On 2/16/23 18:35, Rob Clark wrote:
> On Sun, Jan 8, 2023 at 1:13 PM Dmitry Osipenko
> <dmitry.osipenko@xxxxxxxxxxxxx> wrote:
>>
>> drm_gem_shmem_mmap() doesn't own reference in error code path, resulting
>> in the dma-buf shmem GEM object getting prematurely freed leading to a
>> later use-after-free.
>>
>> Fixes: f49a51bfdc8e ("drm/shme-helpers: Fix dma_buf_mmap forwarding bug")
>> Cc: stable@xxxxxxxxxxxxxxx
>> Signed-off-by: Dmitry Osipenko <dmitry.osipenko@xxxxxxxxxxxxx>
>
> Reviewed-by: Rob Clark <robdclark@xxxxxxxxx>
Applied to misc-fixes
--
Best regards,
Dmitry
