https://github.com/torvalds/linux
Revision e1fc12c5d9ad06a2a74e97a91f1b0c5f4c723b50 authored by Michel Dänzer on 03 November 2017, 15:00:35 UTC, committed by Alex Deucher on 04 November 2017, 13:48:01 UTC
Fixes a use-after-free due to a race condition in
ttm_bo_cleanup_refs_and_unlock, which allows one task to reserve a BO
and destroy its ttm_resv while another task is waiting for it to signal
in reservation_object_wait_timeout_rcu.

v2:
* Always initialize bo->ttm_resv in ttm_bo_init_reserved
 (Christian König)

Fixes: 0d2bd2ae045d "drm/ttm: fix memory leak while individualizing BOs"
Reviewed-by: Chunming Zhou <david1.zhou@amd.com> # v1
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
1 parent 37c5f2c
History
Tip revision: e1fc12c5d9ad06a2a74e97a91f1b0c5f4c723b50 authored by Michel Dänzer on 03 November 2017, 15:00:35 UTC
drm/ttm: Always and only destroy bo->ttm_resv in ttm_bo_release_list
Tip revision: e1fc12c
File Mode Size
Documentation
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitattributes -rw-r--r-- 30 bytes
.gitignore -rw-r--r-- 1.3 KB
.mailmap -rw-r--r-- 8.2 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 96.1 KB
Kbuild -rw-r--r-- 2.2 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 420.5 KB
Makefile -rw-r--r-- 58.4 KB
README -rw-r--r-- 722 bytes

README

back to top