Eric Biggers eb1e552524 drm/vgem: fix use-after-free when drm_gem_handle_create() fails ... commit 21d2b12273 upstream. If drm_gem_handle_create() fails in vgem_gem_create(), then the drm_vgem_gem_object is freed twice: once when the reference is dropped by drm_gem_object_put_unlocked(), and again by __vgem_gem_destroy(). This was hit by syzkaller using fault injection. Fix it by skipping the second free. Reported-by: syzbot+e73f2fb5ed5a5df36d33@syzkaller.appspotmail.com Fixes: af33a9190d ("drm/vgem: Enable dmabuf import interfaces") Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Laura Abbott <labbott@redhat.com> Cc: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers <ebiggers@google.com> Acked-by: Laura Abbott <labbott@redhat.com> Signed-off-by: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com> Link: https://patchwork.freedesktop.org/patch/msgid/20190226214451.195123-1-ebiggers@kernel.org Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-04-03 06:26:26 +02:00
..
Makefile	drm/vgem: remove unneeded -Iinclude/drm compiler flag	2017-05-18 07:13:59 +02:00
vgem_drv.c	drm/vgem: fix use-after-free when drm_gem_handle_create() fails	2019-04-03 06:26:26 +02:00
vgem_drv.h	drm/vgem: Pin our pages for dmabuf exports	2017-06-23 13:04:22 +02:00
vgem_fence.c	treewide: setup_timer() -> timer_setup()	2017-11-21 15:57:07 -08:00