Re: [PATCH] drm/ttm: fix use-after-free races in vm fault handling

2017-02-27 Thread Daniel Vetter
On Mon, Feb 27, 2017 at 10:08:47AM +0100, Daniel Vetter wrote: > On Mon, Feb 27, 2017 at 09:56:56AM +0100, Christian König wrote: > > Am 26.02.2017 um 22:35 schrieb Daniel Vetter: > > > On Sun, Feb 19, 2017 at 10:32:43AM +0100, Christian König wrote: > > > > Am 18.02.2017 um 23:50 schrieb Nicolai H

Re: [PATCH] drm/ttm: fix use-after-free races in vm fault handling

2017-02-27 Thread Daniel Vetter
On Mon, Feb 27, 2017 at 09:56:56AM +0100, Christian König wrote: > Am 26.02.2017 um 22:35 schrieb Daniel Vetter: > > On Sun, Feb 19, 2017 at 10:32:43AM +0100, Christian König wrote: > > > Am 18.02.2017 um 23:50 schrieb Nicolai Hähnle: > > > > From: Nicolai Hähnle > > > > > > > > The vm fault hand

Re: [PATCH] drm/ttm: fix use-after-free races in vm fault handling

2017-02-27 Thread Christian König
Am 26.02.2017 um 22:35 schrieb Daniel Vetter: On Sun, Feb 19, 2017 at 10:32:43AM +0100, Christian König wrote: Am 18.02.2017 um 23:50 schrieb Nicolai Hähnle: From: Nicolai Hähnle The vm fault handler relies on the fact that the VMA owns a reference to the BO. However, once mmap_sem is release

Re: [PATCH] drm/ttm: fix use-after-free races in vm fault handling

2017-02-26 Thread Daniel Vetter
On Sun, Feb 19, 2017 at 10:32:43AM +0100, Christian König wrote: > Am 18.02.2017 um 23:50 schrieb Nicolai Hähnle: > > From: Nicolai Hähnle > > > > The vm fault handler relies on the fact that the VMA owns a reference > > to the BO. However, once mmap_sem is released, other tasks are free to > > d

Re: [PATCH] drm/ttm: fix use-after-free races in vm fault handling

2017-02-19 Thread Christian König
Am 18.02.2017 um 23:50 schrieb Nicolai Hähnle: From: Nicolai Hähnle The vm fault handler relies on the fact that the VMA owns a reference to the BO. However, once mmap_sem is released, other tasks are free to destroy the VMA, which can lead to the BO being freed. Fix two code paths where that c

[PATCH] drm/ttm: fix use-after-free races in vm fault handling

2017-02-18 Thread Nicolai Hähnle
From: Nicolai Hähnle The vm fault handler relies on the fact that the VMA owns a reference to the BO. However, once mmap_sem is released, other tasks are free to destroy the VMA, which can lead to the BO being freed. Fix two code paths where that can happen, both related to vm fault retries. Fou