linux-kernel - [PATCH 5.10 017/122] drm/etnaviv: add missing MMU context put when reaping MMU mapping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210920163916.339109430@linuxfoundation.org>
Date:   Mon, 20 Sep 2021 18:43:09 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     linux-kernel@...r.kernel.org
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        stable@...r.kernel.org, Lucas Stach <l.stach@...gutronix.de>,
        Michael Walle <michael@...le.cc>, Marek Vasut <marex@...x.de>,
        Christian Gmeiner <christian.gmeiner@...il.com>
Subject: [PATCH 5.10 017/122] drm/etnaviv: add missing MMU context put when reaping MMU mapping

From: Lucas Stach <l.stach@...gutronix.de>

commit f2faea8b64125852fa9acc6771c07fc0311a039b upstream.

When we forcefully evict a mapping from the the address space and thus the
MMU context, the MMU context is leaked, as the mapping no longer points to
it, so it doesn't get freed when the GEM object is destroyed. Add the
mssing context put to fix the leak.

Cc: stable@...r.kernel.org # 5.4
Signed-off-by: Lucas Stach <l.stach@...gutronix.de>
Tested-by: Michael Walle <michael@...le.cc>
Tested-by: Marek Vasut <marex@...x.de>
Reviewed-by: Christian Gmeiner <christian.gmeiner@...il.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
---
 drivers/gpu/drm/etnaviv/etnaviv_mmu.c |    1 +
 1 file changed, 1 insertion(+)

--- a/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_mmu.c
@@ -197,6 +197,7 @@ static int etnaviv_iommu_find_iova(struc
 		 */
 		list_for_each_entry_safe(m, n, &list, scan_node) {
 			etnaviv_iommu_remove_mapping(context, m);
+			etnaviv_iommu_context_put(m->context);
 			m->context = NULL;
 			list_del_init(&m->mmu_node);
 			list_del_init(&m->scan_node);