mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2025-01-05 21:35:04 +08:00
drm/i915: Use after free in error path in intel_vgpu_create_workload()
We can't free "workload" until after the printk or it's a use after
free.
Fixes: 2089a76ade
("drm/i915/gvt: Checking workload's gma earlier")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
This commit is contained in:
parent
4187414808
commit
eac4471d08
@ -1528,9 +1528,9 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id,
|
||||
if (!intel_gvt_ggtt_validate_range(vgpu,
|
||||
workload->wa_ctx.indirect_ctx.guest_gma,
|
||||
workload->wa_ctx.indirect_ctx.size)) {
|
||||
kmem_cache_free(s->workloads, workload);
|
||||
gvt_vgpu_err("invalid wa_ctx at: 0x%lx\n",
|
||||
workload->wa_ctx.indirect_ctx.guest_gma);
|
||||
kmem_cache_free(s->workloads, workload);
|
||||
return ERR_PTR(-EINVAL);
|
||||
}
|
||||
}
|
||||
@ -1542,9 +1542,9 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id,
|
||||
if (!intel_gvt_ggtt_validate_range(vgpu,
|
||||
workload->wa_ctx.per_ctx.guest_gma,
|
||||
CACHELINE_BYTES)) {
|
||||
kmem_cache_free(s->workloads, workload);
|
||||
gvt_vgpu_err("invalid per_ctx at: 0x%lx\n",
|
||||
workload->wa_ctx.per_ctx.guest_gma);
|
||||
kmem_cache_free(s->workloads, workload);
|
||||
return ERR_PTR(-EINVAL);
|
||||
}
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user