openbsd/src
1
0
Fork 0
mirror of https://github.com/openbsd/src.git synced 2026-04-15 17:54:36 +00:00
Code Issues Projects Releases Wiki Activity

Revert "drm: Fix use-after-free on framebuffers and property blobs when calling drm_dev_unplug"

Browse Source 
From Maarten Lankhorst
89c3a4ba60309cc6333a8f3940a1866fc21a9000 in linux-6.18.y/6.18.22
45ebe43ea00d6b9f5b3e0db9c35b8ca2a96b7e70 in mainline linux
This commit is contained in:
jsg
2026-04-12 23:00:13 +00:00
parent 8e156a5ebe
commit dedd674940
2 changed files with 4 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
sys/dev/pci/drm/drm_file.c
View File

@@ -235,7 +235,6 @@ static void drm_events_release(struct drm_file *file_priv)
void drm_file_free(struct drm_file *file)
{
struct drm_device *dev;
int idx;
if (!file)
return;
@@ -258,11 +257,9 @@ void drm_file_free(struct drm_file *file)
drm_events_release(file);
if (drm_core_check_feature(dev, DRIVER_MODESET) &&
drm_dev_enter(dev, &idx)) {
if (drm_core_check_feature(dev, DRIVER_MODESET)) {
drm_fb_release(file);
drm_property_destroy_user_blobs(dev, file);
drm_dev_exit(idx);
}
if (drm_core_check_feature(dev, DRIVER_SYNCOBJ))

9
sys/dev/pci/drm/drm_mode_config.c
View File

@@ -570,13 +570,10 @@ void drm_mode_config_cleanup(struct drm_device *dev)
*/
WARN_ON(!list_empty(&dev->mode_config.fb_list));
list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
if (list_empty(&fb->filp_head) || drm_framebuffer_read_refcount(fb) > 1) {
struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");
struct drm_printer p = drm_dbg_printer(dev, DRM_UT_KMS, "[leaked fb]");
drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
drm_framebuffer_print_info(&p, 1, fb);
}
list_del_init(&fb->filp_head);
drm_printf(&p, "framebuffer[%u]:\n", fb->base.id);
drm_framebuffer_print_info(&p, 1, fb);
drm_framebuffer_free(&fb->base.refcount);
}