Skip to contentSkip to conversation

Fix SIGSEGV in libdrm for heigth = 0 and width = 0

PATCH In review Thomas Meyer 2 participants 2 messages Nov 7, 2014 – Nov 20, 2014

lore
Share & tools
lore

Thomas Meyer

author
#0 lore raw

PATCH 1/1 Fix SIGSEGV in libdrm for heigth = 0 and width = 0

drm_intel_gem_bo_free() crashes because the list bo_gem->vma_list is not yet initialised, but the error path tries to free it.

See also https://bugs.freedesktop.org/show_bug.cgi?id=75844

Reviewed-by Chris Wilson <[email protected]>
Signed-off-by Thomas Meyer <[email protected]>

---

intel/intel_bufmgr_gem.c +4 -3
index f2f4fea..b3e9dba 100644
@@ -759,15 +759,16 @@ retry:
 		bo_gem->swizzle_mode = I915_BIT_6_SWIZZLE_NONE;
 		bo_gem->stride = 0;
 
+		/* drm_intel_gem_bo_free calls DRMLISTDEL() for an uninitialized
+		   list (vma_list), so better set the list head here */
+		DRMINITLISTHEAD(&bo_gem->name_list);
+		DRMINITLISTHEAD(&bo_gem->vma_list);
 		if (drm_intel_gem_bo_set_tiling_internal(&bo_gem->bo,
 							 tiling_mode,
 							 stride)) {
 		    drm_intel_gem_bo_free(&bo_gem->bo);
 		    return NULL;
 		}
-
-		DRMINITLISTHEAD(&bo_gem->name_list);
-		DRMINITLISTHEAD(&bo_gem->vma_list);
 	}
 
 	bo_gem->name = name;

_______________________________________________
dri-devel mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/dri-devel

#1 lore raw
Quoted 8 lines · Thomas Meyer

drm_intel_gem_bo_free() crashes because the list bo_gem->vma_list is not yet initialised, but the error path tries to free it.

See also https://bugs.freedesktop.org/show_bug.cgi?id=75844

Reviewed-by Chris Wilson <[email protected]>
Signed-off-by Thomas Meyer <[email protected]>

Thanks for the patch and review tag. Sorry it took so long to push, it wasn't clear who was going to do it.

Signature · 1 line
Damien
Quoted 19 lines

---

intel/intel_bufmgr_gem.c +4 -0
index f2f4fea..b3e9dba 100644
@@ -759,15 +759,16 @@ retry:
 		bo_gem->swizzle_mode = I915_BIT_6_SWIZZLE_NONE;
 		bo_gem->stride = 0;
 
+		/* drm_intel_gem_bo_free calls DRMLISTDEL() for an uninitialized
+		   list (vma_list), so better set the list head here */
+		DRMINITLISTHEAD(&bo_gem->name_list);
+		DRMINITLISTHEAD(&bo_gem->vma_list);
 		if (drm_intel_gem_bo_set_tiling_internal(&bo_gem->bo,
 							 tiling_mode,

intel/intel_bufmgr_gem.c retry: · line 774

Quoted 10 lines
intel/intel_bufmgr_gem.c +0 -3
 							 stride)) {
 		    drm_intel_gem_bo_free(&bo_gem->bo);
 		    return NULL;
 		}
-
-		DRMINITLISTHEAD(&bo_gem->name_list);
-		DRMINITLISTHEAD(&bo_gem->vma_list);
 	}
 
 	bo_gem->name = name;

_______________________________________________
dri-devel mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/dri-devel