Unverified Commit a60664c9 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!4421 v2 drm/atomic: Fix potential use-after-free in nonblocking commits 

Merge Pull Request from: @ci-robot 
 
PR sync from: Guo Mengqi <guomengqi3@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/ZDPIORGKLD6DAKXNUN2VOJXVKSAOWYYU/ 
 
https://gitee.com/src-openeuler/kernel/issues/I8YD5O 
 
Link:https://gitee.com/openeuler/kernel/pulls/4421

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 7d0404f2 331c661d

drivers/gpu/drm/drm_atomic.c

+10 −1
Original line number Diff line number Diff line
@@ -98,6 +98,12 @@ drm_atomic_state_init(struct drm_device *dev, struct drm_atomic_state *state) 
	if (!state->planes)

		goto fail;



	/*

	 * Because drm_atomic_state can be committed asynchronously we need our

	 * own reference and cannot rely on the on implied by drm_file in the

	 * ioctl call.

	 */

	drm_dev_get(dev);

	state->dev = dev;



	DRM_DEBUG_ATOMIC("Allocated atomic state %p\n", state);
@@ -257,7 +263,8 @@ EXPORT_SYMBOL(drm_atomic_state_clear); 
void __drm_atomic_state_free(struct kref *ref)

{

	struct drm_atomic_state *state = container_of(ref, typeof(*state), ref);

	struct drm_mode_config *config = &state->dev->mode_config;

	struct drm_device *dev = state->dev;

	struct drm_mode_config *config = &dev->mode_config;



	drm_atomic_state_clear(state);
@@ -269,6 +276,8 @@ void __drm_atomic_state_free(struct kref *ref) 
		drm_atomic_state_default_release(state);

		kfree(state);

	}



	drm_dev_put(dev);

}

EXPORT_SYMBOL(__drm_atomic_state_free);