Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] drm/nouveau: UAF in select_page_shift() due to lockless resource access --
commit 96b9704295117874e5545da9ce1209804365ab06 Author: Junrui Luo <[email protected]> drm/nouveau/uvmm: reject replace across page sizes This commit fixes an issue where rebinding mappings across different page sizes leaves split remainders with incorrect page tables. It rejects binds with mismatched page sizes and ensures split remainders inherit their parent's page size. Link: https://lore.kernel.org/r/[email protected] > diff --git a/drivers/gpu/drm/nouveau/nouveau_uvmm.c > b/drivers/gpu/drm/nouveau/nouveau_uvmm.c > index f5e4756b4de4a..aa5b93808f41c 100644 > --- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c > +++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c > @@ -684,8 +686,20 @@ nouveau_uvmm_sm_prepare(struct nouveau_uvmm *uvmm, > struct drm_gpuva_op *op; > u64 vmm_get_start = args ? args->addr : 0; > u64 vmm_get_end = args ? args->addr + args->range : 0; > + u8 map_page_shift = 0; > int ret; > > + /* A new mapping takes over the page tables of the mappings it replaces, > + * so every one of them has to be using its page size. The new mapping > + * is the last op drm_gpuvm_sm_map_ops_create() emits. > + */ > + if (args) { > + struct drm_gpuva_op *last = drm_gpuva_last_op(ops); > + > + if (last->op == DRM_GPUVA_OP_MAP) > + map_page_shift = select_page_shift(uvmm, &last->map); [Severity: High] Does this call to select_page_shift() introduce a Use-After-Free (UAF) due to lockless resource access? In nouveau_uvmm_bind_job_submit(), the map prepare sequence is called before drm_exec_until_all_locked() acquires the GEM objects' dma_resv locks: drivers/gpu/drm/nouveau/nouveau_uvmm.c:nouveau_uvmm_bind_job_submit() { ... ret = nouveau_uvmm_sm_map_prepare(uvmm, &op->new, reg, op->ops, op->va.addr, op->va.range, op->flags & 0xff); ... } Inside select_page_shift(), the code accesses nvbo->bo.resource and dereferences its properties without the dma_resv_lock held: drivers/gpu/drm/nouveau/nouveau_uvmm.c:select_page_shift() { ... struct nouveau_mem *mem = nouveau_mem(nvbo->bo.resource); struct nvif_vmm *vmm = &uvmm->vmm.vmm; ... /* Skip incompatible domains. */ if ((mem->mem.type & NVIF_MEM_VRAM) && !vmm->page[i].vram) continue; ... } Because the dma_resv lock is not held during this preparation phase, TTM can concurrently evict or move the BO, freeing the old ttm_resource (and its wrapping nouveau_mem structure). This could leave a dangling pointer and cause a UAF when accessing mem->mem.type, potentially leading to a kernel panic or privilege escalation. > + } -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
