Skip to content
Commit fe69a391 authored by Simona Vetter's avatar Simona Vetter Committed by Steven Price
Browse files

drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code



The object is potentially already gone after the drm_gem_object_put().
In general the object should be fully constructed before calling
drm_gem_handle_create(), except the debugfs tracking uses a separate
lock and list and separate flag to denotate whether the object is
actually initialized.

Since I'm touching this all anyway simplify this by only adding the
object to the debugfs when it's ready for that, which allows us to
delete that separate flag. panthor_gem_debugfs_bo_rm() already checks
whether we've actually been added to the list or this is some error
path cleanup.

v2: Fix build issues for !CONFIG_DEBUGFS (Adrián)

v3: Add linebreak and remove outdated comment (Liviu)

Fixes: a3707f53 ("drm/panthor: show device-wide list of DRM GEM objects over DebugFS")
Cc: Adrián Larumbe <adrian.larumbe@collabora.com>
Cc: Boris Brezillon <boris.brezillon@collabora.com>
Cc: Steven Price <steven.price@arm.com>
Cc: Liviu Dudau <liviu.dudau@arm.com>
Reviewed-by: Liviu Dudau's avatarLiviu Dudau <liviu.dudau@arm.com>
Signed-off-by: default avatarSimona Vetter <simona.vetter@intel.com>
Signed-off-by: default avatarSimona Vetter <simona.vetter@ffwll.ch>
Reviewed-by: Steven Price's avatarSteven Price <steven.price@arm.com>
Signed-off-by: Steven Price's avatarSteven Price <steven.price@arm.com>
Link: https://lore.kernel.org/r/20250709135220.1428931-1-simona.vetter@ffwll.ch
parent 0f168e7b
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment