From 90211ea4ba6e8066f827434e67678cb80f51ba58 Mon Sep 17 00:00:00 2001 From: Chris Wilson Date: Thu, 23 Jan 2020 15:26:02 +0000 Subject: [PATCH] drm/i915/gem: Prevent NULL pointer dereference on missing ctx->vm If the ctx->vm is freed before we can acquire a local reference to it, we proceed to call i915_vm_put(NULL), which is invalid. Reported-by: Colin Ian King Fixes: 5dbd2b7be61e ("drm/i915/gem: Convert vm idr to xarray") Signed-off-by: Chris Wilson Cc: Colin Ian King Reviewed-by: Joonas Lahtinen Link: https://patchwork.freedesktop.org/patch/msgid/20200123152602.1432282-1-chris@chris-wilson.co.uk --- drivers/gpu/drm/i915/gem/i915_gem_context.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_context.c b/drivers/gpu/drm/i915/gem/i915_gem_context.c index 5d4157e1ccf7..a67c2e1b9412 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_context.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c @@ -1002,13 +1002,13 @@ static int get_ppgtt(struct drm_i915_file_private *file_priv, if (!rcu_access_pointer(ctx->vm)) return -ENODEV; - err = -ENODEV; rcu_read_lock(); vm = context_get_vm_rcu(ctx); - if (vm) - err = xa_alloc(&file_priv->vm_xa, &id, vm, - xa_limit_32b, GFP_KERNEL); rcu_read_unlock(); + if (!vm) + return -ENODEV; + + err = xa_alloc(&file_priv->vm_xa, &id, vm, xa_limit_32b, GFP_KERNEL); if (err) goto err_put; -- 2.25.1