From: Dave Airlie <airlied@redhat.com> mainline inclusion from mainline-v7.3-rc1 commit 5e17160d41d92823f3379c1982e1369680c5ce4d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18887 CVE: CVE-2026-89553 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem close path closing the vma leading to a use-after-free. Spotted with the help of Opus 4.6. Signed-off-by: Dave Airlie <airlied@redhat.com> Fixes: e758a3111914 ("drm/nouveau: fixup gem_info ioctl to return client-specific bo virtual") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260612020658.3176270-1-airlied@gmail.com Signed-off-by: Danilo Krummrich <dakr@kernel.org> Conflicts: drivers/gpu/drm/nouveau/nouveau_gem.c [This tree predates the uvmm rework: there is no nouveau_cli_uvmm() helper and nouveau_gem_object_close() unconditionally releases the vma under the reservation lock. Drop the "!nouveau_cli_uvmm(cli)" condition and the "else rep->offset = 0;" arm, keeping only the ttm_bo_reserve()/unreserve() around nouveau_vma_find() and the vma->addr read.] Signed-off-by: Jiacheng Yu <yujiacheng3@huawei.com> --- drivers/gpu/drm/nouveau/nouveau_gem.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c index 6504ebec11901..ec585da438726 100644 --- a/drivers/gpu/drm/nouveau/nouveau_gem.c +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c @@ -230,11 +230,20 @@ nouveau_gem_info(struct drm_file *file_priv, struct drm_gem_object *gem, rep->domain = NOUVEAU_GEM_DOMAIN_VRAM; rep->offset = nvbo->offset; if (vmm->vmm.object.oclass >= NVIF_CLASS_VMM_NV50) { + int ret; + + ret = ttm_bo_reserve(&nvbo->bo, false, false, NULL); + if (ret) + return ret; + vma = nouveau_vma_find(nvbo, vmm); - if (!vma) + if (!vma) { + ttm_bo_unreserve(&nvbo->bo); return -EINVAL; + } rep->offset = vma->addr; + ttm_bo_unreserve(&nvbo->bo); } rep->size = nvbo->bo.mem.num_pages << PAGE_SHIFT; -- 2.34.1