diff options
author | Zheng Wang <zyytlz.wz@163.com> | 2022-12-30 00:56:41 +0800 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-01-12 12:02:31 +0100 |
commit | 1022519da69d99d455c58ca181a6c499c562c70e (patch) | |
tree | d3ad34d265586b88e912629ec37cc6990cdce675 /drivers/block | |
parent | 20a07570c1667a48fe50fdfa59f4ece57775b69a (diff) | |
download | linux-1022519da69d99d455c58ca181a6c499c562c70e.tar.gz |
drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
[ Upstream commit 4a61648af68f5ba4884f0e3b494ee1cabc4b6620 ] If intel_gvt_dma_map_guest_page failed, it will call ppgtt_invalidate_spt, which will finally free the spt. But the caller function ppgtt_populate_spt_by_guest_entry does not notice that, it will free spt again in its error path. Fix this by canceling the mapping of DMA address and freeing sub_spt. Besides, leave the handle of spt destroy to caller function instead of callee function when error occurs. Fixes: b901b252b6cf ("drm/i915/gvt: Add 2M huge gtt support") Signed-off-by: Zheng Wang <zyytlz.wz@163.com> Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com> Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com> Link: http://patchwork.freedesktop.org/patch/msgid/20221229165641.1192455-1-zyytlz.wz@163.com Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/block')
0 files changed, 0 insertions, 0 deletions