Two independent small fixes found by static analysis:
1/2: gen6_ppgtt_create() stores an ERR_PTR in ppgtt->base.pd when
gen6_alloc_top_pd() fails; the teardown path
(gen6_ppgtt_cleanup -> gen6_ppgtt_free_pd) dereferences it and
crashes in the async release worker. Guard both teardown sites
with IS_ERR_OR_NULL() so an allocation failure under memory
pressure stays a plain -ENOMEM.
2/2: i915_perf_add_config_ioctl() creates the dynamic sysfs entry
before idr_alloc(); if idr_alloc() fails the error path frees the
config without removing the sysfs entry, leaving attributes that
point into freed memory (UAF read via the embedded show()
callback). Remove the group on that path, mirroring the remove
ioctl's ordering.
Signed-off-by: Chengyu Liu <[email protected]>
---
Chengyu Liu (2):
i915/gt: tolerate ERR_PTR pd in gen6_ppgtt teardown
i915/perf: remove sysfs entry if idr_alloc() fails in add_config
drivers/gpu/drm/i915/gt/gen6_ppgtt.c | 5 ++++-
drivers/gpu/drm/i915/i915_perf.c | 1 +
2 files changed, 5 insertions(+), 1 deletion(-)
--
2.25.1
