kmem_cache_free() frees *workload*, hence there is a use-after-free bug when calling function gvt_vgpu_err().
Fix this by storing the value of workload->wa_ctx.indirect_ctx.guest_gma and workload->wa_ctx.per_ctx.guest_gma into automatic variable guest_gma before freeing *workload*, for its further use.
Addresses-Coverity-ID: 1452235 ("Read from pointer after free") Fixes: 2089a76ade90 ("drm/i915/gvt: Checking workload's gma earlier") Signed-off-by: Gustavo A. R. Silva gustavo@embeddedor.com --- drivers/gpu/drm/i915/gvt/scheduler.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/gvt/scheduler.c b/drivers/gpu/drm/i915/gvt/scheduler.c index 32ae6b5b7e16..c8cdb4a309f6 100644 --- a/drivers/gpu/drm/i915/gvt/scheduler.c +++ b/drivers/gpu/drm/i915/gvt/scheduler.c @@ -1525,9 +1525,11 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id, if (!intel_gvt_ggtt_validate_range(vgpu, workload->wa_ctx.indirect_ctx.guest_gma, workload->wa_ctx.indirect_ctx.size)) { + unsigned long guest_gma = + workload->wa_ctx.indirect_ctx.guest_gma; kmem_cache_free(s->workloads, workload); gvt_vgpu_err("invalid wa_ctx at: 0x%lx\n", - workload->wa_ctx.indirect_ctx.guest_gma); + guest_gma); return ERR_PTR(-EINVAL); } } @@ -1539,9 +1541,11 @@ intel_vgpu_create_workload(struct intel_vgpu *vgpu, int ring_id, if (!intel_gvt_ggtt_validate_range(vgpu, workload->wa_ctx.per_ctx.guest_gma, CACHELINE_BYTES)) { + unsigned long guest_gma = + workload->wa_ctx.per_ctx.guest_gma; kmem_cache_free(s->workloads, workload); gvt_vgpu_err("invalid per_ctx at: 0x%lx\n", - workload->wa_ctx.per_ctx.guest_gma); + guest_gma); return ERR_PTR(-EINVAL); } }