Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Zheng Wang <zyytlz.wz@163.com>
To:     zhi.a.wang@intel.com
Cc:     1002992920@qq.com, airlied@gmail.com, airlied@linux.ie,
        alex000young@gmail.com, dri-devel@lists.freedesktop.org,
        gregkh@linuxfoundation.org, hackerzheng666@gmail.com,
        intel-gfx@lists.freedesktop.org,
        intel-gvt-dev@lists.freedesktop.org,
        joonas.lahtinen@linux.intel.com, linux-kernel@vger.kernel.org,
        security@kernel.org, tvrtko.ursulin@linux.intel.com,
        zhenyuw@linux.intel.com, zyytlz.wz@163.com
Subject: Re: [Intel-gfx] [PATCH v3] drm/i915/gvt: fix double free bug in split_2MB_gtt_entry
Date:   Mon, 19 Dec 2022 17:21:39 +0800
Message-Id: <20221219092139.222456-1-zyytlz.wz@163.com>
In-Reply-To: <11728bc1-7b59-1623-b517-d1a0d57eb275@intel.com>
References: <11728bc1-7b59-1623-b517-d1a0d57eb275@intel.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Precedence: bulk

Wang, Zhi A <zhi.a.wang@intel.com> 于2022年12月19日周一 16:22写道：

>
> I think it is a case-by-case thing. For example:
>
> The current scenario in this function looks like below:
>
> caller pass spt a
> function
>         alloc spt b
>         something error
>         free spt a
>         return error
>
> The problem is: the function wrongly frees the spt a instead free what
> it allocates.

Thanks for your clear explaination. It’s really helpfult to me.
I think I might know how to fix now.

> A proper fix should be:
>
> caller pass spt a
> function
>         alloc spt b
>         something error
>         *free spt b*
>         return error
>
As it's a case-by-case thing, I'll extract the un-done-mapping-dma part from
ppgtt_invalidate_spt and put it in error path. Then I'll add the code of freeing
new allocated spt. If I misunderstand your meaning, feel free to let me know.
Working on a new fix now.

Best regards,
Zheng Wang