diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2020-01-23 18:26:02 +0300 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2020-01-24 13:22:08 +0300 |
| commit | 90211ea4ba6e8066f827434e67678cb80f51ba58 (patch) | |
| tree | c145acf3d700a013a07202a5bdae2a44d8797995 /drivers/gpu/drm/i915/gem/i915_gem_context.c | |
| parent | 423177140e9fcbd2ee5fef3845d4623f4ec31ed8 (diff) | |
| download | linux-90211ea4ba6e8066f827434e67678cb80f51ba58.tar.xz | |
drm/i915/gem: Prevent NULL pointer dereference on missing ctx->vm
If the ctx->vm is freed before we can acquire a local reference to it,
we proceed to call i915_vm_put(NULL), which is invalid.
Reported-by: Colin Ian King <colin.king@canonical.com>
Fixes: 5dbd2b7be61e ("drm/i915/gem: Convert vm idr to xarray")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200123152602.1432282-1-chris@chris-wilson.co.uk
Diffstat (limited to 'drivers/gpu/drm/i915/gem/i915_gem_context.c')
| -rw-r--r-- | drivers/gpu/drm/i915/gem/i915_gem_context.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/gpu/drm/i915/gem/i915_gem_context.c b/drivers/gpu/drm/i915/gem/i915_gem_context.c index 5d4157e1ccf7..a67c2e1b9412 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_context.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c @@ -1002,13 +1002,13 @@ static int get_ppgtt(struct drm_i915_file_private *file_priv, if (!rcu_access_pointer(ctx->vm)) return -ENODEV; - err = -ENODEV; rcu_read_lock(); vm = context_get_vm_rcu(ctx); - if (vm) - err = xa_alloc(&file_priv->vm_xa, &id, vm, - xa_limit_32b, GFP_KERNEL); rcu_read_unlock(); + if (!vm) + return -ENODEV; + + err = xa_alloc(&file_priv->vm_xa, &id, vm, xa_limit_32b, GFP_KERNEL); if (err) goto err_put; |