admin/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2025-12-07 20:06:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

drm/virtio: Fix NULL pointer deref in virtgpu_dma_buf_free_obj()

Browse Source 
There is a chance that obj->dma_buf would be NULL by the time
virtgpu_dma_buf_free_obj() is called. This can happen for imported
prime objects, when drm_gem_object_exported_dma_buf_free() gets
called on them before drm_gem_object_free(). This is because
drm_gem_object_exported_dma_buf_free() explicitly sets
obj->dma_buf to NULL.

Therefore, fix this issue by storing the dma_buf pointer in the
virtio_gpu_object instance and using it in virtgpu_dma_buf_free_obj.
This stored pointer is guaranteed to be valid until the object is
freed as we took a reference on it in virtgpu_gem_prime_import().

Fixes: 415cb45895 ("drm/virtio: Use dma_buf from GEM object instance")
Cc: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Vivek Kasireddy <vivek.kasireddy@intel.com>
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Link: https://lore.kernel.org/r/20250501232419.180337-1-vivek.kasireddy@intel.com
This commit is contained in:
Vivek Kasireddy
2025-05-01 16:24:19 -07:00
committed by Dmitry Osipenko
parent 9b8f32002c
commit 44b6535d8a
2 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/gpu/drm/virtio/virtgpu_drv.h
View File

@@ -88,6 +88,7 @@ struct virtio_gpu_object_params {
struct virtio_gpu_object {
struct drm_gem_shmem_object base;
struct dma_buf *dma_buf;
struct sg_table *sgt;
uint32_t hw_res_handle;
bool dumb;

3
drivers/gpu/drm/virtio/virtgpu_prime.c
View File

@@ -206,7 +206,7 @@ static void virtgpu_dma_buf_free_obj(struct drm_gem_object *obj)
struct virtio_gpu_device *vgdev = obj->dev->dev_private;
if (drm_gem_is_imported(obj)) {
struct dma_buf *dmabuf = obj->dma_buf;
struct dma_buf *dmabuf = bo->dma_buf;
dma_resv_lock(dmabuf->resv, NULL);
virtgpu_dma_buf_unmap(bo);
@@ -332,6 +332,7 @@ struct drm_gem_object *virtgpu_gem_prime_import(struct drm_device *dev,
obj->import_attach = attach;
get_dma_buf(buf);
bo->dma_buf = buf;
ret = virtgpu_dma_buf_init_obj(dev, bo, attach);
if (ret < 0)