Re: [PATCH] drm/panfrost: Fix a double-free error

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Jun 27, 2019 at 11:24 AM Boris Brezillon
<boris.brezillon@xxxxxxxxxxxxx> wrote:
>
> drm_gem_shmem_create_with_handle() returns a GEM object and attach a
> handle to it. When the user closes the DRM FD, the core releases all
> GEM handles along with their backing GEM objs, which can lead to a
> double-free issue if panfrost_ioctl_create_bo() failed and went
> through the err_free path where drm_gem_object_put_unlocked() is
> called without deleting the associate handle.
>
> Replace this drm_gem_object_put_unlocked() call by a
> drm_gem_handle_delete() one to fix that.
>
> Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver")
> Cc: <stable@xxxxxxxxxxxxxxx>
> Signed-off-by: Boris Brezillon <boris.brezillon@xxxxxxxxxxxxx>
> ---
> Reproduced for real when BO mapping fails because we ran out of
> memory.
> ---
>  drivers/gpu/drm/panfrost/panfrost_drv.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Applied to drm-misc-fixes.

Rob



[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux