diff options
author | Chris Wilson | 2018-11-20 21:24:38 +0100 |
---|---|---|
committer | Zhenyu Wang | 2018-11-21 10:31:56 +0100 |
commit | 7513edbc096a006f967eaf39088091442e623b83 (patch) | |
tree | 71b5cb3bbd66642d967cfc6730467246aa45ba5e /drivers/gpu/drm/i915/gvt | |
parent | drm/i915/gvt: ensure gpu is powered before do i915_gem_gtt_insert (diff) | |
download | kernel-qcow2-linux-7513edbc096a006f967eaf39088091442e623b83.tar.gz kernel-qcow2-linux-7513edbc096a006f967eaf39088091442e623b83.tar.xz kernel-qcow2-linux-7513edbc096a006f967eaf39088091442e623b83.zip |
drm/i915/gvt: Avoid use-after-free iterating the gtt list
Found by smatch:
drivers/gpu/drm/i915/gvt/gtt.c:2452 intel_vgpu_destroy_ggtt_mm() error: dereferencing freed memory 'pos'
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Zhenyu Wang <zhenyuw@linux.intel.com>
Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Diffstat (limited to 'drivers/gpu/drm/i915/gvt')
-rw-r--r-- | drivers/gpu/drm/i915/gvt/gtt.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c index 919de5a1bafb..3b32e69beac6 100644 --- a/drivers/gpu/drm/i915/gvt/gtt.c +++ b/drivers/gpu/drm/i915/gvt/gtt.c @@ -2443,10 +2443,11 @@ static void intel_vgpu_destroy_all_ppgtt_mm(struct intel_vgpu *vgpu) static void intel_vgpu_destroy_ggtt_mm(struct intel_vgpu *vgpu) { - struct intel_gvt_partial_pte *pos; + struct intel_gvt_partial_pte *pos, *next; - list_for_each_entry(pos, - &vgpu->gtt.ggtt_mm->ggtt_mm.partial_pte_list, list) { + list_for_each_entry_safe(pos, next, + &vgpu->gtt.ggtt_mm->ggtt_mm.partial_pte_list, + list) { gvt_dbg_mm("partial PTE update on hold 0x%lx : 0x%llx\n", pos->offset, pos->data); kfree(pos); |