Unverified Commit fbf393fa authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9923 drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zeng Heng <zengheng4@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/2XUQ2JC72HCEDVRPXPZ7YRAOW2Q7E5AF/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9FNEV 
 
Link:https://gitee.com/openeuler/kernel/pulls/9923

 

Reviewed-by: default avatarXie XiuQi <xiexiuqi@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 2902ea73 f103c36d

drivers/gpu/drm/drm_prime.c

+4 −2
Original line number Diff line number Diff line
@@ -724,11 +724,13 @@ int drm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma) 
	vma->vm_pgoff += drm_vma_node_start(&obj->vma_node);



	if (obj->funcs && obj->funcs->mmap) {

		drm_gem_object_get(obj);

		ret = obj->funcs->mmap(obj, vma);

		if (ret)

		if (ret) {

			drm_gem_object_put(obj);

			return ret;

		}

		vma->vm_private_data = obj;

		drm_gem_object_get(obj);

		return 0;

	}