Messages in this thread | | | From | Rob Clark <> | Date | Thu, 16 Feb 2023 07:35:32 -0800 | Subject | Re: [PATCH v1] drm/shmem-helper: Remove another errant put in error path |
| |
On Sun, Jan 8, 2023 at 1:13 PM Dmitry Osipenko <dmitry.osipenko@collabora.com> wrote: > > drm_gem_shmem_mmap() doesn't own reference in error code path, resulting > in the dma-buf shmem GEM object getting prematurely freed leading to a > later use-after-free. > > Fixes: f49a51bfdc8e ("drm/shme-helpers: Fix dma_buf_mmap forwarding bug") > Cc: stable@vger.kernel.org > Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Reviewed-by: Rob Clark <robdclark@gmail.com>
> --- > drivers/gpu/drm/drm_gem_shmem_helper.c | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c > index f21f47737817..8b20b41497e8 100644 > --- a/drivers/gpu/drm/drm_gem_shmem_helper.c > +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c > @@ -624,11 +624,14 @@ int drm_gem_shmem_mmap(struct drm_gem_shmem_object *shmem, struct vm_area_struct > int ret; > > if (obj->import_attach) { > - /* Drop the reference drm_gem_mmap_obj() acquired.*/ > - drm_gem_object_put(obj); > vma->vm_private_data = NULL; > + ret = dma_buf_mmap(obj->dma_buf, vma, 0); > + > + /* Drop the reference drm_gem_mmap_obj() acquired.*/ > + if (!ret) > + drm_gem_object_put(obj); > > - return dma_buf_mmap(obj->dma_buf, vma, 0); > + return ret; > } > > ret = drm_gem_shmem_get_pages(shmem); > -- > 2.38.1 >
| |