Messages in this thread | | | From | Chris Wilson <> | Subject | Re: [PATCH][next] drm/i915/gem: fix null pointer dereference on vm | Date | Thu, 23 Jan 2020 15:24:43 +0000 |
| |
Quoting Colin King (2020-01-23 15:14:06) > From: Colin Ian King <colin.king@canonical.com> > > Currently if the call to function context_get_vm_rcu returns > a null pointer for vm then the error exit path via label err_put > will call i915_vm_put on the null vm, causing a null pointer > dereference. Fix this by adding a null check on vm and returning > without calling the i915_vm_put. > > Fixes: 5dbd2b7be61e ("drm/i915/gem: Convert vm idr to xarray") > Signed-off-by: Colin Ian King <colin.king@canonical.com>
Hmm. Actually, we can drop the rcu_read_lock as soon as we've acquire the local ref to ctx->vm. So something like,
if (!rcu_access_pointer(ctx->vm)) return -ENODEV;
- err = -ENODEV; rcu_read_lock(); vm = context_get_vm_rcu(ctx); - if (vm) - err = xa_alloc(&file_priv->vm_xa, &id, vm, - xa_limit_32b, GFP_KERNEL); rcu_read_unlock(); + if (!vm) + return -ENODEV; + + err = xa_alloc(&file_priv->vm_xa, &id, vm, + xa_limit_32b, GFP_KERNEL); if (err) goto err_put;
would work. -Chris
| |