Commit 5401b9ad authored by Linus Torvalds's avatar Linus Torvalds
Browse files

i915: don't use a vma that didn't match the context VM 



In eb_lookup_vma(), the code checks that the context vm matches before
incrementing the i915 vma usage count, but for the non-matching case it
didn't clear the non-matching vma pointer, so it would then mistakenly
be returned, causing potential UaF and refcount issues.

Reported-by: default avatarYassine Mounir <sosohero200@gmail.com>
Suggested-by: default avatarVille Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent eb3765aa

drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c

+2 −0
Original line number Diff line number Diff line
@@ -898,6 +898,8 @@ static struct i915_vma *eb_lookup_vma(struct i915_execbuffer *eb, u32 handle) 
		vma = radix_tree_lookup(&eb->gem_context->handles_vma, handle);

		if (likely(vma && vma->vm == vm))

			vma = i915_vma_tryget(vma);

		else

			vma = NULL;

		rcu_read_unlock();

		if (likely(vma))

			return vma;