[Spice-devel] [PATCH 2/2] drm/qxl: qxl_release leak in qxl_hw_surface_alloc()

Cc: sta...@vger.kernel.org Fixes: 8002db6336dd ("qxl: convert qxl driver to proper use for reservations") Signed-off-by: Vasily Averin --- drivers/gpu/drm/qxl/qxl_cmd.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/g

[Spice-devel] [PATCH 1/2] drm/qxl: qxl_release leak in qxl_draw_dirty_fb()

ret should be changed to release allocated struct qxl_release Cc: sta...@vger.kernel.org Fixes: 8002db6336dd ("qxl: convert qxl driver to proper use for reservations") Signed-off-by: Vasily Averin --- drivers/gpu/drm/qxl/qxl_draw.c | 5 +++-- 1 file changed, 3 insertions(+), 2

[Spice-devel] [PATCH] drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper()

Signed-off-by: Vasily Averin --- drivers/gpu/drm/qxl/qxl_image.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/qxl/qxl_image.c b/drivers/gpu/drm/qxl/qxl_image.c index 43688ecdd8a0..7270da62fc29 100644 --- a/drivers/gpu/drm/qxl/qxl_image.c +++ b/drivers/gpu/drm/qxl

[Spice-devel] [PATCH v2] drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper()

v2: removed TODO reminder Signed-off-by: Vasily Averin --- drivers/gpu/drm/qxl/qxl_image.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/qxl/qxl_image.c b/drivers/gpu/drm/qxl/qxl_image.c index 43688ecdd8a0..60ab7151b84d 100644 --- a/drivers/gpu/drm/qxl

[Spice-devel] [PATCH] drm/qxl: qxl_release use after free

-192 slab object Gerd Hoffmann proposes to swap the qxl_release_fence_buffer_objects() + qxl_push_{cursor,command}_ring_release() calls to close that race window. cc: sta...@vger.kernel.org Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") Signed-off-by: Vasily Averin --- drive