From patchwork Tue Nov 8 18:38:23 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stanislaw Gruszka X-Patchwork-Id: 13036712 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 83A46C433FE for ; Tue, 8 Nov 2022 18:38:42 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 9BB0710E4ED; Tue, 8 Nov 2022 18:38:40 +0000 (UTC) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by gabe.freedesktop.org (Postfix) with ESMTPS id D90B510E4ED for ; Tue, 8 Nov 2022 18:38:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1667932716; x=1699468716; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=3mbJGRQgfAQjDr2QipUqESxqeSWhd8OVU2fq4EOkZTA=; b=N22l6k9IfEPOF/J5q3uJ4XwTcVoWrwhgZFs8pjArwxlqnDEjgbqFuuRf BQrv+ARfZImm7jwl8aYsKIj8Fdspv/QFiANBuvcXLxnQho30KGdyxB6y9 E1sDQuFhbiQUNZ+k6tmZ7kjd3IB7xcu+Aen5hWsfEOSmQm5dZCjqXR5C9 OoTbO+eNEy2tX7Go2WXFJEcrb113MWm1ZYpBt88Sshr8jCm2bRYk/M1HK x9RAtNL5Eo3vkMUsDKeWxowDPCHrXzeJuQnqWoCUAmoHw0WBklYLCFT6W Zb1Nl27JaUZH51e1f3D1Gg4ObSXGh+S7iTBU3BNOoilt7E/BnjZhL5FBR Q==; X-IronPort-AV: E=McAfee;i="6500,9779,10525"; a="397070011" X-IronPort-AV: E=Sophos;i="5.96,148,1665471600"; d="scan'208";a="397070011" Received: from fmsmga002.fm.intel.com ([10.253.24.26]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Nov 2022 10:38:36 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10525"; a="742068164" X-IronPort-AV: E=Sophos;i="5.96,148,1665471600"; d="scan'208";a="742068164" Received: from joe-255.igk.intel.com (HELO localhost) ([172.22.229.67]) by fmsmga002-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 08 Nov 2022 10:38:34 -0800 From: Stanislaw Gruszka To: dri-devel@lists.freedesktop.org, Daniel Vetter Subject: [PATCH v2] drm: fix crash in drm_minor_alloc_release Date: Tue, 8 Nov 2022 19:38:23 +0100 Message-Id: <20221108183823.314121-1-stanislaw.gruszka@linux.intel.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jacek Lawrynowicz , Thomas Zimmermann , Stanislaw Gruszka Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" If drm_sysfs_minor_alloc() fail in drm_minor_alloc() we can end up freeing invalid minor->kdev pointer and drm_minor_alloc_release() will crash like below: RIP: 0010:kobject_put+0x19/0x1c0 RSP: 0018:ffffbc7001637c38 EFLAGS: 00010282 RAX: ffffffffa8d6deb0 RBX: 00000000ffffffff RCX: ffff9cb5912d4540 RDX: ffffffffa9c45ec5 RSI: ffff9cb5902f2b68 RDI: fffffffffffffff4 RBP: fffffffffffffff4 R08: ffffffffa9c40dec R09: 0000000000000008 R10: ffffffffaa81f7d2 R11: 00000000aa81f7ca R12: ffff9cb5912d4540 R13: ffff9cb5912d4540 R14: dead000000000122 R15: dead000000000100 FS: 00007f56b06e6740(0000) GS:ffff9cb728b40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000030 CR3: 000000011285b004 CR4: 0000000000170ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7: 0000000000000400 Call Trace: drm_minor_alloc_release+0x19/0x50 drm_managed_release+0xab/0x150 drm_dev_init+0x21f/0x2f0 __devm_drm_dev_alloc+0x3c/0xa0 ivpu_probe+0x59/0x797 [intel_vpu 127058409b05eb2f99dcdecd3330bee28d6b3e76] pci_device_probe+0xa4/0x160 really_probe+0x164/0x340 __driver_probe_device+0x10d/0x190 device_driver_attach+0x26/0x50 bind_store+0x9f/0x120 kernfs_fop_write_iter+0x12d/0x1c0 new_sync_write+0x106/0x180 vfs_write+0x216/0x2a0 ksys_write+0x65/0xe0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Fix this crash by returning NULL minor->kdev on error. Fixes: f96306f9892b ("drm: manage drm_minor cleanup with drmm_") Signed-off-by: Stanislaw Gruszka Reviewed-by: Daniel Vetter --- v2: return minor->kdev NULL pointer instead of checking for IS_ERR in drm_minor_alloc_release() drivers/gpu/drm/drm_drv.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c index 8214a0b1ab7f..8d70b634d008 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -142,8 +142,11 @@ static int drm_minor_alloc(struct drm_device *dev, unsigned int type) return r; minor->kdev = drm_sysfs_minor_alloc(minor); - if (IS_ERR(minor->kdev)) - return PTR_ERR(minor->kdev); + if (IS_ERR(minor->kdev)) { + r = PTR_ERR(minor->kdev); + minor->kdev = NULL; + return r; + } *drm_minor_get_slot(dev, type) = minor; return 0;