[PATCH] drm/i915/gvt: Fix orphan vgpu dmabuf_objs' lifetime
Zhenyu Wang
zhenyuw at linux.intel.com
Tue Feb 25 07:36:48 UTC 2020
On 2/25/2020 1:35 PM, Tina Zhang wrote:
> Deleting dmabuf item's list head after releasing its container can lead
> to KASAN-reported issue:
>
> BUG: KASAN: use-after-free in __list_del_entry_valid+0x15/0xf0
> Read of size 8 at addr ffff88818a4598a8 by task kworker/u8:3/13119
>
> So fix this issue by puting deleting dmabuf_objs ahead of releasing its
> container.
>
> Fixes: dfb6ae4e14bd6 ("drm/i915/gvt: Handle orphan dmabuf_objs")
> Signed-off-by: Tina Zhang <tina.zhang at intel.com>
> ---
> drivers/gpu/drm/i915/gvt/dmabuf.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c
> index b854bd243e11..526ae0a0b66e 100644
> --- a/drivers/gpu/drm/i915/gvt/dmabuf.c
> +++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
> @@ -151,12 +151,12 @@ static void dmabuf_gem_object_free(struct kref *kref)
> dmabuf_obj = container_of(pos,
> struct intel_vgpu_dmabuf_obj, list);
> if (dmabuf_obj == obj) {
> + list_del(pos);
> intel_gvt_hypervisor_put_vfio_device(vgpu);
> idr_remove(&vgpu->object_idr,
> dmabuf_obj->dmabuf_id);
> kfree(dmabuf_obj->info);
> kfree(dmabuf_obj);
> - list_del(pos);
> break;
> }
> }
Reviewed-by: Zhenyu Wang <zhenyuw at linux.intel.com>
thanks
More information about the intel-gvt-dev
mailing list