Our analysis revealed that most handlers in ttm_device_funcs perform
type checks before invoking container_of on ttm_buffer_object.
For instance, commit d03d858970a1 ("drm/radeon/kms: Check if bo we got
from ttm are radeon object or not") introduced an object type check (
based on the comparison with destroy function).
This commit adds the missing type checks in the nouveau_bo_evict_flags
and bo_driver_move handlers.
Signed-off-by: Lin Ma <linma@zju.edu.cn>
---
drivers/gpu/drm/drm_gem_vram_helper.c | 3 +++
drivers/gpu/drm/nouveau/nouveau_bo.c | 3 +++
2 files changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/drm_gem_vram_helper.c b/drivers/gpu/drm/drm_gem_vram_helper.c
index 22b1fe9c03b8..40d1b584327e 100644
--- a/drivers/gpu/drm/drm_gem_vram_helper.c
+++ b/drivers/gpu/drm/drm_gem_vram_helper.c
@@ -855,6 +855,9 @@ static int bo_driver_move(struct ttm_buffer_object *bo,
return 0;
}
+ if (!drm_is_gem_vram(bo))
+ return -EINVAL;
+
gbo = drm_gem_vram_of_bo(bo);
return drm_gem_vram_bo_driver_move(gbo, evict, ctx, new_mem);
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index b96f0555ca14..81a66246d547 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -887,6 +887,9 @@ nouveau_bo_evict_flags(struct ttm_buffer_object *bo, struct ttm_placement *pl)
{
struct nouveau_bo *nvbo = nouveau_bo(bo);
+ if (bo->destroy != nouveau_bo_del_ttm)
+ return;
+
switch (bo->resource->mem_type) {
case TTM_PL_VRAM:
nouveau_bo_placement_set(nvbo, NOUVEAU_GEM_DOMAIN_GART,
--
2.17.1