A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 04:12:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

drm/vmwgfx: Fix Use-after-free in validation

Browse source 
[ Upstream commit dfe1323ab3c8a4dd5625ebfdba44dc47df84512a ]

Nodes stored in the validation duplicates hashtable come from an arena
allocator that is cleared at the end of vmw_execbuf_process. All nodes
are expected to be cleared in vmw_validation_drop_ht but this node escaped
because its resource was destroyed prematurely.

Fixes: 64ad2abfe9 ("drm/vmwgfx: Adapt validation code for reference-free lookups")
Reported-by: Kuzey Arda Bulut <kuzeyardabulut@gmail.com>
Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
Reviewed-by: Zack Rusin <zack.rusin@broadcom.com>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://lore.kernel.org/r/20250926195427.1405237-1-ian.forbes@broadcom.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Ian Forbes 2025-09-26 14:54:25 -05:00 • committed by Greg Kroah-Hartman
commit 1822e5287b
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
View file

@ -339,8 +339,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx,
}
}
node->res = vmw_resource_reference_unless_doomed(res);
if (!node->res)
if (!node->res) {
hash_del_rcu(&node->hash.head);
return -ESRCH;
}
node->first_usage = 1;
if (!res->dev_priv->has_mob) {