diff options
| author | Maíra Canal <mcanal@igalia.com> | 2026-03-30 14:51:46 -0300 |
|---|---|---|
| committer | Maíra Canal <mcanal@igalia.com> | 2026-04-02 07:53:23 -0300 |
| commit | 338c56050d8e892604da97f67bfa8cc4015a955f (patch) | |
| tree | 2949d6a92201b2b65bf679bd969d14a50f2c900e | |
| parent | 9525d169e5fd481538cf8c663cc5839e54f2e481 (diff) | |
drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock
The mmap callback reads bo->madv without holding madv_lock, racing with
concurrent DRM_IOCTL_VC4_GEM_MADVISE calls that modify the field under
the same lock. Add the missing locking to prevent the data race.
Fixes: b9f19259b84d ("drm/vc4: Add the DRM_IOCTL_VC4_GEM_MADVISE ioctl")
Reviewed-by: Melissa Wen <mwen@igalia.com>
Link: https://patch.msgid.link/20260330-vc4-misc-fixes-v1-4-92defc940a29@igalia.com
Signed-off-by: Maíra Canal <mcanal@igalia.com>
| -rw-r--r-- | drivers/gpu/drm/vc4/vc4_bo.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c index 1f93bc5a3d02..cb2b62a41972 100644 --- a/drivers/gpu/drm/vc4/vc4_bo.c +++ b/drivers/gpu/drm/vc4/vc4_bo.c @@ -738,12 +738,15 @@ static int vc4_gem_object_mmap(struct drm_gem_object *obj, struct vm_area_struct return -EINVAL; } + mutex_lock(&bo->madv_lock); if (bo->madv != VC4_MADV_WILLNEED) { DRM_DEBUG("mmapping of %s BO not allowed\n", bo->madv == VC4_MADV_DONTNEED ? "purgeable" : "purged"); + mutex_unlock(&bo->madv_lock); return -EINVAL; } + mutex_unlock(&bo->madv_lock); return drm_gem_dma_mmap(&bo->base, vma); } |