From nobody Tue Sep 29 02:04:03 2026 Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7D9822EEE88 for ; Thu, 13 Aug 2026 10:26:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786616780; cv=none; b=cGDLb2KHw2m6lDZgN4LTDJhM/K1ZooEB05f6cXZTHp6yF8IbeeLfxgDDIMRfnsxTRq1DNt/+ANvmcFW6n+XRGOz9+Yj/RygJ0AFYh8q/c9Zjjb9pY+IfCLAWDGXkn6algxgRR87pqe1CMmhimS4+GHISYraFF8r3Jtav7pBBmvs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786616780; c=relaxed/simple; bh=yrf9imgPzO8wlFHThXUTZ35rA60+QDuQrt+uQxh0u+M=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=QzRbbjGOQOxv9f4PTeJjGwpxU4of2Twp2RLdkAPEFYvFc1T+3aDmEx6elIURogz2Isyjqt68Ek1z3eXkQ7BeDI9Q6uuHWxv/9m22HvZGNcd7MRxftLybcro+NQwtQ+Ia2ZKO7J669pa+DAgtKigP73zYRy0wicTYf9a8mJ95pMo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dFgAJw2u; arc=none smtp.client-ip=209.85.214.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dFgAJw2u" Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-2ccf2360620so20447735ad.3 for ; Thu, 13 Aug 2026 03:26:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786616779; x=1787221579; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=CheetA0FCd2QHli7re2NKbzT3knYEe7Te2BK6UHPkW8=; b=dFgAJw2u8L17wAZiY7UwFxiu+qbdz2wQ7V5ypB4rknik7lBWrIdUEZd/FipNmh6ABa fY45say1wGw1dVrluyHatVthNxuJRnId32TyEsqZwSU6duNH/AmP/iuhPKMKqGeRmKIT zc1XguCInPy9GuEdb3DpFF7pH2lUOxJjtn8K+uOdyUr0VLAgVpA3415iPNtOSnPKhiTw H824ri1spbPv56Hj/jw3iisTDSryFdzhrJkk5QfKCyDPBoijMVkTiK/BXD583uoeRsFE FAT0dlK2LVnk6otDRQQrxrYHrpqu8iYthicPdBvGTRgm0sq8eroE+sWblTwpsRHQ61Y7 54+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786616779; x=1787221579; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=CheetA0FCd2QHli7re2NKbzT3knYEe7Te2BK6UHPkW8=; b=HUnF85w4Cnb3vqRW1+Y9e/tEZrpAgreBHrBMekeU+T8IovV2Lqxmox1JavsXSBoqWh lO3CFAB0WHjfaDBKjJO3IcaDscO+i1W1BPMrh2kOWKil8F7ZwveYGZ3uX2pjcEYYRmqj 16Rsde6cqyTUcA2XesjVKHlYpqXEr+oqiU+LJParHgpErjNAGv4lUmO1BniFxdtXvXnr +SojyAZ/QnB5vmqPhAi0bd1TODqHlHcHcyTt0VdrxKh9yofc18DZCvpOG9tPgVCdDABy 7+gCliDX1QtH0o07umAW1benpxHdY6Dy2QCO8H4HMjEKzmZrOyFIeARRScCgSaDYAmy3 whVQ== X-Forwarded-Encrypted: i=1; AHgh+Rrg+woNT7+u0WewHk+xkYbr0ugc8R42xkEcvZdPb7TUhDxE41jX1zGywcpUc1afESq8LNCQPWxsX9TRmE0=@vger.kernel.org X-Gm-Message-State: AOJu0Yw5Erccw3LebcOVcJB7/t9QWgR2v2hWmkeBeFDCcC9NzUAzR2DF aIl/6lePaIDtG8Jg3GDOemzqlF1MFEOw7zNbEHrYUNgxiVcZcJO4NOLa X-Gm-Gg: AR+sD124qXTXvFp3TkBeNJ6U9sVU8CvJMp9osEHs2e/efASqxJ8Wbvw4RVWWLEaK/EV BVYfjTFe5mUtNnFKZ3loQ8ia5138cq1ptRf2jHv4DpDoezOQdK7Erfym2zRwhc+OrcCb3PcuRWL 2rbR7cArkMW6Zbd/5rmGyR1UmkdDxsdpkPiJsRjp5UKPoEUUBzX2qmilNIVWbPCobIn+S1U+DEi 5okPTPLL30DUMSFsVumOB16OomAuO/Fout74HzwhKeJbThrr0iDOYkLqdLHqcUL3j+uqFAaq4of 8WCMg+QtS73CclNWBcge1KYkH6QEgWNMj0pzUyXFu3vHwAk4NbuNl2fiOQQdYDRY9rcBmcMsWd5 GfCWZrYXPpiKiRee2w/uFs0XdtBfV1HPKfvtgS22ebf2MedhfF2TTUS6KZevy4GJaQS7CkYpQwf envtjD6Bx7CP+/GP6l7l78J8klA+b9fJ2NN3C2D1gbDDCdQJLiAAClp+DdzU0= X-Received: by 2002:a17:903:4b28:b0:2cc:777f:d67c with SMTP id d9443c01a7336-2d37e856ffcmr53648995ad.13.1786616778614; Thu, 13 Aug 2026 03:26:18 -0700 (PDT) Received: from LAPTOP-N3B6U5LC.localdomain ([117.147.100.52]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2d37c49bd29sm7220095ad.64.2026.08.13.03.26.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 13 Aug 2026 03:26:18 -0700 (PDT) From: Zhenhao Wan Date: Thu, 13 Aug 2026 18:24:26 +0800 Subject: [PATCH] drm/nouveau: disable VM_BIND once a legacy BO VMA is created Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260813-nouveau-gem-uvmm-vma-fix-v1-1-4f14d427f2c9@gmail.com> X-B4-Tracking: v=1; b=H4sIAFmbfWoC/yXMSwqEMBBF0a1IjS2IX9StiIMkllpCoiQmNIh77 3Q7PA/evcGTY/IwZDc4iuz5sAlFnoHepF0JeU6GUpSt6IoK7REiyYArGQzRGIxG4sIf7GaxKKn rplY9pPvpKM3/9Di99kHtpK9fD57nC8WTXNF8AAAA X-Change-ID: 20260813-nouveau-gem-uvmm-vma-fix-8d0fbac454b9 To: Lyude Paul , Danilo Krummrich , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Dave Airlie Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Yuhao Jiang , stable@vger.kernel.org, Zhenhao Wan X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1786616773; l=2346; i=whi4ed0g@gmail.com; h=from:subject:message-id; bh=yrf9imgPzO8wlFHThXUTZ35rA60+QDuQrt+uQxh0u+M=; b=8up90CkB3EcBEnF95pzAf697k2mBINT6B819yhVrWyqIK8onVKU51wq9dVqfe1WponwGildgE n1Cbg8WGmwFBxQyZiMo/7nsnzQyn6HS1V+ThAo1prd3d45OWyzzzIbM X-Developer-Key: i=whi4ed0g@gmail.com; a=ed25519; pk=zRTKlstE0LmilshGwJsFYEVjiT6RiXMBXK8Og6VmuVQ= nouveau_gem_object_open() creates a legacy per-client VMA when the client has not initialised VM_BIND (!nouveau_cli_uvmm()), but nouveau_gem_object_close() only tears it down while the client is still not a VM_BIND client ("if (nouveau_cli_uvmm(cli)) return;"). nouveau_gem_ioctl_new() calls nouveau_cli_disable_uvmm_noinit() to stop a client mixing the legacy and VM_BIND uAPIs, but the prime-import and flink GEM_OPEN paths that also run nouveau_gem_object_open() do not. A client can thus open an object (creating a legacy VMA), call NOUVEAU_VM_INIT, then close the handle: close() now returns early and leaks the VMA. If the BO is flink-shared it outlives the client's freed vmm, and the next migration walks nvbo->vma_list in nouveau_bo_move_ntfy() and dereferences the stale vma->vmm -- a use-after-free. Disable VM_BIND in nouveau_gem_object_open() as nouveau_gem_ioctl_new() does; the helper is a no-op once VM_BIND is initialised, so VM_BIND-first clients are unaffected. Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI") Reported-by: Yuhao Jiang Assisted-by: Claude:claude-opus-5 Cc: stable@vger.kernel.org Signed-off-by: Zhenhao Wan --- drivers/gpu/drm/nouveau/nouveau_gem.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouvea= u/nouveau_gem.c index 20dba02d6175..e33f76b5a239 100644 --- a/drivers/gpu/drm/nouveau/nouveau_gem.c +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c @@ -108,6 +108,14 @@ nouveau_gem_object_open(struct drm_gem_object *gem, st= ruct drm_file *file_priv) if (vmm->vmm.object.oclass < NVIF_CLASS_VMM_NV50) return 0; =20 + /* + * Opening the object binds it through the legacy per-VMA path below. + * Disable VM_BIND for this client, as nouveau_gem_ioctl_new() does, so + * a later NOUVEAU_VM_INIT cannot switch the client to uvmm and leave + * nouveau_gem_object_close() unable to tear this VMA down. + */ + nouveau_cli_disable_uvmm_noinit(cli); + if (nvbo->no_share && uvmm && drm_gpuvm_resv(&uvmm->base) !=3D nvbo->bo.base.resv) return -EPERM; --- base-commit: db2ddb87143519e20a95aa36c60b36107b736a58 change-id: 20260813-nouveau-gem-uvmm-vma-fix-8d0fbac454b9 Best regards, -- =20 Zhenhao Wan