Commit fa6a7b2b authored by Danilo Krummrich's avatar Danilo Krummrich Committed by Chen Jun
Browse files

drm/nouveau: prime: fix refcount underflow 

stable inclusion
from stable-v5.10.224
commit 906372e753c5027a1dc88743843b6aa2ad1aaecf
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALCQI
CVE: CVE-2024-43867

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=906372e753c5027a1dc88743843b6aa2ad1aaecf



--------------------------------

[ Upstream commit a9bf3efc33f1fbf88787a277f7349459283c9b95 ]

Calling nouveau_bo_ref() on a nouveau_bo without initializing it (and
hence the backing ttm_bo) leads to a refcount underflow.

Instead of calling nouveau_bo_ref() in the unwind path of
drm_gem_object_init(), clean things up manually.

Fixes: ab9ccb96 ("drm/nouveau: use prime helpers")
Reviewed-by: default avatarBen Skeggs <bskeggs@nvidia.com>
Reviewed-by: default avatarChristian König <christian.koenig@amd.com>
Signed-off-by: default avatarDanilo Krummrich <dakr@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20240718165959.3983-2-dakr@kernel.org


(cherry picked from commit 1b93f3e89d03cfc576636e195466a0d728ad8de5)
Signed-off-by: default avatarDanilo Krummrich <dakr@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarChen Jun <chenjun102@huawei.com>
parent 31421c83

drivers/gpu/drm/nouveau/nouveau_prime.c

+2 −1
Original line number Diff line number Diff line
@@ -81,7 +81,8 @@ struct drm_gem_object *nouveau_gem_prime_import_sg_table(struct drm_device *dev, 
	 * to the caller, instead of a normal nouveau_bo ttm reference. */

	ret = drm_gem_object_init(dev, &nvbo->bo.base, size);

	if (ret) {

		nouveau_bo_ref(NULL, &nvbo);

		drm_gem_object_release(&nvbo->bo.base);

		kfree(nvbo);

		obj = ERR_PTR(-ENOMEM);

		goto unlock;

	}