diff options
| author | Dmitry Osipenko <dmitry.osipenko@collabora.com> | 2023-01-09 00:13:11 +0300 |
|---|---|---|
| committer | Dmitry Osipenko <dmitry.osipenko@collabora.com> | 2023-02-27 02:39:52 +0300 |
| commit | ee9adb7a45516cfa536ca92253d7ae59d56db9e4 (patch) | |
| tree | 953886f9f2af99d4cab06ef244f422be6501b6a5 /drivers/gpu | |
| parent | a54bace095d00e9222161495649688bc43de4dde (diff) | |
| download | lwn-ee9adb7a45516cfa536ca92253d7ae59d56db9e4.tar.gz lwn-ee9adb7a45516cfa536ca92253d7ae59d56db9e4.zip | |
drm/shmem-helper: Remove another errant put in error path
drm_gem_shmem_mmap() doesn't own reference in error code path, resulting
in the dma-buf shmem GEM object getting prematurely freed leading to a
later use-after-free.
Fixes: f49a51bfdc8e ("drm/shme-helpers: Fix dma_buf_mmap forwarding bug")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Reviewed-by: Rob Clark <robdclark@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230108211311.3950107-1-dmitry.osipenko@collabora.com
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/drm/drm_gem_shmem_helper.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c index b602cd72a120..1a681de9a6ea 100644 --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -622,11 +622,14 @@ int drm_gem_shmem_mmap(struct drm_gem_shmem_object *shmem, struct vm_area_struct int ret; if (obj->import_attach) { - /* Drop the reference drm_gem_mmap_obj() acquired.*/ - drm_gem_object_put(obj); vma->vm_private_data = NULL; + ret = dma_buf_mmap(obj->dma_buf, vma, 0); + + /* Drop the reference drm_gem_mmap_obj() acquired.*/ + if (!ret) + drm_gem_object_put(obj); - return dma_buf_mmap(obj->dma_buf, vma, 0); + return ret; } ret = drm_gem_shmem_get_pages(shmem); |