mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 07:03:28 -04:00
Code Issues Packages Projects Releases Wiki Activity

drm/vmwgfx: skip hash_del_rcu when validation context has no hash table

Browse Source 
vmw_validation_add_resource() calls hash_add_rcu() only when
ctx->sw_context is non-NULL, but the doomed-resource error path calls
hash_del_rcu() unconditionally.  The validation contexts declared with
DECLARE_VAL_CONTEXT(_, NULL, 0) in vmwgfx_kms.c, vmwgfx_scrn.c,
vmwgfx_stdu.c and vmwgfx_execbuf.c consequently reach a delete for a
node that was never added to any hash chain.

That is harmless today, but only incidentally so.  hash_del_rcu() is
hlist_del_init_rcu(), which is guarded by hlist_unhashed(), and
vmw_validation_mem_alloc() hands out memory from __GFP_ZERO pages that
are never recycled within a context's lifetime, so
node->hash.head.pprev is always NULL and the delete does nothing.
Neither property is apparent at the call site, and the asymmetry with
the add side invites a real bug the first time either one changes.

Mirror the condition from the add side so the node is only unlinked
when it was actually linked.  No functional change.

Assisted-by: Claude:claude-opus-4.7
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Reviewed-by: Ian Forbes <ian.forbes@broadcom.com>
Link: https://patch.msgid.link/20260505222728.519626-11-zack.rusin@broadcom.com
This commit is contained in:
Zack Rusin
2026-05-05 18:22:31 -04:00
parent d5ed874916
commit e5c3e484e0
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/gpu/drm/vmwgfx/vmwgfx_validation.c
View File

@@ -309,7 +309,8 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx,
}
node->res = vmw_resource_reference_unless_doomed(res);
if (!node->res) {
hash_del_rcu(&node->hash.head);
if (ctx->sw_context)
hash_del_rcu(&node->hash.head);
return -ESRCH;
}