Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20220928033340.1063949-1-zyytlz.wz@163.com> <20221006165845.1735393-1-zyytlz.wz@163.com>
 <Yz8rIxV7bVCcfZb0@kroah.com>
In-Reply-To: <Yz8rIxV7bVCcfZb0@kroah.com>
From:   Zheng Hacker <hackerzheng666@gmail.com>
Date:   Fri, 7 Oct 2022 08:39:41 +0800
Message-ID: <CAJedcCwwNFWU0_RQ1aG4WQc9JGUYWKKhKtZx_drV3T3n9UD3sQ@mail.gmail.com>
Subject: Re: [PATCH v2] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
To:     Greg KH <gregkh@linuxfoundation.org>
Cc:     Zheng Wang <zyytlz.wz@163.com>, 1002992920@qq.com,
        airlied@linux.ie, alex000young@gmail.com,
        dri-devel@lists.freedesktop.org, intel-gfx@lists.freedesktop.org,
        jani.nikula@linux.intel.com, linux-kernel@vger.kernel.org,
        security@kernel.org, tvrtko.ursulin@linux.intel.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Greg KH <gregkh@linuxfoundation.org> =E4=BA=8E2022=E5=B9=B410=E6=9C=887=E6=
=97=A5=E5=91=A8=E4=BA=94 03:22=E5=86=99=E9=81=93=EF=BC=9A
>
> On Fri, Oct 07, 2022 at 12:58:45AM +0800, Zheng Wang wrote:
> > If intel_gvt_dma_map_guest_page failed, it will call
> > ppgtt_invalidate_spt, which will finally free the spt.
> > But the caller does not notice that, it will free spt again in error pa=
th.
> >
> > Fix this by spliting invalidate and free in ppgtt_invalidate_spt.
> > Only free spt when in good case.
> >
> > Reported-by: Zheng Wang <hackerzheng666@gmail.com>
> > Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
> > ---
> > v2:
> > - split initial function into two api function suggested by Greg
> >
> > v1: https://lore.kernel.org/all/20220928033340.1063949-1-zyytlz.wz@163.=
com/
> > ---
> >  drivers/gpu/drm/i915/gvt/gtt.c | 31 +++++++++++++++++++++----------
> >  1 file changed, 21 insertions(+), 10 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/=
gtt.c
> > index ce0eb03709c3..55d8e1419302 100644
> > --- a/drivers/gpu/drm/i915/gvt/gtt.c
> > +++ b/drivers/gpu/drm/i915/gvt/gtt.c
> > @@ -959,6 +959,7 @@ static inline int ppgtt_put_spt(struct intel_vgpu_p=
pgtt_spt *spt)
> >       return atomic_dec_return(&spt->refcount);
> >  }
> >
> > +static int  ppgtt_invalidate_and_free_spt(struct intel_vgpu_ppgtt_spt =
*spt);
>
> Odd extra space after the 'int', why?
>

Hi Greg,

Sorry it's a spelling mistake. I'll correct it right away :)

Thanks,
Zheng Wang