diff options
| author | Zhi Wang <[email protected]> | 2025-05-27 16:37:12 +0000 |
|---|---|---|
| committer | Danilo Krummrich <[email protected]> | 2025-06-13 14:38:06 +0000 |
| commit | 9802f0a63b641f4cddb2139c814c2e95cb825099 (patch) | |
| tree | 517ce810ce225fc53a4571a42b70ffef3bed7994 /tools/perf/scripts/python/check-perf-trace.py | |
| parent | drm/nouveau/gsp: Fix potential integer overflow on integer shifts (diff) | |
| download | kernel-9802f0a63b641f4cddb2139c814c2e95cb825099.tar.gz kernel-9802f0a63b641f4cddb2139c814c2e95cb825099.zip | |
drm/nouveau: fix a use-after-free in r535_gsp_rpc_push()
The RPC container is released after being passed to r535_gsp_rpc_send().
When sending the initial fragment of a large RPC and passing the
caller's RPC container, the container will be freed prematurely. Subsequent
attempts to send remaining fragments will therefore result in a
use-after-free.
Allocate a temporary RPC container for holding the initial fragment of a
large RPC when sending. Free the caller's container when all fragments
are successfully sent.
Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM")
Signed-off-by: Zhi Wang <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
[ Rebase onto Blackwell changes. - Danilo ]
Signed-off-by: Danilo Krummrich <[email protected]>
Diffstat (limited to 'tools/perf/scripts/python/check-perf-trace.py')
0 files changed, 0 insertions, 0 deletions