtAm2hM96fg6OO998ADmOq6kad5xDWf4vAjZylX/5Fqn W3qc1KHizeXOJI7H5KRktGYVvTSTgjdBGXIi7K5REMhCXQKthUyaMrRq37f1xtIqm5Eu uodNBVU074Vmmuo9Z5ZS2DljfpkeL8427C/K0cQ1wkIwO3N8GhuAfE05wQBUxM/E1tgm OznC3YLD3MBKOyclCwFLlYNaZaOscvhqsBketHLMN2ZbrqQHXdpmdYXvgjyzZMKD/njf H0VbNu/NKmrXwz/mvGNur57iB40lacDxrjQowM/a1oaJxOAgFqx283LFovnWiUSqiAUC bgQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786438041; x=1787042841; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=FHAeoyo5cMJf1W0mZYzZjfd/SrG8usIZS6fsxweLRlk=; b=S//syYwbJs3lyAWuiTJYQepk/YEurjrexjYOuPeNz/XDxfarZdVeUBZIagPepi7hed Y9h0B1th64wLyDpgwOAwRi+9kLRMho5Xqo+BX1Wn9UQJrXuGw8y5bTSxCokU6NiZKeSH Wo8j3SBWo6YLwbQn8dBD0DRF9f1I9uQoHOtQlrZJ+RcJzLGFpJ6cf3w+aNmUk2F+VjxV zTfWBI/EJPT3x/kgHfoO630wbvZnEX+DchZL/tG95zzJYU9o9V/WrXVnQDyBuAlHZXj8 6+ADzDEt6Wp02cpy5Gfe+OYiu5aXQG61tLZHbAvGI80kKlavQ5b0vYPF2I1gn2LNoGgH uEeg== X-Forwarded-Encrypted: i=1; AHgh+RopLU+FXxcNdwioxn2pBdzajNXRjhCj5mHWvNX0Fda91I7SH1qjL8NxynghwXYl0/gmQzs0mlra4FwY++g=@vger.kernel.org X-Gm-Message-State: AOJu0YyEmN9jqty0FkhOctn0EpHMum5lYain+bKR4n/zUOh0v1up/f9N T6yXXJx2gmXjgbOSeKfOBfOce42YSV4Ql2+J/L3LwQcoO9YuOH0uXCeE X-Gm-Gg: AR+sD10b/Bb+p2n1tffr/bQCBa78BcgtmVn3GCr5a73FVpp1JaoBnQKM2BuatVDZyki 4AWm9r8S0tQdOwFhFG2uOJQAnHzKgaCRp4rBX8C3eF8R0lptCKBu8VmMqJ3kXIsrLgdTu43TX21 UQ5ITlWFRsvhh+7eDg3BLFEfiu1BQNWK2rrpTTYos37KEdicbYxXiEoY82ayhQ7IEkGjBBjIo/N pQ4CCc0rBg3l7LNoRRG2tBkqwdat7wOS81mkR8Z/0uxNCOIY6lNVQFaRu4P+EVMsyS/7E/bZZcM Kh5NpSWHPPNPC/MQaauJnAJS7tOFkECjdQPNLHax+ValD6+g8KKasl78EDYpTxiA8gW5v9w7lNB L1qB41Dt/AMuJK5W0yZEj9C1G7M9N0+UXx3Grrmr9xrWpuuBgFMazeG+dYuTnfd0ZFSGmUqmj/X pFchfMi2QiJaeu1UXW7D+54At3gShbi731UFA9lTLAfGGA15bGb5vUzyFYfyM= X-Received: by 2002:a17:90b:5483:b0:36d:9e0b:3801 with SMTP id 98e67ed59e1d1-392ec4cf8e2mr1886740a91.8.1786438041538; Tue, 11 Aug 2026 01:47:21 -0700 (PDT) Received: from LAPTOP-N3B6U5LC.localdomain ([117.147.100.52]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-392e58a94aasm633058a91.4.2026.08.11.01.47.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Aug 2026 01:47:21 -0700 (PDT) From: Zhenhao Wan Date: Tue, 11 Aug 2026 16:46:30 +0800 Subject: [PATCH v2 3/3] drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260811-nouveau-uvmm-vmbind-fixes-v2-3-aaee4b395d04@gmail.com> References: <20260811-nouveau-uvmm-vmbind-fixes-v2-0-aaee4b395d04@gmail.com> In-Reply-To: <20260811-nouveau-uvmm-vmbind-fixes-v2-0-aaee4b395d04@gmail.com> To: Lyude Paul , Danilo Krummrich , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Dave Airlie Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Zhenhao Wan , Yuhao Jiang , stable@vger.kernel.org X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1786438000; l=1623; i=whi4ed0g@gmail.com; h=from:subject:message-id; bh=lIptHHN9gxorlm/NvGtJXIbFnkM/mVFweQW+foQRg4s=; b=BbY3eudDUU3rCJhubXR1NqITi9+XwlsZJYkYbjnHMrEnfLQTsJ3piqBsNjdoamVkGcHZ/Oh66 8ZouVLyJEukCAvYeXRa06MN6LzT6WFM2hlbqZHknRlcvNwKCxLz3JDA X-Developer-Key: i=whi4ed0g@gmail.com; a=ed25519; pk=zRTKlstE0LmilshGwJsFYEVjiT6RiXMBXK8Og6VmuVQ= A successful OP_UNMAP_SPARSE marks its region dirty with nouveau_uvma_region_dirty() and defers the teardown to nouveau_uvmm_bind_job_cleanup(); it does not remove the region from uvmm->region_mt. If a later op in the job fails, the unwind path never clears reg->dirty (set in one place, cleared nowhere) and sets op->reg =3D NULL, so cleanup skips the teardown. The region is left in the tree with dirty set and its completion never signalled. Later binds over that range then fail permanently -- -ENOENT or -EINVAL from the dirty checks, or an unkillable wait_for_completion() in bind_validate_region() -- for the lifetime of the uvmm. Clear reg->dirty when the unwind reverts the sparse unmap, restoring the region to the state it was found in. Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI") Reported-by: Yuhao Jiang Assisted-by: Claude:claude-opus-5 Cc: stable@vger.kernel.org Signed-off-by: Zhenhao Wan Reviewed-by: Lyude Paul --- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/nouveau/nouveau_uvmm.c b/drivers/gpu/drm/nouve= au/nouveau_uvmm.c index 3412200b21fd..76ab377f0e2c 100644 --- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c +++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c @@ -1475,6 +1475,7 @@ nouveau_uvmm_bind_job_submit(struct nouveau_job *job, op->va.range); break; case OP_UNMAP_SPARSE: + op->reg->dirty =3D false; __nouveau_uvma_region_insert(uvmm, op->reg); nouveau_uvmm_sm_unmap_prepare_unwind(uvmm, &op->new, op->ops); --=20 2.34.1