drm/nouveau/nvif: fix potential double-free

DRM cleanup paths unconditionally call nvif_mmu_dtor() for clients,
which would result in a double-free if nvif_mmu_ctor()'d previously
failed.

Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Karol Herbst <kherbst@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230525003106.3853741-9-skeggsb@gmail.com

diff --git a/drivers/gpu/drm/nouveau/nvif/mmu.c b/drivers/gpu/drm/nouveau/nvif/mmu.c
index 3709cbbc19a1edfc2937ddcb74aee9e7fdc86814..c9dd3cff49a002e45ccd4a4d08eee1ea5568c7cc 100644 (file)
--- a/drivers/gpu/drm/nouveau/nvif/mmu.c
+++ b/drivers/gpu/drm/nouveau/nvif/mmu.c
@@ -27,6 +27,9 @@
 void
 nvif_mmu_dtor(struct nvif_mmu *mmu)
 {
+       if (!nvif_object_constructed(&mmu->object))
+               return;
+
        kfree(mmu->kind);
        kfree(mmu->type);
        kfree(mmu->heap);