Re: [PATCH v1 1/4] drm/panthor: Fix UAF on kernel BO VA nodes

[Liviu Dudau <liviu.dudau@arm.com>]

On Fri, Oct 31, 2025 at 04:48:15PM +0100, Boris Brezillon wrote:
> If the MMU is down, panthor_vm_unmap_range() might return an error.
> We expect the page table to be updated still, and if the MMU is blocked,
> the rest of the GPU should be blocked too, so no risk of accessing
> physical memory returned to the system (which the current code doesn't
> cover for anyway).
> 
> Proceed with the rest of the cleanup instead of bailing out and leaving
> the va_node inserted in the drm_mm, which leads to UAF when other
> adjacent nodes are removed from the drm_mm tree.
> 
> Reported-by: Lars-Ivar Hesselberg Simonsen <lars-ivar.simonsen@arm.com>
> Closes: https://gitlab.freedesktop.org/panfrost/linux/-/issues/57
> Fixes: 8a1cc07578bf ("drm/panthor: Add GEM logical block")
> Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>

Reviewed-by: Liviu Dudau <liviu.dudau@arm.com>

Best regards,
Liviu

> ---
>  drivers/gpu/drm/panthor/panthor_gem.c | 14 +++-----------
>  1 file changed, 3 insertions(+), 11 deletions(-)
> 
> diff --git a/drivers/gpu/drm/panthor/panthor_gem.c b/drivers/gpu/drm/panthor/panthor_gem.c
> index 7e7d2f223cfa..f369cc3e2a5f 100644
> --- a/drivers/gpu/drm/panthor/panthor_gem.c
> +++ b/drivers/gpu/drm/panthor/panthor_gem.c
> @@ -87,7 +87,6 @@ static void panthor_gem_free_object(struct drm_gem_object *obj)
>  void panthor_kernel_bo_destroy(struct panthor_kernel_bo *bo)
>  {
>  	struct panthor_vm *vm;
> -	int ret;
>  
>  	if (IS_ERR_OR_NULL(bo))
>  		return;
> @@ -95,18 +94,11 @@ void panthor_kernel_bo_destroy(struct panthor_kernel_bo *bo)
>  	vm = bo->vm;
>  	panthor_kernel_bo_vunmap(bo);
>  
> -	if (drm_WARN_ON(bo->obj->dev,
> -			to_panthor_bo(bo->obj)->exclusive_vm_root_gem != panthor_vm_root_gem(vm)))
> -		goto out_free_bo;
> -
> -	ret = panthor_vm_unmap_range(vm, bo->va_node.start, bo->va_node.size);
> -	if (ret)
> -		goto out_free_bo;
> -
> +	drm_WARN_ON(bo->obj->dev,
> +		    to_panthor_bo(bo->obj)->exclusive_vm_root_gem != panthor_vm_root_gem(vm));
> +	panthor_vm_unmap_range(vm, bo->va_node.start, bo->va_node.size);
>  	panthor_vm_free_va(vm, &bo->va_node);
>  	drm_gem_object_put(bo->obj);
> -
> -out_free_bo:
>  	panthor_vm_put(vm);
>  	kfree(bo);
>  }
> -- 
> 2.51.0
> 

-- 
====================
| I would like to |
| fix the world,  |
| but they're not |
| giving me the   |
 \ source code!  /
  ---------------
    ¯\_(ツ)_/¯