• Thomas Hellstrom's avatar
    drm/vmwgfx: Fix up user_dmabuf refcounting · 54c12bc3
    Thomas Hellstrom authored
    If user space calls unreference on a user_dmabuf it will typically
    kill the struct ttm_base_object member which is responsible for the
    user-space visibility. However the dmabuf part may still be alive and
    refcounted. In some situations, like for shared guest-backed surface
    referencing/opening, the driver may try to reference the
    struct ttm_base_object member again, causing an immediate kernel warning
    and a later kernel NULL pointer dereference.
    
    Fix this by always maintaining a reference on the struct
    ttm_base_object member, in situations where it might subsequently be
    referenced.
    
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
    Reviewed-by: default avatarBrian Paul <brianp@vmware.com>
    Reviewed-by: default avatarSinclair Yeh <syeh@vmware.com>
    54c12bc3
vmwgfx_drv.h 37.2 KB