lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 784/917] drm/nouveau/svm: Fix refcount leak bug and missing check against null bug
    Date
    From: Chenyuan Mi <cymi20@fudan.edu.cn>

    [ Upstream commit 6bb8c2d51811eb5e6504f49efe3b089d026009d2 ]

    The reference counting issue happens in one exception handling path of
    nouveau_svmm_bind(). When cli->svm.svmm is null, the function forgets
    to decrease the refcount of mm increased by get_task_mm(), causing a
    refcount leak.

    Fix this issue by using mmput() to decrease the refcount in the
    exception handling path.

    Also, the function forgets to do check against null when get mm
    by get_task_mm().

    Fix this issue by adding null check after get mm by get_task_mm().

    Signed-off-by: Chenyuan Mi <cymi20@fudan.edu.cn>
    Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
    Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
    Fixes: 822cab6150d3 ("drm/nouveau/svm: check for SVM initialized before migrating")
    Reviewed-by: Lyude Paul <lyude@redhat.com>
    Reviewed-by: Ben Skeggs <bskeggs@redhat.com>
    Reviewed-by: Karol Herbst <kherbst@redhat.com>
    Signed-off-by: Karol Herbst <kherbst@redhat.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20210907122633.16665-1-cymi20@fudan.edu.cn
    Link: https://gitlab.freedesktop.org/drm/nouveau/-/merge_requests/14
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/gpu/drm/nouveau/nouveau_svm.c | 4 ++++
    1 file changed, 4 insertions(+)

    diff --git a/drivers/gpu/drm/nouveau/nouveau_svm.c b/drivers/gpu/drm/nouveau/nouveau_svm.c
    index b0c3422cb01fa..9985bfde015a6 100644
    --- a/drivers/gpu/drm/nouveau/nouveau_svm.c
    +++ b/drivers/gpu/drm/nouveau/nouveau_svm.c
    @@ -162,10 +162,14 @@ nouveau_svmm_bind(struct drm_device *dev, void *data,
    */

    mm = get_task_mm(current);
    + if (!mm) {
    + return -EINVAL;
    + }
    mmap_read_lock(mm);

    if (!cli->svm.svmm) {
    mmap_read_unlock(mm);
    + mmput(mm);
    return -EINVAL;
    }

    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-16 01:10    [W:4.019 / U:0.412 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site