diff options
| author |   Chris Wilson <chris@chris-wilson.co.uk> | 2020-05-20 15:23:47 +0100 |
|---|---|---|
| committer | Chris Wilson <chris@chris-wilson.co.uk> | 2020-05-20 17:05:07 +0100 |
| commit | 0e799e840a07e9cd843149be6811fd895d20a5a0 (patch) | |
| tree | d0010e781476a8ffadbc571dc82aa721841f6228 /include/drm/drm_gem.h | |
| parent | dma-fence: add might_sleep annotation to _wait() (diff) | |
| download | wireguard-linux-0e799e840a07e9cd843149be6811fd895d20a5a0.tar.xz wireguard-linux-0e799e840a07e9cd843149be6811fd895d20a5a0.zip | |
drm: Restore the NULL check for drm_gem_object_put()
Some users want to pass NULL to drm_gem_object_put(), but those using
__drm_gem_object_put() did not. Compromise, have both and let the
compiler sort it out.
drm_gem_fb_destroy() calls drm_gem_object_put() with NULL obj causing:
[ 11.584209] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 11.584213] #PF: supervisor write access in kernel mode
[ 11.584215] #PF: error_code(0x0002) - not-present page
[ 11.584216] PGD 0 P4D 0
[ 11.584220] Oops: 0002 [#1] SMP NOPTI
[ 11.584223] CPU: 7 PID: 1571 Comm: gnome-shell Tainted: G E 5.7.0-rc1-1-default+ #27
[ 11.584225] Hardware name: Micro-Star International Co., Ltd. MS-7A31/X370 XPOWER GAMING TITANIUM (MS-7A31), BIOS 1.MR 12/03/2019
[ 11.584237] RIP: 0010:drm_gem_fb_destroy+0x28/0x70 [drm_kms_helper]
<snip>
[ 11.584256] Call Trace:
[ 11.584279] drm_mode_rmfb+0x189/0x1c0 [drm]
[ 11.584299] ? drm_mode_rmfb+0x1c0/0x1c0 [drm]
[ 11.584314] drm_ioctl_kernel+0xaa/0xf0 [drm]
[ 11.584329] drm_ioctl+0x1ff/0x3b0 [drm]
[ 11.584347] ? drm_mode_rmfb+0x1c0/0x1c0 [drm]
[ 11.584421] amdgpu_drm_ioctl+0x49/0x80 [amdgpu]
[ 11.584427] ksys_ioctl+0x87/0xc0
[ 11.584430] __x64_sys_ioctl+0x16/0x20
[ 11.584434] do_syscall_64+0x5f/0x240
[ 11.584438] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 11.584440] RIP: 0033:0x7f0ef80f7227
Reported-by: Nirmoy Das <nirmoy.das@amd.com>
Fixes: b5d250744ccc ("drm/gem: fold drm_gem_object_put_unlocked and __drm_gem_object_put()")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Nirmoy Das <nirmoy.das@amd.com>
Cc: Emil Velikov <emil.velikov@collabora.com>
Cc: Christian König <christian.koenig@amd.com>.
Acked-by: Nirmoy Das <nirmoy.das@amd.com>
Reviewed-by: Emil Velikov <emil.velikov@collabora.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200520142347.29060-1-chris@chris-wilson.co.uk
Diffstat (limited to 'include/drm/drm_gem.h')
| -rw-r--r-- | include/drm/drm_gem.h | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h index 52173abdf500..2410ff0a8e86 100644 --- a/include/drm/drm_gem.h +++ b/include/drm/drm_gem.h @@ -363,6 +363,13 @@ static inline void drm_gem_object_get(struct drm_gem_object *obj) kref_get(&obj->refcount); } +__attribute__((nonnull)) +static inline void +__drm_gem_object_put(struct drm_gem_object *obj) +{ + kref_put(&obj->refcount, drm_gem_object_free); +} + /** * drm_gem_object_put - drop a GEM buffer object reference * @obj: GEM buffer object @@ -372,7 +379,8 @@ static inline void drm_gem_object_get(struct drm_gem_object *obj) static inline void drm_gem_object_put(struct drm_gem_object *obj) { - kref_put(&obj->refcount, drm_gem_object_free); + if (obj) + __drm_gem_object_put(obj); } void drm_gem_object_put_locked(struct drm_gem_object *obj); |