@@ -141,7 +141,7 @@ void drm_gem_shmem_free(struct drm_gem_shmem_object *shmem)
if (obj->import_attach) {
drm_prime_gem_destroy(obj, shmem->sgt);
- } else {
+ } else if (!shmem->imported_sgt) {
dma_resv_lock(shmem->base.resv, NULL);
drm_WARN_ON(obj->dev, shmem->vmap_use_count);
@@ -765,6 +765,17 @@ drm_gem_shmem_prime_import_sg_table(struct drm_device *dev,
shmem->sgt = sgt;
+ /*
+ * drm_gem_shmem_prime_import_sg_table() can be called from a
+ * driver specific ->import_sg_table() implementations that
+ * may fail, in that case drm_gem_shmem_free() will be invoked
+ * without assigned drm_gem_object::import_attach.
+ *
+ * This flag lets drm_gem_shmem_free() differentiate whether
+ * SGT belongs to dmabuf and shall not be freed by drm-shmem.
+ */
+ shmem->imported_sgt = true;
+
drm_dbg_prime(dev, "size = %zu\n", size);
return &shmem->base;
@@ -73,6 +73,13 @@ struct drm_gem_shmem_object {
*/
unsigned int vmap_use_count;
+ /**
+ * @imported_sgt:
+ *
+ * True if SG table belongs to imported dma-buf.
+ */
+ bool imported_sgt : 1;
+
/**
* @pages_mark_dirty_on_put:
*
Freeing drm-shmem GEM right after creating it using drm_gem_shmem_prime_import_sg_table() frees SGT of the imported dma-buf and then dma-buf frees this SGT second time. The v3d_prime_import_sg_table() is example of a error code path where dma-buf's SGT is freed by drm-shmem and then it's freed second time by dma_buf_unmap_attachment() in drm_gem_prime_import_dev(). Add drm-shmem GEM flag telling that this is imported SGT shall not be treated as own SGT, fixing the use-after-free bug. Cc: stable@vger.kernel.org Fixes: 2194a63a818d ("drm: Add library for shmem backed GEM objects") Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> --- drivers/gpu/drm/drm_gem_shmem_helper.c | 13 ++++++++++++- include/drm/drm_gem_shmem_helper.h | 7 +++++++ 2 files changed, 19 insertions(+), 1 deletion(-)