[Intel-gfx] [PATCH v5] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry

2022-12-21 Thread Zheng Wang
If intel_gvt_dma_map_guest_page failed, it will call ppgtt_invalidate_spt, which will finally free the spt. But the caller function ppgtt_populate_spt_by_guest_entry does not notice that, it will free spt again in its error path. Fix this by undoing the mapping of DMA address and freeing sub_sp

Re: [Intel-gfx] [PATCH v5] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry

2022-12-20 Thread Zheng Hacker
Zhenyu Wang 于2022年12月21日周三 11:01写道: > > On 2022.12.20 17:40:14 +0800, Zheng Wang wrote: > > If intel_gvt_dma_map_guest_page failed, it will call > > ppgtt_invalidate_spt, which will finally free the spt. But the > > caller function ppgtt_populate_spt_by_guest_entry does not notice > > that, it

Re: [Intel-gfx] [PATCH v5] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry

2022-12-20 Thread Zhenyu Wang
On 2022.12.20 17:40:14 +0800, Zheng Wang wrote: > If intel_gvt_dma_map_guest_page failed, it will call > ppgtt_invalidate_spt, which will finally free the spt. But the > caller function ppgtt_populate_spt_by_guest_entry does not notice > that, it will free spt again in its error path. indent >