Maíra Canal d868edbc1e drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock ...

[ Upstream commit 338c56050d ]

The mmap callback reads bo->madv without holding madv_lock, racing with
concurrent DRM_IOCTL_VC4_GEM_MADVISE calls that modify the field under
the same lock. Add the missing locking to prevent the data race.

Fixes: b9f19259b8 ("drm/vc4: Add the DRM_IOCTL_VC4_GEM_MADVISE ioctl")
Reviewed-by: Melissa Wen <mwen@igalia.com>
Link: https://patch.msgid.link/20260330-vc4-misc-fixes-v1-4-92defc940a29@igalia.com
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-06-01 17:29:09 +02:00

..

accessibility

…

acpi

ACPI: EC: Fix ECDT probe ordering issues

2026-04-18 10:31:06 +02:00

amba

…

android

binder: don't use %pK through printk

2026-03-04 07:20:06 -05:00

ata

ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585

2026-06-01 17:29:08 +02:00

atm

atm: fore200e: fix use-after-free in tasklets during device removal

2026-03-04 07:20:23 -05:00

auxdisplay

…

base

device property: fix of node refcount leak in fwnode_graph_get_next_endpoint()

2026-04-18 10:31:17 +02:00

bcma

…

block

drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()

2026-04-18 10:30:51 +02:00

bluetooth

Bluetooth: btusb: clamp SCO altsetting table indices

2026-04-18 10:31:05 +02:00

bus

bus: fsl-mc: fix an error handling in fsl_mc_device_add()

2026-03-04 07:20:19 -05:00

cdrom

…

char

…

clk

clk: tegra: tegra124-emc: fix device leak on set_rate()

2026-04-18 10:30:50 +02:00

clocksource

clocksource/drivers/timer-integrator-ap: Add missing Kconfig dependency on OF

2026-03-04 07:19:55 -05:00

connector

…

counter

…

cpufreq

cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path

2026-04-18 10:31:15 +02:00

cpuidle

sched: idle: Make skipping governor callbacks more consistent

2026-04-18 10:30:54 +02:00

crypto

crypto: atmel-sha204a - Fix OOM ->tfm_count leak

2026-04-18 10:31:00 +02:00

dax

…

dca

…

devfreq

…

dio

…

dma

dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA

2026-04-18 10:31:07 +02:00

dma-buf

…

edac

…

eisa

…

extcon

…

firewire

…

firmware

efi/mokvar-table: Avoid repeated map/unmap of the same page

2026-04-18 10:31:10 +02:00

fpga

fpga: dfl: use subsys_initcall to allow built-in drivers to be added

2026-03-04 07:20:13 -05:00

fsi

…

gnss

…

gpio

gpio: aspeed-sgpio: Change the macro to support deferred probe

2026-03-04 07:19:59 -05:00

gpu

drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock

2026-06-01 17:29:09 +02:00

greybus

…

hid

HID: roccat: fix use-after-free in roccat_report_event

2026-06-01 17:29:08 +02:00

hsi

…

hv

…

hwmon

hwmon: (occ) Fix division by zero in occ_show_power_1()

2026-04-18 10:31:11 +02:00

hwspinlock

…

hwtracing

coresight: etm3x: Fix cpulocked warning on cpuhp

2026-03-04 07:19:44 -05:00

i2c

i2c: fsi: Fix a potential leak in fsi_i2c_probe()

2026-04-18 10:31:03 +02:00

i3c

…

ide

…

idle

…

iio

iio: gyro: mpu3050: Fix out-of-sequence free_irq()

2026-04-18 10:31:12 +02:00

infiniband

RDMA/rw: Fall back to direct SGE on MR pool exhaustion

2026-04-18 10:31:06 +02:00

input

Input: uinput - take event lock when submitting FF request "event"

2026-04-18 10:31:13 +02:00

interconnect

…

iommu

iommu/vt-d: Fix intel iommu iotlb sync hardlockup and retry

2026-04-18 10:30:58 +02:00

ipack

…

irqchip

irqchip/gic-v3-its: Limit number of per-device MSIs to the range the ITS supports

2026-04-18 10:30:56 +02:00

isdn

…

leds

…

lightnvm

…

macintosh

…

mailbox

mailbox: sprd: clear delivery flag before handling TX done

2026-03-04 07:20:05 -05:00

mcb

…

md

dm mpath: make pg_init_delay_msecs settable

2026-03-04 07:20:20 -05:00

media

media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar

2026-04-18 10:31:10 +02:00

memory

…

memstick

…

message

…

mfd

Revert "mfd: da9052-spi: Change read-mask to write-mask"

2026-03-04 07:20:07 -05:00

misc

misc: rtsx: Add SD Express mode support for RTS5261

2026-03-04 07:19:44 -05:00

mmc

mmc: vub300: fix NULL-deref on disconnect

2026-04-18 10:31:15 +02:00

most

…

mtd

mtd: rawnand: brcmnand: skip DMA during panic write

2026-04-18 10:31:03 +02:00

mux

…

net

wifi: brcmfmac: validate bsscfg indices in IF events

2026-06-01 17:29:08 +02:00

nfc

nfc: pn533: allocate rx skb before consuming bytes

2026-04-18 10:31:15 +02:00

ntb

NTB: ntb_transport: Fix too small buffer for debugfs_name

2026-03-04 07:20:24 -05:00

nubus

…

nvdimm

nvdimm/bus: Fix potential use after free in asynchronous initialization

2026-04-18 10:30:57 +02:00

nvme

nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()

2026-04-18 10:31:16 +02:00

nvmem

…

of

…

opp

…

oprofile

…

parisc

…

parport

…

pci

PCI: hv: Set default NUMA node to 0 for devices without affinity info

2026-06-01 17:29:08 +02:00

pcmcia

…

perf

…

phy

phy: renesas: rcar-gen3-usb2: Assert PLL reset on PHY power off

2026-04-18 10:31:12 +02:00

pinctrl

pinctrl: mediatek: common: Fix probe failure for devices without EINT

2026-04-18 10:31:04 +02:00

platform

platform/olpc: olpc-xo175-ec: Fix overflow error message to print inlen

2026-04-18 10:31:05 +02:00

pnp

…

power

power: supply: wm97xx: Fix NULL pointer dereference in power_supply_changed()

2026-03-04 07:19:38 -05:00

powercap

…

pps

…

ps3

…

ptp

…

pwm

…

rapidio

rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net()

2026-03-04 07:20:20 -05:00

ras

…

regulator

regulator: pca9450: Correct interrupt type

2026-04-18 10:30:54 +02:00

remoteproc

remoteproc: sysmon: Correct subsys_name_len type in QMI request

2026-04-18 10:30:52 +02:00

reset

…

rpmsg

rpmsg: core: fix race in driver_override_show() and use core helper

2026-03-04 07:20:13 -05:00

rtc

rtc: interface: Alarm race handling should not discard preceding error

2026-03-04 07:19:50 -05:00

s390

s390/zcrypt: Enable AUTOSEL_DOM for CCA serialnr sysfs attribute

2026-04-18 10:31:00 +02:00

sbus

…

scsi

scsi: core: Wake up the error handler when final completions race against each other

2026-04-18 10:31:10 +02:00

sfi

…

sh

…

siox

…

slimbus

…

soc

soc: fsl: qbman: fix race condition in qman_destroy_fq

2026-04-18 10:31:01 +02:00

soundwire

…

spi

spi: spi-fsl-lpspi: fix teardown order issue (UAF)

2026-04-18 10:31:06 +02:00

spmi

…

ssb

…

staging

comedi: me4000: Fix potential overrun of firmware buffer

2026-04-18 10:31:12 +02:00

target

…

tc

…

tee

…

thermal

…

thunderbolt

thunderbolt: Fix property read in nhi_wake_supported()

2026-04-18 10:31:13 +02:00

tty

serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY

2026-04-18 10:30:58 +02:00

uio

…

usb

usb: gadget: uvc: fix NULL pointer dereference during unbind race

2026-04-18 10:31:16 +02:00

vdpa

…

vfio

…

vhost

…

video

fbdev: ffb: fix corrupted video output on Sun FFB1

2026-03-04 07:20:24 -05:00

virt

…

virtio

…

visorbus

…

vlynq

…

vme

…

w1

…

watchdog

fix it87_wdt early reboot by reporting running timer

2026-03-04 07:20:06 -05:00

xen

Buffer overflow in drivers/xen/sys-hypervisor.c

2026-04-30 11:25:29 +02:00

zorro

…

Kconfig

…

Makefile

…