archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 05:04:51 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

drm/vmwgfx: Fix invalid kref_put callback in vmw_bo_dirty_release

Browse source 
The kref_put() call uses (void *)kvfree as the release callback, which
is incorrect. kref_put() expects a function with signature
void (*release)(struct kref *), but kvfree has signature
void (*)(const void *). Calling through an incompatible function pointer
is undefined behavior.

The code only worked by accident because ref_count is the first member
of vmw_bo_dirty, making the kref pointer equal to the struct pointer.

Fix this by adding a proper release callback that uses container_of()
to retrieve the containing structure before freeing.

Fixes: c1962742ff ("drm/vmwgfx: Use kref in vmw_bo_dirty")
Signed-off-by: Brad Spengler <brad.spengler@opensrcsec.com>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Cc: Ian Forbes <ian.forbes@broadcom.com>
Link: https://patch.msgid.link/20260107171236.3573118-1-zack.rusin@broadcom.com
This commit is contained in:
Brad Spengler 2026-01-07 12:12:36 -05:00 • committed by Zack Rusin
parent 40b24d9cdd
commit 211ecfaaef
1 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c
View file

@ -260,6 +260,13 @@ out_no_dirty:
return ret;
}
static void vmw_bo_dirty_free(struct kref *kref)
{
struct vmw_bo_dirty *dirty = container_of(kref, struct vmw_bo_dirty, ref_count);
kvfree(dirty);
}
/**
* vmw_bo_dirty_release - Release a dirty-tracking user from a buffer object
* @vbo: The buffer object
@ -274,7 +281,7 @@ void vmw_bo_dirty_release(struct vmw_bo *vbo)
{
struct vmw_bo_dirty *dirty = vbo->dirty;
if (dirty && kref_put(&dirty->ref_count, (void *)kvfree))
if (dirty && kref_put(&dirty->ref_count, vmw_bo_dirty_free))
vbo->dirty = NULL;
}