From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from bali.collaboradmins.com (bali.collaboradmins.com [148.251.105.195]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 497DA14B977; Wed, 6 May 2026 12:16:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.251.105.195 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778069800; cv=none; b=WX/UTiZMf+MDr/7SWSAC5Tx0HjnoSyaq7YWUdgzjIkFJwpuIlQ5oVTGxMPOLTuCleZDaoa0szLILPA4LKwA07TfotvblKSjIb5qeZ2kGhF++wf2WIirwXxv/RW1FN5s+PyZFhMh6cTs5d5eYJDxvOoWQGtyRzTSd/LSHguQKDk0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778069800; c=relaxed/simple; bh=s2rz6WBCQQLTAnI5a+CDvnoj5qWr+M9TUVuy622jV7E=; h=From:Subject:Date:Message-Id:MIME-Version:Content-Type:To:Cc; b=ZBSyvaaVElpy/Gd+nlBxn2+oWBzY5mJmSHQZ9nTkaYz+8PqMcE6AkyxrQnSoxMfV9hg3OlZzOD7GQokmofdigv+OJFMZzzBfLDg24hq//iMhfojICCchFQoK4PD3qay8a2iTQYYMTIDelFiqfUplmP1cobQ3b6qB1gCz/v31zfg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com; spf=pass smtp.mailfrom=collabora.com; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b=VWrzPbJ6; arc=none smtp.client-ip=148.251.105.195 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=collabora.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=collabora.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=collabora.com header.i=@collabora.com header.b="VWrzPbJ6" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1778069797; bh=s2rz6WBCQQLTAnI5a+CDvnoj5qWr+M9TUVuy622jV7E=; h=From:Subject:Date:To:Cc:From; b=VWrzPbJ6FcOZqnKVy9C3qqbzO/UWw1WydKijlVKnVjyqm9u1MBDBJ2Nkd0q+oKHCH yYwveoHyNmwYAwEMc8t+XI3eQesPyBSOb0SvwmJiFyUEvZBYmpm0BedDIy42Im/wCz +ohF0utsPg7ChM/qk6vrX8vGf61OwIgD/lemsBYylEpAYcJQc2/7321ZvR11c0cwlq dVvAE6HpgXxHrv4uCOdYOpqfk/FGElwyctgXzaWqwDb20C/AkgHTv2VdQ4MTGZ38BW 1sgJDgtxT/W8gVvB+C8B128MVbV2hZCU/nskg4w+f2pfwWCSi9eocFQqYzfc49/2OS NmSPzDvMKic0g== Received: from [100.64.0.11] (unknown [100.64.0.11]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: bbrezillon) by bali.collaboradmins.com (Postfix) with ESMTPSA id 91D3017E1502; Wed, 6 May 2026 14:16:36 +0200 (CEST) From: Boris Brezillon Subject: [PATCH 0/3] drm/panthor: Fix a race in the shrinker logic Date: Wed, 06 May 2026 14:16:25 +0200 Message-Id: <20260506-panthor-shrinker-fixes-v1-0-e7721526de96@collabora.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-B4-Tracking: v=1; b=H4sIAAAAAAAC/x3LQQqAIBBA0avErBvQSImuEi3CxhwCjZmIILp70 vLx+Q8oCZPC2DwgdLFyyRW2bSCkJW+EvFZDZzpvnPF4LPlMRVCTcN5JMPJNim4INvYuxNBbqPM h9If6TvP7fp9wy89oAAAA X-Change-ID: 20260506-panthor-shrinker-fixes-58c1f45cfc41 To: Steven Price , Liviu Dudau , Boris Brezillon , Dmitry Osipenko Cc: Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Akash Goel , Chia-I Wu , Rob Clark , Dmitry Baryshkov , Abhinav Kumar , Jessica Zhang , Sean Paul , Marijn Suijten , linux-arm-msm@vger.kernel.org, freedreno@lists.freedesktop.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1778069796; l=1376; i=boris.brezillon@collabora.com; s=20260429; h=from:subject:message-id; bh=s2rz6WBCQQLTAnI5a+CDvnoj5qWr+M9TUVuy622jV7E=; b=THEVnc4x1Mq4RI7yePdlKafi+stM406BVAhLHlcFjn6UsvLD2Eypts6czFRA3bjzlawp9M/xm EuezyTmr5S/CiWGj5okBy6X1+9FnjKHz0kQAvjitxXZfCY8pUBv9Rgh X-Developer-Key: i=boris.brezillon@collabora.com; a=ed25519; pk=eN+ORdOgQY7d5U+0kA8h5bf67XdD8bhKbjD/TCHexSY= As reported by Chia-I [1], a race exists between drm_gem_lru_remove() and drm_gem_lru_scan(), causing a UAF on a stack-allocated object. This first patch fixes the problem at the panthor level by making sure we never use drm_gem_lru_remove(). The second one fixes an undetected race between drm_gem_lru_scan() and drm_gem_object_release(), and the last one kills drm_gem_lru_remove() so no one else relying on the drm_gem_lru infra gets bitten by this race again. Adding the MSM maintainers to the loop, since it's the only other driver relying on drm_gem_lru. [1]https://gitlab.freedesktop.org/panfrost/linux/-/work_items/86 --- Boris Brezillon (3): drm/panthor: Don't use the racy drm_gem_lru_remove() helper drm/gem: Fix a race between drm_gem_lru_scan() and drm_gem_object_release() drm/gem: Stop exposing the racy/unsafe drm_gem_lru_remove() helper drivers/gpu/drm/drm_gem.c | 63 ++++++++++++++------------------ drivers/gpu/drm/panthor/panthor_device.h | 10 +++++ drivers/gpu/drm/panthor/panthor_gem.c | 5 ++- include/drm/drm_gem.h | 1 - 4 files changed, 41 insertions(+), 38 deletions(-) --- base-commit: 57f68ed1f08cd10f51a9091645fd5dfcc369a885 change-id: 20260506-panthor-shrinker-fixes-58c1f45cfc41 Best regards, -- Boris Brezillon