Maíra CanalandGreg Kroah-Hartman 46f7a5f914 drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock ...

[ Upstream commit 338c56050d ]

The mmap callback reads bo->madv without holding madv_lock, racing with
concurrent DRM_IOCTL_VC4_GEM_MADVISE calls that modify the field under
the same lock. Add the missing locking to prevent the data race.

Fixes: b9f19259b8 ("drm/vc4: Add the DRM_IOCTL_VC4_GEM_MADVISE ioctl")
Reviewed-by: Melissa Wen <mwen@igalia.com>
Link: https://patch.msgid.link/20260330-vc4-misc-fixes-v1-4-92defc940a29@igalia.com
Signed-off-by: Maíra Canal <mcanal@igalia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-06-01 17:35:02 +02:00

..

amd

drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink

2026-04-18 10:33:19 +02:00

arm

minmax: add in_range() macro

2025-10-19 16:21:28 +02:00

armada

drm/armada: Fix off-by-one error in armada_overlay_get_property()

2023-09-19 12:22:38 +02:00

aspeed

…

ast

drm/ast: dp501: Fix initialization of SCU2C

2026-04-18 10:33:32 +02:00

atmel-hlcdc

drm/atmel-hlcdc: fix use-after-free of drm_crtc_commit after release

2026-03-04 07:20:05 -05:00

bridge

drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts

2025-12-07 06:09:19 +09:00

etnaviv

drm/etnaviv: fix flush sequence logic

2025-12-07 06:09:14 +09:00

exynos

drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free

2026-04-18 10:33:18 +02:00

fsl-dcu

drm: fsl-dcu: enable PIXCLK on LS1021A

2024-12-14 19:50:55 +01:00

gma500

drm/gma500: Remove unused helper psb_fbdev_fb_setcolreg()

2026-01-19 13:10:11 +01:00

gud

…

hisilicon

drm/hisilicon/hibmc: fix the hibmc loaded failed bug

2025-08-28 16:24:38 +02:00

hyperv

…

i2c

…

i810

…

i915

drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat

2026-04-18 10:33:37 +02:00

imx

drm/imx/tve: fix probe device leak

2026-02-06 16:42:05 +01:00

ingenic

…

kmb

…

lib

…

lima

drm/lima: set gp bus_stop bit before hard reset

2024-09-04 13:23:24 +02:00

mcde

drm/mcde: Enable module autoloading

2024-12-14 19:51:36 +01:00

mediatek

drm/mediatek: Fix CCORR mtk_ctm_s31_32_to_s1_n function issue

2026-01-19 13:09:31 +01:00

meson

drm/meson: Use 1000ULL when operating with mode->clock

2025-06-27 11:05:22 +01:00

mga

…

mgag200

drm/mgag200: Set DDC timeout in milliseconds

2024-08-19 05:45:47 +02:00

msm

drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers

2026-01-19 13:10:03 +01:00

mxsfb

…

nouveau

nouveau/dpcd: return EBUSY for aux xfer if the device is asleep

2026-04-18 10:33:15 +02:00

omapdrm

drm/omap: Fix locking in omap_gem_new_dmabuf()

2024-12-14 19:50:51 +01:00

panel

drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel

2026-02-06 16:41:49 +01:00

panfrost

drm/panfrost: Remove unused id_mask from struct panfrost_model

2024-12-14 19:50:55 +01:00

pl111

drm/pl111: Fix error handling in pl111_amba_probe

2026-01-19 13:10:14 +01:00

qxl

drm/qxl: Add check for drm_cvt_mode

2024-08-19 05:45:02 +02:00

r128

…

radeon

drm/radeon: apply state adjust rules to some additional HAINAN vairants

2026-04-18 10:33:18 +02:00

rcar-du

drm: rcar-du: Fix memory leak in rcar_du_vsps_init()

2025-06-27 11:05:11 +01:00

rockchip

drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed

2025-08-28 16:24:07 +02:00

savage

…

scheduler

drm/sched: Fix race in drm_sched_entity_select_rq()

2025-12-07 06:09:15 +09:00

selftests

…

shmobile

…

sis

…

sti

drm: sti: fix device leaks at component probe

2025-12-07 06:09:36 +09:00

stm

drm/stm: Fix an error handling path in stm_drm_platform_probe()

2024-10-17 15:10:51 +02:00

sun4i

…

tdfx

…

tegra

drm/tegra: dsi: fix device leak on probe

2026-04-18 10:33:07 +02:00

tidss

drm/tidss: Set crtc modesetting parameters with adjusted mode

2025-12-07 06:09:18 +09:00

tilcdc

drm/tilcdc: Fix irq free on unload

2024-01-25 14:52:41 -08:00

tiny

drm/repaper: fix integer overflows in repeat functions

2025-05-02 07:44:14 +02:00

ttm

drm/ttm: Avoid NULL pointer deref for evicted BOs

2026-01-19 13:10:03 +01:00

tve200

…

udl

drm/udl: Unregister device before cleaning up on disconnect

2025-07-10 15:57:40 +02:00

v3d

drm/v3d: Set DMA segment size to avoid debug warnings

2026-03-04 07:20:02 -05:00

vboxvideo

drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA

2024-11-01 01:52:35 +01:00

vc4

drm/vc4: Protect madv read in vc4_gem_object_mmap() with madv_lock

2026-06-01 17:35:02 +02:00

vgem

drm/vgem-fence: Fix potential deadlock on release

2026-01-19 13:09:22 +01:00

via

…

virtio

…

vkms

drm/vkms: Adjust vkms_state->active_planes allocation type

2025-06-27 11:05:11 +01:00

vmwgfx

drm/vmwgfx: Fix an error return check in vmw_compat_shader_add()

2026-02-06 16:41:49 +01:00

xen

…

xlnx

drm: xlnx: zynqmp: Fix max dma segment size

2025-04-10 14:31:58 +02:00

zte

…

drm_agpsupport.c

…

drm_aperture.c

…

drm_atomic_helper.c

drm: Add valid clones check

2025-06-04 14:38:04 +02:00

drm_atomic_state_helper.c

…

drm_atomic_uapi.c

drm/atomic: Filter out redundant DPMS calls

2025-04-10 14:31:52 +02:00

drm_atomic.c

drm/atomic: Fix potential use-after-free in nonblocking commits

2023-07-23 13:47:58 +02:00

drm_auth.c

…

drm_blend.c

…

drm_bridge_connector.c

…

drm_bridge.c

…

drm_bufs.c

…

drm_cache.c

…

drm_client_modeset.c

drm/client: fix null pointer dereference in drm_client_modeset_probe

2024-08-19 05:45:43 +02:00

drm_client.c

…

drm_color_mgmt.c

minmax: add a few more MIN_T/MAX_T users

2025-10-19 16:21:52 +02:00

drm_connector.c

drm/atomic: Filter out redundant DPMS calls

2025-04-10 14:31:52 +02:00

drm_context.c

…

drm_crtc_helper_internal.h

…

drm_crtc_helper.c

…

drm_crtc_internal.h

…

drm_crtc.c

drm/crtc: fix uninitialized variable use even harder

2024-10-17 15:11:48 +02:00

drm_damage_helper.c

…

drm_debugfs_crc.c

…

drm_debugfs.c

…

drm_displayid.c

…

drm_dma.c

…

drm_dp_aux_bus.c

…

drm_dp_aux_dev.c

…

drm_dp_cec.c

gpu: drm_dp_cec: fix broken CEC adapter properties check

2025-03-13 12:50:22 +01:00

drm_dp_dual_mode_helper.c

…

drm_dp_helper.c

Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS"

2025-09-04 14:28:48 +02:00

drm_dp_mst_topology_internal.h

…

drm_dp_mst_topology.c

drm/dp_mst: Fix drm RAD print

2025-04-10 14:31:58 +02:00

drm_drv.c

drm/drv: propagate errors from drm_modeset_register_all()

2024-01-25 14:52:42 -08:00

drm_dsc.c

…

drm_dumb_buffers.c

…

drm_edid_load.c

…

drm_edid.c

drm/edid: fixed the bug that hdr metadata was not reset

2025-06-04 14:38:06 +02:00

drm_encoder_slave.c

…

drm_encoder.c

…

drm_fb_cma_helper.c

…

drm_fb_helper.c

drm/modeset: Handle tiled displays in pan_display_atomic.

2025-03-13 12:50:23 +01:00

drm_file.c

drm/drm_file: fix use of uninitialized variable

2024-02-23 08:54:46 +01:00

drm_flip_work.c

…

drm_format_helper.c

…

drm_fourcc.c

…

drm_framebuffer.c

drm/framebuffer: Fix use of uninitialized variable

2024-02-23 08:54:47 +01:00

drm_gem_atomic_helper.c

drm/sysfb: Do not dereference NULL pointer in plane reset

2025-12-07 06:09:15 +09:00

drm_gem_cma_helper.c

…

drm_gem_framebuffer_helper.c

…

drm_gem_shmem_helper.c

drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE)

2024-10-22 15:40:41 +02:00

drm_gem_ttm_helper.c

…

drm_gem_vram_helper.c

…

drm_gem.c

drm/gem: Fix race in drm_gem_handle_create_tail()

2025-07-17 18:30:49 +02:00

drm_hashtab.c

…

drm_hdcp.c

…

drm_internal.h

…

drm_ioc32.c

drm/ioc32: stop speculation on the drm_compat_ioctl path

2026-04-18 10:33:31 +02:00

drm_ioctl.c

…

drm_irq.c

…

drm_kms_helper_common.c

…

drm_lease.c

…

drm_legacy_misc.c

…

drm_legacy.h

…

drm_lock.c

…

drm_managed.c

…

drm_memory.c

…

drm_mipi_dbi.c

…

drm_mipi_dsi.c

Revert "drm/mipi-dsi: Set the fwnode for mipi_dsi_device"

2024-11-08 16:25:56 +01:00

drm_mm.c

drm/mm: Mark drm_mm_interval_tree*() functions with __maybe_unused

2024-12-14 19:50:51 +01:00

drm_mode_config.c

…

drm_mode_object.c

…

drm_modes.c

drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()

2025-01-09 13:28:33 +01:00

drm_modeset_helper.c

drm: Check output polling initialized before disabling

2024-06-16 13:39:53 +02:00

drm_modeset_lock.c

…

drm_of.c

…

drm_panel_orientation_quirks.c

drm: panel-orientation-quirks: Add new quirk for GPD Win 2

2025-05-02 07:43:57 +02:00

drm_panel.c

drm/bridge: panel: forbid initializing a panel with unknown connector type

2025-05-02 07:43:57 +02:00

drm_pci.c

…

drm_plane_helper.c

…

drm_plane.c

drm: Don't unref the same fb many times by mistake due to deadlock handling

2024-02-23 08:54:32 +01:00

drm_prime.c

drm/prime: Support page array >= 4GB

2024-02-23 08:55:07 +01:00

drm_print.c

drm/printer: Allow NULL data in devcoredump printer

2024-10-17 15:11:32 +02:00

drm_probe_helper.c

drm/probe-helper: Create a HPD IRQ event helper for a single connector

2025-03-13 12:50:48 +01:00

drm_property.c

drm: Account property blob allocations to memcg

2026-03-04 07:20:04 -05:00

drm_rect.c

…

drm_scatter.c

…

drm_scdc_helper.c

…

drm_self_refresh_helper.c

…

drm_simple_kms_helper.c

…

drm_syncobj.c

drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set

2024-03-01 13:22:00 +01:00

drm_sysfs.c

…

drm_trace_points.c

…

drm_trace.h

…

drm_vblank_work.c

…

drm_vblank.c

…

drm_vm.c

…

drm_vma_manager.c

…

drm_writeback.c

…

Kconfig

…

Makefile

…