diff options
| author | Boris Brezillon <boris.brezillon@collabora.com> | 2026-01-06 17:49:35 +0100 |
|---|---|---|
| committer | Boris Brezillon <boris.brezillon@collabora.com> | 2026-01-09 12:16:02 +0100 |
| commit | 5f8d6f29c51ab8572fc1d3891952ca445e75a610 (patch) | |
| tree | 058a8a48bc70d365919ae8202be79f186853eb48 /drivers/gpu/drm | |
| parent | 0244539f9a4f3b564604dfe4d639f61cecec381a (diff) | |
drm/gem: Fix a GEM leak in drm_gem_get_unmapped_area()
drm_gem_object_lookup_at_offset() can return a valid object with
filp or filp->f_op->get_unmapped_area set to NULL. Make sure we still
release the ref we acquired on such objects.
Cc: Loïc Molinari <loic.molinari@collabora.com>
Fixes: 99bda20d6d4c ("drm/gem: Introduce drm_gem_get_unmapped_area() fop")
Reviewed-by: Loïc Molinari <loic.molinari@collabora.com>
Link: https://patch.msgid.link/20260106164935.409765-1-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Diffstat (limited to 'drivers/gpu/drm')
| -rw-r--r-- | drivers/gpu/drm/drm_gem.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 36c8af123877..f7cbf6e8d1e0 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -1298,11 +1298,13 @@ unsigned long drm_gem_get_unmapped_area(struct file *filp, unsigned long uaddr, unsigned long ret; obj = drm_gem_object_lookup_at_offset(filp, pgoff, len >> PAGE_SHIFT); - if (IS_ERR(obj) || !obj->filp || !obj->filp->f_op->get_unmapped_area) - return mm_get_unmapped_area(filp, uaddr, len, 0, flags); + if (IS_ERR(obj)) + obj = NULL; - ret = obj->filp->f_op->get_unmapped_area(obj->filp, uaddr, len, 0, - flags); + if (!obj || !obj->filp || !obj->filp->f_op->get_unmapped_area) + ret = mm_get_unmapped_area(filp, uaddr, len, 0, flags); + else + ret = obj->filp->f_op->get_unmapped_area(obj->filp, uaddr, len, 0, flags); drm_gem_object_put(obj); |