]> git.baikalelectronics.ru Git - kernel.git/commit
drm/panfrost: Fix a double-free error
authorBoris Brezillon <boris.brezillon@collabora.com>
Thu, 27 Jun 2019 17:24:14 +0000 (19:24 +0200)
committerRob Herring <robh@kernel.org>
Fri, 28 Jun 2019 22:45:51 +0000 (16:45 -0600)
commitfec85488daa26a4a3a4e01dbde9aea6ff6cdef86
tree1fada45149073102e0cd827677da41f13f27a167
parent98b1022a7038beabc58c314c491c56887a068237
drm/panfrost: Fix a double-free error

drm_gem_shmem_create_with_handle() returns a GEM object and attach a
handle to it. When the user closes the DRM FD, the core releases all
GEM handles along with their backing GEM objs, which can lead to a
double-free issue if panfrost_ioctl_create_bo() failed and went
through the err_free path where drm_gem_object_put_unlocked() is
called without deleting the associate handle.

Replace this drm_gem_object_put_unlocked() call by a
drm_gem_handle_delete() one to fix that.

Fixes: 0bd01550c49d ("drm/panfrost: Add initial panfrost driver")
Cc: <stable@vger.kernel.org>
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Signed-off-by: Rob Herring <robh@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20190627172414.27231-1-boris.brezillon@collabora.com
drivers/gpu/drm/panfrost/panfrost_drv.c