Commit eac4471d authored by Dan Carpenter's avatar Dan Carpenter Committed by Zhenyu Wang

drm/i915: Use after free in error path in intel_vgpu_create_workload()

We can't free "workload" until after the printk or it's a use after
free.

Fixes: 2089a76a ("drm/i915/gvt: Checking workload's gma earlier")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: default avatarZhenyu Wang <zhenyuw@linux.intel.com>
parent 41874148
...@@ -1528,9 +1528,9 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id, ...@@ -1528,9 +1528,9 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id,
if (!intel_gvt_ggtt_validate_range(vgpu, if (!intel_gvt_ggtt_validate_range(vgpu,
workload->wa_ctx.indirect_ctx.guest_gma, workload->wa_ctx.indirect_ctx.guest_gma,
workload->wa_ctx.indirect_ctx.size)) { workload->wa_ctx.indirect_ctx.size)) {
kmem_cache_free(s->workloads, workload);
gvt_vgpu_err("invalid wa_ctx at: 0x%lx\n", gvt_vgpu_err("invalid wa_ctx at: 0x%lx\n",
workload->wa_ctx.indirect_ctx.guest_gma); workload->wa_ctx.indirect_ctx.guest_gma);
kmem_cache_free(s->workloads, workload);
return ERR_PTR(-EINVAL); return ERR_PTR(-EINVAL);
} }
} }
...@@ -1542,9 +1542,9 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id, ...@@ -1542,9 +1542,9 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id,
if (!intel_gvt_ggtt_validate_range(vgpu, if (!intel_gvt_ggtt_validate_range(vgpu,
workload->wa_ctx.per_ctx.guest_gma, workload->wa_ctx.per_ctx.guest_gma,
CACHELINE_BYTES)) { CACHELINE_BYTES)) {
kmem_cache_free(s->workloads, workload);
gvt_vgpu_err("invalid per_ctx at: 0x%lx\n", gvt_vgpu_err("invalid per_ctx at: 0x%lx\n",
workload->wa_ctx.per_ctx.guest_gma); workload->wa_ctx.per_ctx.guest_gma);
kmem_cache_free(s->workloads, workload);
return ERR_PTR(-EINVAL); return ERR_PTR(-EINVAL);
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment