summaryrefslogtreecommitdiffstats
path: root/drivers/gpu/drm/virtio
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-05-08 04:15:15 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-05-08 04:15:15 +0000
commit68c1b0995e963349e50f8a8b00ebc140908f7882 (patch)
treeae3788542761985ee15e3d1ca439706040d1eb0c /drivers/gpu/drm/virtio
parentReleasing progress-linux version 4.19.269-1progress5u1. (diff)
downloadlinux-68c1b0995e963349e50f8a8b00ebc140908f7882.tar.xz
linux-68c1b0995e963349e50f8a8b00ebc140908f7882.zip
Merging upstream version 4.19.282.
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r--drivers/gpu/drm/virtio/virtgpu_ioctl.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
index 8d2f5ded8..a539843a0 100644
--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
@@ -309,7 +309,6 @@ static int virtio_gpu_resource_create_ioctl(struct drm_device *dev, void *data,
}
return ret;
}
- drm_gem_object_put_unlocked(obj);
rc->res_handle = res_id; /* similiar to a VM address */
rc->bo_handle = handle;
@@ -318,6 +317,15 @@ static int virtio_gpu_resource_create_ioctl(struct drm_device *dev, void *data,
virtio_gpu_unref_list(&validate_list);
dma_fence_put(&fence->f);
}
+
+ /*
+ * The handle owns the reference now. But we must drop our
+ * remaining reference *after* we no longer need to dereference
+ * the obj. Otherwise userspace could guess the handle and
+ * race closing it from another thread.
+ */
+ drm_gem_object_put_unlocked(obj);
+
return 0;
fail_unref:
if (vgdev->has_virgl_3d) {