diff options
| author | Thomas Hellstrom <thellstrom@vmware.com> | 2015-09-14 01:13:11 -0700 |
|---|---|---|
| committer | Thomas Hellstrom <thellstrom@vmware.com> | 2015-09-14 01:13:11 -0700 |
| commit | 54c12bc374408faddbff75dbf1a6167c19af39c4 (patch) | |
| tree | 15f78c5ccbc97a04aab1b0612c59626e0608d66f /drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c | |
| parent | 9fbcc7c007ea200357e2453c6b2b153646fbc165 (diff) | |
drm/vmwgfx: Fix up user_dmabuf refcounting
If user space calls unreference on a user_dmabuf it will typically
kill the struct ttm_base_object member which is responsible for the
user-space visibility. However the dmabuf part may still be alive and
refcounted. In some situations, like for shared guest-backed surface
referencing/opening, the driver may try to reference the
struct ttm_base_object member again, causing an immediate kernel warning
and a later kernel NULL pointer dereference.
Fix this by always maintaining a reference on the struct
ttm_base_object member, in situations where it might subsequently be
referenced.
Cc: <stable@vger.kernel.org>
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Brian Paul <brianp@vmware.com>
Reviewed-by: Sinclair Yeh <syeh@vmware.com>
Diffstat (limited to 'drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c')
| -rw-r--r-- | drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c b/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c index 76069f093ccf..222c9c2123a1 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_overlay.c @@ -484,7 +484,7 @@ int vmw_overlay_ioctl(struct drm_device *dev, void *data, goto out_unlock; } - ret = vmw_user_dmabuf_lookup(tfile, arg->handle, &buf); + ret = vmw_user_dmabuf_lookup(tfile, arg->handle, &buf, NULL); if (ret) goto out_unlock; |