Applied. Thanks! On Mon, Jun 5, 2023 at 4:13 AM Christian König <christian.koenig@xxxxxxx> wrote: > > Am 03.06.23 um 09:43 schrieb Min Li: > > Userspace can race to free the gobj(robj converted from), robj should not > > be accessed again after drm_gem_object_put, otherwith it will result in > > use-after-free. > > > > Signed-off-by: Min Li <lm0963hack@xxxxxxxxx> > > Reviewed-by: Christian König <christian.koenig@xxxxxxx> > > > --- > > Changes in v2: > > - Remove unused robj, avoid compile complain > > > > drivers/gpu/drm/radeon/radeon_gem.c | 4 +--- > > 1 file changed, 1 insertion(+), 3 deletions(-) > > > > diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c > > index bdc5af23f005..d3f5ddbc1704 100644 > > --- a/drivers/gpu/drm/radeon/radeon_gem.c > > +++ b/drivers/gpu/drm/radeon/radeon_gem.c > > @@ -459,7 +459,6 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data, > > struct radeon_device *rdev = dev->dev_private; > > struct drm_radeon_gem_set_domain *args = data; > > struct drm_gem_object *gobj; > > - struct radeon_bo *robj; > > int r; > > > > /* for now if someone requests domain CPU - > > @@ -472,13 +471,12 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data, > > up_read(&rdev->exclusive_lock); > > return -ENOENT; > > } > > - robj = gem_to_radeon_bo(gobj); > > > > r = radeon_gem_set_domain(gobj, args->read_domains, args->write_domain); > > > > drm_gem_object_put(gobj); > > up_read(&rdev->exclusive_lock); > > - r = radeon_gem_handle_lockup(robj->rdev, r); > > + r = radeon_gem_handle_lockup(rdev, r); > > return r; > > } > > >
