36b6c9ed45
If drm_gem_handle_create() fails in vkms_gem_create(), then the
vkms_gem_object is freed twice: once when the reference is dropped by
drm_gem_object_put_unlocked(), and again by the extra calls to
drm_gem_object_release() and kfree().
Fix it by skipping the second release and free.
This bug was originally found in the vgem driver by syzkaller using
fault injection, but I noticed it's also present in the vkms driver.
Fixes:
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| vkms_crc.c | ||
| vkms_crtc.c | ||
| vkms_drv.c | ||
| vkms_drv.h | ||
| vkms_gem.c | ||
| vkms_output.c | ||
| vkms_plane.c | ||