From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 50A7E3659FB for ; Tue, 18 Aug 2026 20:18:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787084333; cv=none; b=XiOQQjueUsNvLimS3ix4tRJCyMz35stmXpx4bB/hlUt7BmrqLWv3dN7K5iYZlIc+YoWlJ/E1x4rDWz/rE0bSWmWHvuNmDz4d8lj9ub/3A5uPGScW7HvJ/B8+Ttav9g3d1ip9EvIG1TV8C69LpHnLVEpzoC15US2Vr3nAVmDCpUA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787084333; c=relaxed/simple; bh=QSjEJ+3oiIlDrlfXsEdJ5jpNGIkTPrgzJoW6lljP6f8=; h=Message-ID:Subject:From:To:Cc:Date:In-Reply-To:References: Content-Type:MIME-Version; b=HrJU1S69BSzYy1JNWaQcR5PNCIC/4R5bU5wQRIYhRU/qIx5GAKMPwaxXfU3WuWO0Cepu4JmTx/CpEjW+h2YKsAmr/i6av/L21oRCXAZ5z41vjQXKb5k8seqYQeMS99+qlwuWLGi+hWaY+PphVck1H35m+Vrvhpa0OH6+iefho/w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=aJcaJ/FO; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=ssI6nvWl; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="aJcaJ/FO"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="ssI6nvWl" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1787084331; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=g9OWuHNZhe61OBLjXm8D+LZBFST1XmHdZMCDCW5KK8E=; b=aJcaJ/FOy0I0T2bSJMFyoNVyO4ps9hbZDvDMCLTqBfEHI2UvlPWjFbQzctJZiqvP5thPI5 7bAaswuzLuqKyiX2mc5QjtbpbK+xePe0RUd1AOsm+4CwZuXl81FS9LnvVSzE/OagqDv5cP yg5mOR2/j20cTeD2DFowFpikoBfMf38= Received: from mail-qv1-f69.google.com (mail-qv1-f69.google.com [209.85.219.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-507-Q0N4-sUeOkeyy-A0PxqukA-1; Tue, 18 Aug 2026 16:18:44 -0400 X-MC-Unique: Q0N4-sUeOkeyy-A0PxqukA-1 X-Mimecast-MFC-AGG-ID: Q0N4-sUeOkeyy-A0PxqukA_1787084324 Received: by mail-qv1-f69.google.com with SMTP id 6a1803df08f44-8ec3314f65fso4231766d6.3 for ; Tue, 18 Aug 2026 13:18:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1787084324; x=1787689124; darn=vger.kernel.org; h=mime-version:user-agent:content-transfer-encoding:content-type :references:in-reply-to:date:cc:to:from:subject:message-id:from:to :cc:subject:date:message-id:reply-to:content-type; bh=g9OWuHNZhe61OBLjXm8D+LZBFST1XmHdZMCDCW5KK8E=; b=ssI6nvWlaS8pbxt7AN6Y1dEZxZK5CF/GMbsaacl4FI5QXSBiEjIcVoeWdhasLbFi0/ 5i5dJQMeTBa6jG68CJAZG6BjwT04X3YBultRhDWeM8wV/ymruRzkqyM09N9PFimelDGJ cKhn9iEBWMYFvLuYETILE+UqGQ+znB8lRLQSnFqt9zVzerfawn1W62MuM4V4tO/XFG2p U3XAcSQeaH6ccbVqiv8+W9ewn/kilH+bGkg3NhCGiu3SMkTNvQ+9bdEJNfbfwnUrWiO9 Jm86Y9XHU3eOsqIWFO3KIH9+5R/7cFX7HVZJCfNwv4pnNLADWxBnlFE9JIp7xJf0wXBo rG/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787084324; x=1787689124; h=mime-version:user-agent:content-transfer-encoding:content-type :references:in-reply-to:date:cc:to:from:subject:message-id:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=g9OWuHNZhe61OBLjXm8D+LZBFST1XmHdZMCDCW5KK8E=; b=Z/+L1W5YVpmN0aIHGherMBOtuirpOpYYhd3BzKpbnBx7DdNkodgZwleHI7XMctTCMc n9sB7Ye4vLJMo5d58cJfAzKPyd9jbai/YTXXIwmAOw+2cffMWbXkMm9pkwNiAMe2FJs7 pQleU3nMJYpKr1klx+An6ylzLNg9/atdZOgL69ens5p3u8hy/I9lP1wvk4VAp9SaeuTy uqfRhAFnZNhztl6m0cJ9TZUr5wLgHYmwoT86hWSl8BJcDQRtGlsx9hMxK/7ZN7oJO5Ir WV+6HSZ1egN6NjNnsX5JW/vglzLUzbWLajBv1G1dix3phCDpRLLWmyEhfVsm9YnM1GHS fycA== X-Forwarded-Encrypted: i=1; AHgh+RoKi6U65IZLH3GJP6mhhku9bw8E24zZJDIIbt/Cwv0XFSK4lgr9dMUl5tehe+xQpcnldSawXyo1aannV24=@vger.kernel.org X-Gm-Message-State: AOJu0Yy1q6oAEhVbwIUgEv65F2jP4vZWaHLAO6wjPqsyY/F1DySXEO/F dpzcYB+jjHTUSM7NV8uOjyiiASTu7sSr4s0fXkHWtHRdEKyCW5+y12eou9Y0knZ5H7DCPwsGQN+ nbPoyxUxVjyh7W+pFviJ6gdKNxYLI0/H3aq+xRw9tg+V9uZN7lx3SRox5pNqNkBel9A== X-Gm-Gg: AR+sD13g2zZU7oYA6Qi9KZwZ5lNWJkbNc0TaWu8HqVMPYtCxCLjNfsrlOVKnAO9F/f3 +niGmJLQRzH4q6j1EuitG1FmE9d8SdD7rW4M2z3z28aIWSR6iLuKUS1r48ojKDIdgP1HPGymW8W KyBUWsbHQm9QSmDNfJ/F/+7FVzo6HnVah2BKlhKFsd1Ybg6WLy9IPuQeXm1BcpykcWxWePcogd8 WZzJ+gWIQALywWPDMsUAtBdUpARgZKjameVKWqTho4lNI2Fh/15fYSNI0i8A1NKAKjbN8WJLrzX 5wzJ0TTedSmkXKXitotxCraqbm6geROJcV7RdDRSMyM8ZaCdUb009z/TrZEgL+Eg6cObrYfg X-Received: by 2002:a05:6214:4518:b0:8be:7779:d1b1 with SMTP id 6a1803df08f44-90c5c14e795mr13754606d6.30.1787084323985; Tue, 18 Aug 2026 13:18:43 -0700 (PDT) X-Received: by 2002:a05:6214:4518:b0:8be:7779:d1b1 with SMTP id 6a1803df08f44-90c5c14e795mr13753966d6.30.1787084323495; Tue, 18 Aug 2026 13:18:43 -0700 (PDT) Received: from [192.168.8.4] ([100.0.180.93]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-90c4597793esm39672716d6.41.2026.08.18.13.18.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 18 Aug 2026 13:18:42 -0700 (PDT) Message-ID: Subject: Re: [PATCH v2] drm/nouveau/svm: drain fault handler before freeing svmm From: lyude@redhat.com To: Zhenhao Wan , Danilo Krummrich , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Ben Skeggs Cc: dri-devel@lists.freedesktop.org, nouveau@lists.freedesktop.org, linux-kernel@vger.kernel.org, Yuhao Jiang , stable@vger.kernel.org Date: Tue, 18 Aug 2026 16:18:42 -0400 In-Reply-To: <20260814-nouveau-svm-svmm-uaf-v2-1-8e6590519f07@gmail.com> References: <20260814-nouveau-svm-svmm-uaf-v2-1-8e6590519f07@gmail.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.58.3 (3.58.3-1.fc43) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reviewed-by: Lyude Paul Will push to drm-misc-next in just a moment On Fri, 2026-08-14 at 18:00 +0800, Zhenhao Wan wrote: > The SVM fault handler nouveau_svm_fault() looks up each fault's > nouveau_svmm under svm->mutex, caches it in the fault array, then > drops > svm->mutex and dereferences the svmm across blocking faults > (mmu_interval_notifier_insert(), hmm_range_fault()). >=20 > nouveau_svmm is not refcounted. On DRM file close nouveau_svmm_fini() > -> > mmu_notifier_put() frees it asynchronously via call_srcu() without > waiting for the handler, and mmget_not_zero() pins the mm, not the > svmm. > flush_work() on the fault buffer otherwise runs only at device > removal > and suspend, never on close, so a fault handled concurrently with a > close > can dereference a freed svmm. >=20 > The instance is already unlinked by nouveau_svmm_part() earlier in > the > same close, so no new fault can resolve to it. Drain the handler in > nouveau_svmm_fini() before the free, guarding the flush with a NULL > check > on drm->svm: on device teardown nouveau_svm_fini() runs first and > frees > drm->svm (NULL) after blocking the notify and flushing the buffer, so > the > handler is already drained; on per-client close drm->svm is alive and > the > flush runs. >=20 > Fixes: eeaf06ac1a55 ("drm/nouveau/svm: initial support for shared > virtual memory") > Reported-by: Yuhao Jiang > Assisted-by: Claude:claude-opus-5 > Cc: stable@vger.kernel.org > Signed-off-by: Zhenhao Wan > --- > Changes in v2: > - Fix a NULL deref introduced in v1: guard flush_work() with a NULL > =C2=A0 check on drm->svm.=C2=A0 On device teardown nouveau_svm_fini() fre= es > =C2=A0 drm->svm before the per-client svmm teardown, so > nouveau_svmm_fini() > =C2=A0 would deref NULL (reported by Sashiko AI review); the handler is > =C2=A0 already drained there, so there is nothing left to flush. > - Tighten the commit message and the code comment; no functional > change. > - Link to v1: > https://patch.msgid.link/20260813-nouveau-svm-svmm-uaf-v1-1-2d3112dea734@= gmail.com >=20 > To: Lyude Paul > To: Danilo Krummrich > To: Maarten Lankhorst > To: Maxime Ripard > To: Thomas Zimmermann > To: David Airlie > To: Simona Vetter > To: Ben Skeggs > Cc: dri-devel@lists.freedesktop.org > Cc: nouveau@lists.freedesktop.org > Cc: linux-kernel@vger.kernel.org > --- > =C2=A0drivers/gpu/drm/nouveau/nouveau_svm.c | 13 +++++++++++++ > =C2=A01 file changed, 13 insertions(+) >=20 > diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c > b/drivers/gpu/drm/nouveau/nouveau_svm.c > index dcc92131488e..a87406d3da30 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_svm.c > +++ b/drivers/gpu/drm/nouveau/nouveau_svm.c > @@ -304,6 +304,19 @@ nouveau_svmm_fini(struct nouveau_svmm **psvmm) > =C2=A0{ > =C2=A0 struct nouveau_svmm *svmm =3D *psvmm; > =C2=A0 if (svmm) { > + struct nouveau_svm *svm =3D svmm->vmm->cli->drm->svm; > + > + /* The fault handler caches svmm pointers under svm- > >mutex and > + * dereferences them after dropping it, across > blocking faults. > + * The instance is already unlinked > (nouveau_svmm_part), so drain > + * the handler before the free to release any in- > flight reference. > + * > + * On device teardown nouveau_svm_fini() ran first > and freed > + * drm->svm (NULL) after draining the buffer; > nothing to flush. > + */ > + if (svm) > + flush_work(&svm->buffer[0].work); > + > =C2=A0 mutex_lock(&svmm->mutex); > =C2=A0 svmm->vmm =3D NULL; > =C2=A0 mutex_unlock(&svmm->mutex); >=20 > --- > base-commit: db2ddb87143519e20a95aa36c60b36107b736a58 > change-id: 20260813-nouveau-svm-svmm-uaf-bbcf36265aaa >=20 > Best regards, > --=C2=A0=20 > Zhenhao Wan