Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
drm/shmem-helper: Remove another errant put in error path
drm_gem_shmem_mmap() doesn't own reference in error code path, resulting
in the dma-buf shmem GEM object getting prematurely freed leading to a
later use-after-free.
Fixes: f49a51bfdc8e ("drm/shme-helpers: Fix dma_buf_mmap forwarding bug")
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Reviewed-by: Rob Clark <robdclark@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230108211311.3950107-1-dmitry.osipenko@collabora.com
+6
-3
+6
-3
drivers/gpu/drm/drm_gem_shmem_helper.c
+6
-3
drivers/gpu/drm/drm_gem_shmem_helper.c
···
622
622
int ret;
623
623
624
624
if (obj->import_attach) {
625
-
/* Drop the reference drm_gem_mmap_obj() acquired.*/
626
-
drm_gem_object_put(obj);
627
625
vma->vm_private_data = NULL;
626
+
ret = dma_buf_mmap(obj->dma_buf, vma, 0);
628
627
629
-
return dma_buf_mmap(obj->dma_buf, vma, 0);
628
+
/* Drop the reference drm_gem_mmap_obj() acquired.*/
629
+
if (!ret)
630
+
drm_gem_object_put(obj);
631
+
632
+
return ret;
630
633
}
631
634
632
635
ret = drm_gem_shmem_get_pages(shmem);