leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

drm/i915/gem: Prevent NULL pointer dereference on missing ctx->vm

Browse Source 
If the ctx->vm is freed before we can acquire a local reference to it,
we proceed to call i915_vm_put(NULL), which is invalid.

Reported-by: Colin Ian King <colin.king@canonical.com>
Fixes: 5dbd2b7be6 ("drm/i915/gem: Convert vm idr to xarray")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200123152602.1432282-1-chris@chris-wilson.co.uk
This commit is contained in:
Chris Wilson 2020-01-23 15:26:02 +00:00
parent 423177140e
commit 90211ea4ba
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/gpu/drm/i915/gem/i915_gem_context.c
View File

@ -1002,13 +1002,13 @@ static int get_ppgtt(struct drm_i915_file_private *file_priv,
if (!rcu_access_pointer(ctx->vm))
return -ENODEV;
err = -ENODEV;
rcu_read_lock();
vm = context_get_vm_rcu(ctx);
if (vm)
err = xa_alloc(&file_priv->vm_xa, &id, vm,
xa_limit_32b, GFP_KERNEL);
rcu_read_unlock();
if (!vm)
return -ENODEV;
err = xa_alloc(&file_priv->vm_xa, &id, vm, xa_limit_32b, GFP_KERNEL);
if (err)
goto err_put;