Commit a7806243 authored by Dmitry Osipenko's avatar Dmitry Osipenko Committed by sanglipeng
Browse files

drm/shmem-helper: Remove another errant put in error path 

stable inclusion
from stable-v5.10.176
commit 684c7372bbd6447c2e86a2a84e97a1478604d21f
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I87BGI

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=684c7372bbd6447c2e86a2a84e97a1478604d21f



--------------------------------

commit ee9adb7a upstream.

drm_gem_shmem_mmap() doesn't own reference in error code path, resulting
in the dma-buf shmem GEM object getting prematurely freed leading to a
later use-after-free.

Fixes: f49a51bf ("drm/shme-helpers: Fix dma_buf_mmap forwarding bug")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDmitry Osipenko <dmitry.osipenko@collabora.com>
Reviewed-by: default avatarRob Clark <robdclark@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230108211311.3950107-1-dmitry.osipenko@collabora.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarsanglipeng <sanglipeng1@jd.com>
parent f9a9f98a

drivers/gpu/drm/drm_gem_shmem_helper.c

+6 −3
Original line number Diff line number Diff line
@@ -614,11 +614,14 @@ int drm_gem_shmem_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma) 
	int ret;



	if (obj->import_attach) {

		vma->vm_private_data = NULL;

		ret = dma_buf_mmap(obj->dma_buf, vma, 0);



		/* Drop the reference drm_gem_mmap_obj() acquired.*/

		if (!ret)

			drm_gem_object_put(obj);

		vma->vm_private_data = NULL;



		return dma_buf_mmap(obj->dma_buf, vma, 0);

		return ret;

	}



	shmem = to_drm_gem_shmem_obj(obj);