Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2e51ef32 authored by Changbin Du's avatar Changbin Du Committed by Zhenyu Wang
Browse files

drm/i915/gvt: fix use after free for workload 



In the function workload_thread(), we invoke complete_current_workload()
to cleanup the just processed workload (workload will be freed there).
So we cannot access workload->req after that. This patch move
complete_current_workload() afterward.

Signed-off-by: default avatarChangbin Du <changbin.du@intel.com>
Signed-off-by: default avatarZhenyu Wang <zhenyuw@linux.intel.com>
parent 2fcdb663

drivers/gpu/drm/i915/gvt/scheduler.c

+2 −2
Original line number Diff line number Diff line
@@ -459,11 +459,11 @@ static int workload_thread(void *priv) 
		gvt_dbg_sched("will complete workload %p\n, status: %d\n",

				workload, workload->status);



		complete_current_workload(gvt, ring_id);



		if (workload->req)

			i915_gem_request_put(fetch_and_zero(&workload->req));



		complete_current_workload(gvt, ring_id);



		if (need_force_wake)

			intel_uncore_forcewake_put(gvt->dev_priv,

					FORCEWAKE_ALL);