| From 21dedfd718a3b28db67206ae78d7e0f1dab5ee48 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 18 Jul 2024 18:58:46 +0200 |
| Subject: drm/nouveau: prime: fix refcount underflow |
| MIME-Version: 1.0 |
| Content-Type: text/plain; charset=UTF-8 |
| Content-Transfer-Encoding: 8bit |
| |
| From: Danilo Krummrich <dakr@kernel.org> |
| |
| [ Upstream commit a9bf3efc33f1fbf88787a277f7349459283c9b95 ] |
| |
| Calling nouveau_bo_ref() on a nouveau_bo without initializing it (and |
| hence the backing ttm_bo) leads to a refcount underflow. |
| |
| Instead of calling nouveau_bo_ref() in the unwind path of |
| drm_gem_object_init(), clean things up manually. |
| |
| Fixes: ab9ccb96a6e6 ("drm/nouveau: use prime helpers") |
| Reviewed-by: Ben Skeggs <bskeggs@nvidia.com> |
| Reviewed-by: Christian Kรถnig <christian.koenig@amd.com> |
| Signed-off-by: Danilo Krummrich <dakr@kernel.org> |
| Link: https://patchwork.freedesktop.org/patch/msgid/20240718165959.3983-2-dakr@kernel.org |
| (cherry picked from commit 1b93f3e89d03cfc576636e195466a0d728ad8de5) |
| Signed-off-by: Danilo Krummrich <dakr@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/gpu/drm/nouveau/nouveau_prime.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/drivers/gpu/drm/nouveau/nouveau_prime.c b/drivers/gpu/drm/nouveau/nouveau_prime.c |
| index 25cbe4ef383bd..ea7cd8aee68f6 100644 |
| --- a/drivers/gpu/drm/nouveau/nouveau_prime.c |
| +++ b/drivers/gpu/drm/nouveau/nouveau_prime.c |
| @@ -83,7 +83,8 @@ struct drm_gem_object *nouveau_gem_prime_import_sg_table(struct drm_device *dev, |
| * to the caller, instead of a normal nouveau_bo ttm reference. */ |
| ret = drm_gem_object_init(dev, &nvbo->bo.base, size); |
| if (ret) { |
| - nouveau_bo_ref(NULL, &nvbo); |
| + drm_gem_object_release(&nvbo->bo.base); |
| + kfree(nvbo); |
| obj = ERR_PTR(-ENOMEM); |
| goto unlock; |
| } |
| -- |
| 2.43.0 |
| |
