Commit ee9adb7a authored by Dmitry Osipenko's avatar Dmitry Osipenko
Browse files

drm/shmem-helper: Remove another errant put in error path 



drm_gem_shmem_mmap() doesn't own reference in error code path, resulting
in the dma-buf shmem GEM object getting prematurely freed leading to a
later use-after-free.

Fixes: f49a51bf ("drm/shme-helpers: Fix dma_buf_mmap forwarding bug")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDmitry Osipenko <dmitry.osipenko@collabora.com>
Reviewed-by: default avatarRob Clark <robdclark@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230108211311.3950107-1-dmitry.osipenko@collabora.com
parent a54bace0

drivers/gpu/drm/drm_gem_shmem_helper.c

+6 −3
Original line number Diff line number Diff line
@@ -622,11 +622,14 @@ int drm_gem_shmem_mmap(struct drm_gem_shmem_object *shmem, struct vm_area_struct 
	int ret;



	if (obj->import_attach) {

		vma->vm_private_data = NULL;

		ret = dma_buf_mmap(obj->dma_buf, vma, 0);



		/* Drop the reference drm_gem_mmap_obj() acquired.*/

		if (!ret)

			drm_gem_object_put(obj);

		vma->vm_private_data = NULL;



		return dma_buf_mmap(obj->dma_buf, vma, 0);

		return ret;

	}



	ret = drm_gem_shmem_get_pages(shmem);