[Intel-gfx] [RESEND PATCH v4] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry

2022-12-21 Thread Zheng Wang
If intel_gvt_dma_map_guest_page failed, it will call ppgtt_invalidate_spt, which will finally free the spt. But the caller does not notice that, it will free spt again in error path. Fix this by undoing the mapping of DMA address and freeing sub_spt. Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M

Re: [Intel-gfx] [RESEND PATCH v4] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry

2022-12-20 Thread Zheng Hacker
Zhenyu Wang 于2022年12月20日周二 16:25写道: > > On 2022.12.19 20:52:04 +0800, Zheng Wang wrote: > > If intel_gvt_dma_map_guest_page failed, it will call > > ppgtt_invalidate_spt, which will finally free the spt. But the caller does > > not notice that, it will free spt again in error path. > > > > It's

Re: [Intel-gfx] [RESEND PATCH v4] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry

2022-12-20 Thread Zhenyu Wang
On 2022.12.19 20:52:04 +0800, Zheng Wang wrote: > If intel_gvt_dma_map_guest_page failed, it will call > ppgtt_invalidate_spt, which will finally free the spt. But the caller does > not notice that, it will free spt again in error path. > It's not clear from this description which caller is