Commit 262417d4 authored by Rob Clark's avatar Rob Clark Committed by sanglipeng
Browse files

drm/shmem-helper: Remove errant put in error path

stable inclusion
from stable-v5.10.159
commit 6a4da05acd062ae7774b6b19cef2b7d922902d36
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7NTXH

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6a4da05acd062ae7774b6b19cef2b7d922902d36

--------------------------------

commit 24013314 upstream.

drm_gem_shmem_mmap() doesn't own this reference, resulting in the GEM
object getting prematurely freed leading to a later use-after-free.

Link: https://syzkaller.appspot.com/bug?extid=c8ae65286134dd1b800d


Reported-by: default avatar <syzbot+c8ae65286134dd1b800d@syzkaller.appspotmail.com>
Fixes: 2194a63a ("drm: Add library for shmem backed GEM objects")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20221130185748.357410-2-robdclark@gmail.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarsanglipeng <sanglipeng1@jd.com>
parent 3e14b151
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment