Unverified Commit 5bc2c7cb authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!4411 v2 drm/atomic: Fix potential use-after-free in nonblocking commits 

Merge Pull Request from: @ci-robot 
 
PR sync from: Guo Mengqi <guomengqi3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/4OPQGMANJJWNNMGA2VWRNIDSYJ24VT5Q/ 
 
https://gitee.com/src-openeuler/kernel/issues/I8YD5O 
 
Link:https://gitee.com/openeuler/kernel/pulls/4411

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents c06633e4 33811fb3

drivers/gpu/drm/drm_atomic.c

+10 −1
Original line number Diff line number Diff line
@@ -91,6 +91,12 @@ drm_atomic_state_init(struct drm_device *dev, struct drm_atomic_state *state) 
	if (!state->planes)

		goto fail;



	/*

	 * Because drm_atomic_state can be committed asynchronously we need our

	 * own reference and cannot rely on the on implied by drm_file in the

	 * ioctl call.

	 */

	drm_dev_get(dev);

	state->dev = dev;



	DRM_DEBUG_ATOMIC("Allocated atomic state %p\n", state);
@@ -250,7 +256,8 @@ EXPORT_SYMBOL(drm_atomic_state_clear); 
void __drm_atomic_state_free(struct kref *ref)

{

	struct drm_atomic_state *state = container_of(ref, typeof(*state), ref);

	struct drm_mode_config *config = &state->dev->mode_config;

	struct drm_device *dev = state->dev;

	struct drm_mode_config *config = &dev->mode_config;



	drm_atomic_state_clear(state);
@@ -262,6 +269,8 @@ void __drm_atomic_state_free(struct kref *ref) 
		drm_atomic_state_default_release(state);

		kfree(state);

	}



	drm_dev_put(dev);

}

EXPORT_SYMBOL(__drm_atomic_state_free);