From patchwork Wed May 20 12:33:27 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Nirmoy Das X-Patchwork-Id: 11564793 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 0C4EC13B1 for ; Fri, 22 May 2020 06:56:33 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id DFDF420823 for ; Fri, 22 May 2020 06:56:32 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BqWz+Mjk" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org DFDF420823 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 64BC36E3C4; Fri, 22 May 2020 06:56:08 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-ej1-x641.google.com (mail-ej1-x641.google.com [IPv6:2a00:1450:4864:20::641]) by gabe.freedesktop.org (Postfix) with ESMTPS id BAFE06E15A for ; Wed, 20 May 2020 12:33:19 +0000 (UTC) Received: by mail-ej1-x641.google.com with SMTP id n24so3615774ejd.0 for ; Wed, 20 May 2020 05:33:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:reply-to:mime-version :content-transfer-encoding; bh=ehjzIXJVfsowwKW5tw7J90PSE9awheuDdbtm+lGfy+0=; b=BqWz+Mjkdf25ceZl5lM/8TkPSm4mOKkEmmBbB3aA90LBphd4FCgSN6lu9CLOnLtvGM YJXawJ3D5azc9laESl9RhS58KSyP9nNMCJTXgRupguj4+3odu6RY4QO5VHZKWsp0Ybwa FOuj7T9a5DSnOcyYnDlB3w5P/YLr/y/l1h5e0JDm0X4j013sOycht6IaMKacwpGAOxmb FcA1PyyizzplaJ63zJePreJXyuYA2kRXc56lvy+seFoPUpmtnOmN1ZMl5RwAANWBLKFO MXOeU09ocwmACLUaSc4bmt8XqaiGlpr7O5qJtP8+GNFbOiWJZr0duWuVrR9YQIsDEVK4 AJpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :mime-version:content-transfer-encoding; bh=ehjzIXJVfsowwKW5tw7J90PSE9awheuDdbtm+lGfy+0=; b=lAq0j2JU6SXQO5F6l5tf+jxiTehb8eyPf162oohUvwGERmUVulIL1uMyh6xmUPfgop pAon8guTpEKodA+pb51U22arY4lQRHsqdn6yblNgcZGIOmTdSa1C59wBM4q4gHv1a5/V x5qlwJvgE3/+RgLPYOaNUS8JyKbT8ep2ne9gILX2ssGbSVG6efLp0bY++7OaQwbRuhBk HRYloHhz7ongSiO51kNnjDWqjTnGFYEikKoJWylwnAGc+9RGMvQrXoDt/EjePYIzFxES I95uzW2QMoYZ4D03krN1VvMQ3tsZRxHCI/Z0roadi86KyjMEryfdOlcMDTjpH8AAo+yU PwWw== X-Gm-Message-State: AOAM532KtWHRk2NmE7V4Zq8nv2ANZYhNu5ImVb5hnLB5C6cLyKqZbhVk 0HUksQcfA4mgSPYuD2UlyB24LdfIP4g= X-Google-Smtp-Source: ABdhPJxgjs2yn44rYaccct8jkxe50KpOY/oVVEhDMva6TEQv1F6iwZdeaWjxN0qyKVzlZwvoRi1dAg== X-Received: by 2002:a17:906:dd8:: with SMTP id p24mr3357070eji.93.1589977997979; Wed, 20 May 2020 05:33:17 -0700 (PDT) Received: from localhost.localdomain (p200300c58f225e00cb12a21916b827a8.dip0.t-ipconnect.de. [2003:c5:8f22:5e00:cb12:a219:16b8:27a8]) by smtp.gmail.com with ESMTPSA id s17sm1788637edr.84.2020.05.20.05.33.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 20 May 2020 05:33:17 -0700 (PDT) From: Nirmoy Das X-Google-Original-From: Nirmoy Das To: dri-devel@lists.freedesktop.org Subject: [PATCH v2 1/1] drm: check for NULL pointer in drm_gem_object_put Date: Wed, 20 May 2020 14:33:27 +0200 Message-Id: <20200520123327.87476-1-nirmoy.das@amd.com> X-Mailer: git-send-email 2.26.2 MIME-Version: 1.0 X-Mailman-Approved-At: Fri, 22 May 2020 06:56:07 +0000 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: 20200520123118.85706-1-nirmoy.das@amd.com Cc: Nirmoy Das , emil.l.velikov@gmail.com, christian.koenig@amd.com, nirmoy.aiemd@gmail.com Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" drm_gem_fb_destroy() calls drm_gem_object_put() with NULL obj causing: [ 11.584209] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 11.584213] #PF: supervisor write access in kernel mode [ 11.584215] #PF: error_code(0x0002) - not-present page [ 11.584216] PGD 0 P4D 0 [ 11.584220] Oops: 0002 [#1] SMP NOPTI [ 11.584223] CPU: 7 PID: 1571 Comm: gnome-shell Tainted: G E 5.7.0-rc1-1-default+ #27 [ 11.584225] Hardware name: Micro-Star International Co., Ltd. MS-7A31/X370 XPOWER GAMING TITANIUM (MS-7A31), BIOS 1.MR 12/03/2019 [ 11.584237] RIP: 0010:drm_gem_fb_destroy+0x28/0x70 [drm_kms_helper] [ 11.584256] Call Trace: [ 11.584279] drm_mode_rmfb+0x189/0x1c0 [drm] [ 11.584299] ? drm_mode_rmfb+0x1c0/0x1c0 [drm] [ 11.584314] drm_ioctl_kernel+0xaa/0xf0 [drm] [ 11.584329] drm_ioctl+0x1ff/0x3b0 [drm] [ 11.584347] ? drm_mode_rmfb+0x1c0/0x1c0 [drm] [ 11.584421] amdgpu_drm_ioctl+0x49/0x80 [amdgpu] [ 11.584427] ksys_ioctl+0x87/0xc0 [ 11.584430] __x64_sys_ioctl+0x16/0x20 [ 11.584434] do_syscall_64+0x5f/0x240 [ 11.584438] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 11.584440] RIP: 0033:0x7f0ef80f7227 Fixes: b5d250744cccfb400 ("drm/gem: fold drm_gem_object_put_unlocked and __drm_gem_object_put()") Signed-off-by: Nirmoy Das Reviewed-by: Christian König --- include/drm/drm_gem.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h index 52173abdf500..a13510346a9b 100644 --- a/include/drm/drm_gem.h +++ b/include/drm/drm_gem.h @@ -372,6 +372,9 @@ static inline void drm_gem_object_get(struct drm_gem_object *obj) static inline void drm_gem_object_put(struct drm_gem_object *obj) { + if (!obj) + return; + kref_put(&obj->refcount, drm_gem_object_free); }