Three bugs on the nouveau VM_BIND submit/unwind/cleanup error path, all
introduced by the original VM_BIND uAPI (Fixes: b88baab82871) and all
reachable by an unprivileged render-node client:
1/3 NULL deref when the unwind loop frees a never-populated
OP_MAP_SPARSE op's ops list.
2/3 premature free of a region on a failed OP_UNMAP_SPARSE, because
op->reg is left set on the failure paths.
3/3 a sparse region left permanently marked dirty after unwind,
wedging later binds over that range.
Each fix is minimal and self-contained; all are Cc: stable.
Signed-off-by: Zhenhao Wan <[email protected]>
---
Zhenhao Wan (3):
drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op
drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE
drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE
drivers/gpu/drm/nouveau/nouveau_uvmm.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
---
base-commit: ba3e43a9e601636f5edb54e259a74f96ca3b8fd8
change-id: 20260811-nouveau-uvmm-vmbind-fixes-c2dfab359df2
Best regards,
--
Zhenhao Wan <[email protected]>
