Two independent small fixes found by static analysis:
1/2: gen6_ppgtt_create() stored the result of gen6_alloc_top_pd()
directly into ppgtt->base.pd; on failure the ERR_PTR stayed in the
field and the async release worker crashed dereferencing it in
gen6_ppgtt_free_pd(). v2 follows the local-variable pattern
suggested by Ville: assign to the field only after validation, so
it can only ever be NULL or a valid pointer, and
gen6_ppgtt_free_pd() now bails out on a NULL pd.
2/2: i915_perf_add_config_ioctl() creates the dynamic sysfs entry
before idr_alloc(); if idr_alloc() fails the error path frees the
config without removing the sysfs entry, leaving attributes that
point into freed memory (UAF read via the embedded show()
callback). Remove the group on that path, mirroring the remove
ioctl's ordering. Unchanged since v1.
Signed-off-by: Chengyu Liu <[email protected]>
---
v2:
- 1/2: don't assign the error pointer into ppgtt->base.pd at all
- 2/2: unchanged
v1: https://lore.kernel.org/r/[email protected]
Chengyu Liu (2):
i915/gt: don't store ERR_PTR into ppgtt->base.pd on allocation failure
i915/perf: remove sysfs entry if idr_alloc() fails in add_config
drivers/gpu/drm/i915/gt/gen6_ppgtt.c | 11 ++++++++---
drivers/gpu/drm/i915/i915_perf.c | 1 +
2 files changed, 9 insertions(+), 3 deletions(-)
--
2.25.1
