Quoting Colin King (2020-01-23 15:14:06)
> From: Colin Ian King <colin.king@xxxxxxxxxxxxx>
>
> Currently if the call to function context_get_vm_rcu returns
> a null pointer for vm then the error exit path via label err_put
> will call i915_vm_put on the null vm, causing a null pointer
> dereference. Fix this by adding a null check on vm and returning
> without calling the i915_vm_put.
>
> Fixes: 5dbd2b7be61e ("drm/i915/gem: Convert vm idr to xarray")
> Signed-off-by: Colin Ian King <colin.king@xxxxxxxxxxxxx>
Hmm. Actually, we can drop the rcu_read_lock as soon as we've acquire
the local ref to ctx->vm. So something like,
if (!rcu_access_pointer(ctx->vm))
return -ENODEV;
- err = -ENODEV;
rcu_read_lock();
vm = context_get_vm_rcu(ctx);
- if (vm)
- err = xa_alloc(&file_priv->vm_xa, &id, vm,
- xa_limit_32b, GFP_KERNEL);
rcu_read_unlock();
+ if (!vm)
+ return -ENODEV;
+
+ err = xa_alloc(&file_priv->vm_xa, &id, vm,
+ xa_limit_32b, GFP_KERNEL);
if (err)
goto err_put;
would work.
-Chris
