diff options
| author | Chris Wilson <chris@chris-wilson.co.uk> | 2018-11-20 20:24:38 +0000 |
|---|---|---|
| committer | Zhenyu Wang <zhenyuw@linux.intel.com> | 2018-11-21 17:31:56 +0800 |
| commit | 7513edbc096a006f967eaf39088091442e623b83 (patch) | |
| tree | 71b5cb3bbd66642d967cfc6730467246aa45ba5e | |
| parent | f3be657d96b0709c832b165501170f072882df3c (diff) | |
drm/i915/gvt: Avoid use-after-free iterating the gtt list
Found by smatch:
drivers/gpu/drm/i915/gvt/gtt.c:2452 intel_vgpu_destroy_ggtt_mm() error: dereferencing freed memory 'pos'
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Zhenyu Wang <zhenyuw@linux.intel.com>
Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
| -rw-r--r-- | drivers/gpu/drm/i915/gvt/gtt.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c index 919de5a1bafb..3b32e69beac6 100644 --- a/drivers/gpu/drm/i915/gvt/gtt.c +++ b/drivers/gpu/drm/i915/gvt/gtt.c @@ -2443,10 +2443,11 @@ static void intel_vgpu_destroy_all_ppgtt_mm(struct intel_vgpu *vgpu) static void intel_vgpu_destroy_ggtt_mm(struct intel_vgpu *vgpu) { - struct intel_gvt_partial_pte *pos; + struct intel_gvt_partial_pte *pos, *next; - list_for_each_entry(pos, - &vgpu->gtt.ggtt_mm->ggtt_mm.partial_pte_list, list) { + list_for_each_entry_safe(pos, next, + &vgpu->gtt.ggtt_mm->ggtt_mm.partial_pte_list, + list) { gvt_dbg_mm("partial PTE update on hold 0x%lx : 0x%llx\n", pos->offset, pos->data); kfree(pos); |