[PATCH v18 22/26] drm/shmem-helper: Don't free refcounted GEM

[Dmitry Osipenko]

Don't free refcounted shmem object to prevent use-after-free bug that
is worse than a memory leak.

Signed-off-by: Dmitry Osipenko <dmitry.osipe...@collabora.com>
---
 drivers/gpu/drm/drm_gem_shmem_helper.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c 
b/drivers/gpu/drm/drm_gem_shmem_helper.c
index 6dd087f19ea3..4253c367dc07 100644
--- a/drivers/gpu/drm/drm_gem_shmem_helper.c
+++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
@@ -203,9 +203,10 @@ void drm_gem_shmem_free(struct drm_gem_shmem_object *shmem)
        if (obj->import_attach)
                drm_prime_gem_destroy(obj, shmem->sgt);
 
-       drm_WARN_ON(obj->dev, refcount_read(&shmem->vmap_use_count));
-       drm_WARN_ON(obj->dev, refcount_read(&shmem->pages_use_count));
-       drm_WARN_ON(obj->dev, refcount_read(&shmem->pages_pin_count));
+       if (drm_WARN_ON(obj->dev, refcount_read(&shmem->vmap_use_count)) ||
+           drm_WARN_ON(obj->dev, refcount_read(&shmem->pages_use_count)) ||
+           drm_WARN_ON(obj->dev, refcount_read(&shmem->pages_pin_count)))
+               return;
 
        drm_gem_object_release(obj);
        kfree(shmem);
-- 
2.41.0