On 02/26, Eric Biggers wrote: > From: Eric Biggers <[email protected]> > > If drm_gem_handle_create() fails in vkms_gem_create(), then the > vkms_gem_object is freed twice: once when the reference is dropped by > drm_gem_object_put_unlocked(), and again by the extra calls to > drm_gem_object_release() and kfree(). > > Fix it by skipping the second release and free. > > This bug was originally found in the vgem driver by syzkaller using > fault injection, but I noticed it's also present in the vkms driver. > > Fixes: 559e50fd34d1 ("drm/vkms: Add dumb operations") > Cc: Rodrigo Siqueira <[email protected]> > Cc: Haneen Mohammed <[email protected]> > Cc: Daniel Vetter <[email protected]> > Cc: Chris Wilson <[email protected]> > Cc: [email protected] > Signed-off-by: Eric Biggers <[email protected]> > --- > drivers/gpu/drm/vkms/vkms_gem.c | 5 +---- > 1 file changed, 1 insertion(+), 4 deletions(-) > > diff --git a/drivers/gpu/drm/vkms/vkms_gem.c b/drivers/gpu/drm/vkms/vkms_gem.c > index 138b0bb325cf9..69048e73377dc 100644 > --- a/drivers/gpu/drm/vkms/vkms_gem.c > +++ b/drivers/gpu/drm/vkms/vkms_gem.c > @@ -111,11 +111,8 @@ struct drm_gem_object *vkms_gem_create(struct drm_device > *dev, > > ret = drm_gem_handle_create(file, &obj->gem, handle); > drm_gem_object_put_unlocked(&obj->gem); > - if (ret) { > - drm_gem_object_release(&obj->gem); > - kfree(obj); > + if (ret) > return ERR_PTR(ret); > - } > > return &obj->gem; > } > -- > 2.21.0.rc2.261.ga7da99ff1b-goog >
Hi, Thanks for your patch! :) The patch looks good for me. I also tested it under the IGT tests on my local VM and everything was fine. Reviewed-by: Rodrigo Siqueira <[email protected]> -- Rodrigo Siqueira https://siqueira.tech Graduate Student Department of Computer Science University of São Paulo
signature.asc
Description: PGP signature
_______________________________________________ dri-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/dri-devel
