Re: [PATCH] drm: fix double free for gbo in drm_gem_vram_init and drm_gem_vram_create

Thanks for your suggestion, I can make the patch. But the problem is reported by tool "Hulk Robot" and only happen one time. No scripts are left, so I have no exact environment to test. On 2020/7/1 14:56, Thomas Zimmermann wrote: > Hi > > Thanks for the patch and apologies for being late with th

Re: [PATCH] drm: fix double free for gbo in drm_gem_vram_init and drm_gem_vram_create

Hi Thanks for the patch and apologies for being late with the review. The fix is good, but I'd like to see different approach. I'd rather have drm_gem_vram_init() being integrated into drm_gem_vram_create(). Do you prefer to make the patch or shall I type up something? Would you be able to test?

Re: [PATCH] drm: fix double free for gbo in drm_gem_vram_init and drm_gem_vram_create

Ping... On 2020/6/20 14:21, Jia Yang wrote: > I got a use-after-free report when doing some fuzz test: > > If ttm_bo_init() fails, the "gbo" and "gbo->bo.base" will be > freed by ttm_buffer_object_destroy() in ttm_bo_init(). But > then drm_gem_vram_create() and drm_gem_vram_init() will free > "gb

[PATCH] drm: fix double free for gbo in drm_gem_vram_init and drm_gem_vram_create

I got a use-after-free report when doing some fuzz test: If ttm_bo_init() fails, the "gbo" and "gbo->bo.base" will be freed by ttm_buffer_object_destroy() in ttm_bo_init(). But then drm_gem_vram_create() and drm_gem_vram_init() will free "gbo" and "gbo->bo.base" again. BUG: KMSAN: use-after-free