]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
drm/vmwgfx: Stop accessing buffer objects which failed init
authorZack Rusin <zackr@vmware.com>
Wed, 8 Feb 2023 18:00:50 +0000 (13:00 -0500)
committerZack Rusin <zackr@vmware.com>
Wed, 15 Feb 2023 03:10:01 +0000 (22:10 -0500)
commit1a6897921f52ceb2c8665ef826e405bd96385159
tree8d654d1618a085429f33ac9dd89e7843449e4ea7
parentbb2ff6c27bc9e1da4d3ec5e7b1d6b9df1092cb5a
drm/vmwgfx: Stop accessing buffer objects which failed init

ttm_bo_init_reserved on failure puts the buffer object back which
causes it to be deleted, but kfree was still being called on the same
buffer in vmw_bo_create leading to a double free.

After the double free the vmw_gem_object_create_with_handle was
setting the gem function objects before checking the return status
of vmw_bo_create leading to null pointer access.

Fix the entire path by relaying on ttm_bo_init_reserved to delete the
buffer objects on failure and making sure the return status is checked
before setting the gem function objects on the buffer object.

Signed-off-by: Zack Rusin <zackr@vmware.com>
Fixes: 8afa13a0583f ("drm/vmwgfx: Implement DRIVER_GEM")
Reviewed-by: Maaz Mombasawala <mombasawalam@vmware.com>
Reviewed-by: Martin Krastev <krastevm@vmware.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230208180050.2093426-1-zack@kde.org
(cherry picked from commit 36d421e632e9a0e8375eaed0143551a34d81a7e3)
Cc: <stable@vger.kernel.org> # v5.17+
drivers/gpu/drm/vmwgfx/vmwgfx_bo.c
drivers/gpu/drm/vmwgfx/vmwgfx_gem.c