kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/gpu/drm/vkms
History
Yuan Can 57031c474c drm/vkms: Fix null-ptr-deref in vkms_release() 
[ Upstream commit 2fe2a8f40c ]

A null-ptr-deref is triggered when it tries to destroy the workqueue in
vkms->output.composer_workq in vkms_release().

 KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
 CPU: 5 PID: 17193 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf #24
 RIP: 0010:destroy_workqueue+0x2f/0x710
 ...
 Call Trace:
  <TASK>
  ? vkms_config_debugfs_init+0x50/0x50 [vkms]
  __devm_drm_dev_alloc+0x15a/0x1c0 [drm]
  vkms_init+0x245/0x1000 [vkms]
  do_one_initcall+0xd0/0x4f0
  do_init_module+0x1a4/0x680
  load_module+0x6249/0x7110
  __do_sys_finit_module+0x140/0x200
  do_syscall_64+0x35/0x80
  entry_SYSCALL_64_after_hwframe+0x46/0xb0

The reason is that an OOM happened which triggers the destroy of the
workqueue, however, the workqueue is alloced in the later process,
thus a null-ptr-deref happened. A simple call graph is shown as below:

 vkms_init()
  vkms_create()
    devm_drm_dev_alloc()
      __devm_drm_dev_alloc()
        devm_drm_dev_init()
          devm_add_action_or_reset()
            devm_add_action() # an error happened
            devm_drm_dev_init_release()
              drm_dev_put()
                kref_put()
                  drm_dev_release()
                    vkms_release()
                      destroy_workqueue() # null-ptr-deref happened
    vkms_modeset_init()
      vkms_output_init()
        vkms_crtc_init() # where the workqueue get allocated

Fix this by checking if composer_workq is NULL before passing it to
the destroy_workqueue() in vkms_release().

Fixes: 6c234fe37c ("drm/vkms: Implement CRC debugfs API")
Signed-off-by: Yuan Can <yuancan@huawei.com>
Reviewed-by: Melissa Wen <mwen@igalia.com>
Signed-off-by: Melissa Wen <melissa.srw@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20221101065156.41584-3-yuancan@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2023-03-10 09:28:26 +01:00
..
Makefile drm: vkms: Refactor the plane composer to accept new formats 2022-09-05 20:18:35 -01:00
vkms_composer.c drm: vkms: Supports to the case where primary plane doesn't match the CRTC 2022-09-05 20:18:42 -01:00
vkms_crtc.c drm/vkms: fix misuse of WARN_ON 2021-03-25 08:23:28 -03:00
vkms_drv.c drm/vkms: Fix null-ptr-deref in vkms_release() 2023-03-10 09:28:26 +01:00
vkms_drv.h drm: vkms: Add fb information to vkms_writeback_job 2022-09-05 20:12:18 -01:00
vkms_formats.c drm/vkms: fix 32bit compilation error by replacing macros 2022-09-11 22:28:56 +10:00
vkms_formats.h drm: vkms: Refactor the plane composer to accept new formats 2022-09-05 20:18:35 -01:00
vkms_output.c drm: Drop drm_edid.h from drm_crtc.h 2022-06-20 23:53:55 +03:00
vkms_plane.c drm/vkms: fix variable dereferenced before check warning 2022-09-10 21:18:56 -01:00
vkms_writeback.c drm: vkms: Add support to the RGB565 format 2022-09-05 20:25:08 -01:00