https://github.com/torvalds/linux
Revision 1a6897921f52ceb2c8665ef826e405bd96385159 authored by Zack Rusin on 08 February 2023, 18:00:50 UTC, committed by Zack Rusin on 15 February 2023, 03:10:01 UTC
ttm_bo_init_reserved on failure puts the buffer object back which
causes it to be deleted, but kfree was still being called on the same
buffer in vmw_bo_create leading to a double free.
After the double free the vmw_gem_object_create_with_handle was
setting the gem function objects before checking the return status
of vmw_bo_create leading to null pointer access.
Fix the entire path by relaying on ttm_bo_init_reserved to delete the
buffer objects on failure and making sure the return status is checked
before setting the gem function objects on the buffer object.
Signed-off-by: Zack Rusin <zackr@vmware.com>
Fixes: 8afa13a0583f ("drm/vmwgfx: Implement DRIVER_GEM")
Reviewed-by: Maaz Mombasawala <mombasawalam@vmware.com>
Reviewed-by: Martin Krastev <krastevm@vmware.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230208180050.2093426-1-zack@kde.org
(cherry picked from commit 36d421e632e9a0e8375eaed0143551a34d81a7e3)
Cc: <stable@vger.kernel.org> # v5.17+
1 parent bb2ff6c
Tip revision: 1a6897921f52ceb2c8665ef826e405bd96385159 authored by Zack Rusin on 08 February 2023, 18:00:50 UTC
drm/vmwgfx: Stop accessing buffer objects which failed init
drm/vmwgfx: Stop accessing buffer objects which failed init
Tip revision: 1a68979
| File | Mode | Size |
|---|---|---|
| Documentation | ||
| LICENSES | ||
| arch | ||
| block | ||
| certs | ||
| crypto | ||
| drivers | ||
| fs | ||
| include | ||
| init | ||
| io_uring | ||
| ipc | ||
| kernel | ||
| lib | ||
| mm | ||
| net | ||
| rust | ||
| samples | ||
| scripts | ||
| security | ||
| sound | ||
| tools | ||
| usr | ||
| virt | ||
| .clang-format | -rw-r--r-- | 20.0 KB |
| .cocciconfig | -rw-r--r-- | 59 bytes |
| .get_maintainer.ignore | -rw-r--r-- | 151 bytes |
| .gitattributes | -rw-r--r-- | 62 bytes |
| .gitignore | -rw-r--r-- | 2.0 KB |
| .mailmap | -rw-r--r-- | 24.6 KB |
| .rustfmt.toml | -rw-r--r-- | 369 bytes |
| COPYING | -rw-r--r-- | 496 bytes |
| CREDITS | -rw-r--r-- | 99.3 KB |
| Kbuild | -rw-r--r-- | 2.5 KB |
| Kconfig | -rw-r--r-- | 555 bytes |
| MAINTAINERS | -rw-r--r-- | 681.1 KB |
| Makefile | -rw-r--r-- | 69.5 KB |
| README | -rw-r--r-- | 727 bytes |
Computing file changes ...
