All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm/i915/gvt: fix dropping obj reference twice
@ 2019-11-06  7:31 ` Pan Bian
  0 siblings, 0 replies; 10+ messages in thread
From: Pan Bian @ 2019-11-06  7:31 UTC (permalink / raw)
  To: Zhenyu Wang, Zhi Wang, Jani Nikula, Joonas Lahtinen,
	Rodrigo Vivi, David Airlie, Daniel Vetter
  Cc: intel-gvt-dev, intel-gfx, dri-devel, linux-kernel, Pan Bian

The reference count of obj will be decremented twice if error occurs
in dma_buf_fd(). Additionally, attempting to read the reference count of
obj after dropping reference may lead to a use after free bug. Here, we
drop obj's reference until it is not used.

Signed-off-by: Pan Bian <bianpan2016@163.com>
---
 drivers/gpu/drm/i915/gvt/dmabuf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c
index 13044c027f27..4bfaefdf548d 100644
--- a/drivers/gpu/drm/i915/gvt/dmabuf.c
+++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
@@ -498,8 +498,6 @@ int intel_vgpu_get_dmabuf(struct intel_vgpu *vgpu, unsigned int dmabuf_id)
 		goto out_free_gem;
 	}
 
-	i915_gem_object_put(obj);
-
 	ret = dma_buf_fd(dmabuf, DRM_CLOEXEC | DRM_RDWR);
 	if (ret < 0) {
 		gvt_vgpu_err("create dma-buf fd failed ret:%d\n", ret);
@@ -524,6 +522,8 @@ int intel_vgpu_get_dmabuf(struct intel_vgpu *vgpu, unsigned int dmabuf_id)
 		    file_count(dmabuf->file),
 		    kref_read(&obj->base.refcount));
 
+	i915_gem_object_put(obj);
+
 	return dmabuf_fd;
 
 out_free_dmabuf:
-- 
2.7.4


^ permalink raw reply related	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2019-11-08  0:02 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-06  7:31 [PATCH] drm/i915/gvt: fix dropping obj reference twice Pan Bian
2019-11-06  7:31 ` [Intel-gfx] " Pan Bian
2019-11-06  7:31 ` Pan Bian
2019-11-06  8:43 ` Zhenyu Wang
2019-11-06  8:43   ` [Intel-gfx] " Zhenyu Wang
2019-11-06  8:43   ` Zhenyu Wang
2019-11-06 22:27 ` ✓ Fi.CI.BAT: success for " Patchwork
2019-11-06 22:27   ` [Intel-gfx] " Patchwork
2019-11-08  0:02 ` ✓ Fi.CI.IGT: " Patchwork
2019-11-08  0:02   ` [Intel-gfx] " Patchwork

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.