mirrors/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-02-07 04:10:29 -05:00
Code Issues Packages Projects Releases Wiki Activity

drm/i915/gvt: Avoid use-after-free iterating the gtt list

Browse Source 
Found by smatch:

drivers/gpu/drm/i915/gvt/gtt.c:2452 intel_vgpu_destroy_ggtt_mm() error: dereferencing freed memory 'pos'

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Zhenyu Wang <zhenyuw@linux.intel.com>
Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
This commit is contained in:
Chris Wilson
2018-11-20 20:24:38 +00:00
committed by Zhenyu Wang
parent f3be657d96
commit 7513edbc09
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/gpu/drm/i915/gvt/gtt.c
View File

@@ -2443,10 +2443,11 @@ static void intel_vgpu_destroy_all_ppgtt_mm(struct intel_vgpu *vgpu)
static void intel_vgpu_destroy_ggtt_mm(struct intel_vgpu *vgpu)
{
struct intel_gvt_partial_pte *pos;
struct intel_gvt_partial_pte *pos, *next;
list_for_each_entry(pos,
&vgpu->gtt.ggtt_mm->ggtt_mm.partial_pte_list, list) {
list_for_each_entry_safe(pos, next,
&vgpu->gtt.ggtt_mm->ggtt_mm.partial_pte_list,
list) {
gvt_dbg_mm("partial PTE update on hold 0x%lx : 0x%llx\n",
pos->offset, pos->data);
kfree(pos);