diff options
| author | Dave Airlie <airlied@redhat.com> | 2025-10-11 06:17:06 +1000 |
|---|---|---|
| committer | Dave Airlie <airlied@redhat.com> | 2025-10-11 06:17:13 +1000 |
| commit | 5ca5f00a167cdd28bcfeeae6ddd370b13ac00a2a (patch) | |
| tree | f86f00b3e19667f9b636bcaa007d63b0e1b65393 /drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | |
| parent | e5f0a698b34ed76002dc5cff3804a61c80233a7a (diff) | |
| parent | e4bea919584ff292c9156cf7d641a2ab3cbe27b0 (diff) | |
Merge tag 'drm-misc-fixes-2025-10-09' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes
Short summary of fixes pull:
nouveau:
- Return errno code from TTM move helper
vmwgfx:
- Fix null-ptr access in cursor code
- Fix UAF in validation
- Use correct iterator in validation
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://lore.kernel.org/r/20251009120004.GA17570@linux.fritz.box
Diffstat (limited to 'drivers/gpu/drm/vmwgfx/vmwgfx_validation.c')
| -rw-r--r-- | drivers/gpu/drm/vmwgfx/vmwgfx_validation.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c index 7ee93e7191c7..35dc94c3db39 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.c @@ -308,8 +308,10 @@ int vmw_validation_add_resource(struct vmw_validation_context *ctx, hash_add_rcu(ctx->sw_context->res_ht, &node->hash.head, node->hash.key); } node->res = vmw_resource_reference_unless_doomed(res); - if (!node->res) + if (!node->res) { + hash_del_rcu(&node->hash.head); return -ESRCH; + } node->first_usage = 1; if (!res->dev_priv->has_mob) { @@ -636,7 +638,7 @@ void vmw_validation_drop_ht(struct vmw_validation_context *ctx) hash_del_rcu(&val->hash.head); list_for_each_entry(val, &ctx->resource_ctx_list, head) - hash_del_rcu(&entry->hash.head); + hash_del_rcu(&val->hash.head); ctx->sw_context = NULL; } |