Greg, I emailed a backport as per this request. Please let me know if there is anything additional we need to do or something we need to do differently to get this in stable. Thanks, Thomas On 10/17/2015 10:29 PM, gregkh@xxxxxxxxxxxxxxxxxxx wrote: > The patch below does not apply to the 4.2-stable tree. > If someone wants it applied there, or to any other stable or longterm > tree, then please email the backport, including the original git commit > id to <stable@xxxxxxxxxxxxxxx>. > > thanks, > > greg k-h > > ------------------ original commit in Linus's tree ------------------ > > From 54c12bc374408faddbff75dbf1a6167c19af39c4 Mon Sep 17 00:00:00 2001 > From: Thomas Hellstrom <thellstrom@xxxxxxxxxx> > Date: Mon, 14 Sep 2015 01:13:11 -0700 > Subject: [PATCH] drm/vmwgfx: Fix up user_dmabuf refcounting > > If user space calls unreference on a user_dmabuf it will typically > kill the struct ttm_base_object member which is responsible for the > user-space visibility. However the dmabuf part may still be alive and > refcounted. In some situations, like for shared guest-backed surface > referencing/opening, the driver may try to reference the > struct ttm_base_object member again, causing an immediate kernel warning > and a later kernel NULL pointer dereference. > > Fix this by always maintaining a reference on the struct > ttm_base_object member, in situations where it might subsequently be > referenced. > > Cc: <stable@xxxxxxxxxxxxxxx> > Signed-off-by: Thomas Hellstrom <thellstrom@xxxxxxxxxx> > Reviewed-by: Brian Paul <brianp@xxxxxxxxxx> > Reviewed-by: Sinclair Yeh <syeh@xxxxxxxxxx> > > -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html