Our analysis revealed that most handlers in ttm_device_funcs perform type checks before invoking container_of on ttm_buffer_object. For instance, commit d03d858970a1 ("drm/radeon/kms: Check if bo we got from ttm are radeon object or not") introduced an object type check ( based on the comparison with destroy function). This commit adds the missing type checks in the nouveau_bo_evict_flags and bo_driver_move handlers. Signed-off-by: Lin Ma --- drivers/gpu/drm/drm_gem_vram_helper.c | 3 +++ drivers/gpu/drm/nouveau/nouveau_bo.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/drivers/gpu/drm/drm_gem_vram_helper.c b/drivers/gpu/drm/drm_gem_vram_helper.c index 22b1fe9c03b8..40d1b584327e 100644 --- a/drivers/gpu/drm/drm_gem_vram_helper.c +++ b/drivers/gpu/drm/drm_gem_vram_helper.c @@ -855,6 +855,9 @@ static int bo_driver_move(struct ttm_buffer_object *bo, return 0; } + if (!drm_is_gem_vram(bo)) + return -EINVAL; + gbo = drm_gem_vram_of_bo(bo); return drm_gem_vram_bo_driver_move(gbo, evict, ctx, new_mem); diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c index b96f0555ca14..81a66246d547 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bo.c +++ b/drivers/gpu/drm/nouveau/nouveau_bo.c @@ -887,6 +887,9 @@ nouveau_bo_evict_flags(struct ttm_buffer_object *bo, struct ttm_placement *pl) { struct nouveau_bo *nvbo = nouveau_bo(bo); + if (bo->destroy != nouveau_bo_del_ttm) + return; + switch (bo->resource->mem_type) { case TTM_PL_VRAM: nouveau_bo_placement_set(nvbo, NOUVEAU_GEM_DOMAIN_GART, -- 2.17.1