Re: [PATCH] drm/qxl: Handle failure to reference the surface release buffer

[sashiko-bot@kernel.org]

> When allocating a surface destroy release, qxl_release_list_add()
> takes a reference to the buffer shared with the create release.
> If allocation of the list entry fails, the error is ignored and
> the destroy command is submitted without holding that reference.
> 
> Once the current release buffer has changed and the create release
> has been freed, the buffer may be freed while the destroy release
> still points to it. Garbage collection can then access the freed
> buffer through qxl_release_map().
> 
> Check the return value, free the new release and propagate the error
> before submitting the command. Increment release_count after successful
> release allocation to balance the decrement in qxl_release_free() on
> both the error and normal completion paths.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE static
> analysis tool.
> 
> Fixes: 8002db6336dd ("qxl: convert qxl driver to proper use for reservations")
> Cc: stable@vger.kernel.org
> Signed-off-by: Alex Kazinsky <a.kazinsky@ideco.ru>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113110658.4188477-1-a.kazinsky@ideco.ru?part=1