lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 078/846] drm: fix null-ptr-deref in drm_dev_init_release()
    Date
    From: Wang Hai <wanghai38@huawei.com>

    [ Upstream commit acf20ed020ffa4d6cc8347e8d356509b95df3cbe ]

    I got a null-ptr-deref report:

    [drm:drm_dev_init [drm]] *ERROR* Cannot allocate anonymous inode: -12
    ==================================================================
    BUG: KASAN: null-ptr-deref in iput+0x3c/0x4a0
    ...
    Call Trace:
    dump_stack_lvl+0x6c/0x8b
    kasan_report.cold+0x64/0xdb
    __asan_load8+0x69/0x90
    iput+0x3c/0x4a0
    drm_dev_init_release+0x39/0xb0 [drm]
    drm_managed_release+0x158/0x2d0 [drm]
    drm_dev_init+0x3a7/0x4c0 [drm]
    __devm_drm_dev_alloc+0x55/0xd0 [drm]
    mi0283qt_probe+0x8a/0x2b5 [mi0283qt]
    spi_probe+0xeb/0x130
    ...
    entry_SYSCALL_64_after_hwframe+0x44/0xae

    If drm_fs_inode_new() fails in drm_dev_init(), dev->anon_inode will point
    to PTR_ERR(...) instead of NULL. This will result in null-ptr-deref when
    drm_fs_inode_free(dev->anon_inode) is called.

    drm_dev_init()
    drm_fs_inode_new() // fail, dev->anon_inode = PTR_ERR(...)
    drm_managed_release()
    drm_dev_init_release()
    drm_fs_inode_free() // access non-existent anon_inode

    Define a temp variable and assign it to dev->anon_inode if the temp
    variable is not PTR_ERR.

    Fixes: 2cbf7fc6718b ("drm: Use drmm_ for drm_dev_init cleanup")
    Reported-by: Hulk Robot <hulkci@huawei.com>
    Signed-off-by: Wang Hai <wanghai38@huawei.com>
    Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
    Link: https://patchwork.freedesktop.org/patch/msgid/20211013114139.4042207-1-wanghai38@huawei.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/gpu/drm/drm_drv.c | 9 ++++++---
    1 file changed, 6 insertions(+), 3 deletions(-)

    diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
    index 7a5097467ba5c..b3a1636d1b984 100644
    --- a/drivers/gpu/drm/drm_drv.c
    +++ b/drivers/gpu/drm/drm_drv.c
    @@ -581,6 +581,7 @@ static int drm_dev_init(struct drm_device *dev,
    const struct drm_driver *driver,
    struct device *parent)
    {
    + struct inode *inode;
    int ret;

    if (!drm_core_init_complete) {
    @@ -617,13 +618,15 @@ static int drm_dev_init(struct drm_device *dev,
    if (ret)
    return ret;

    - dev->anon_inode = drm_fs_inode_new();
    - if (IS_ERR(dev->anon_inode)) {
    - ret = PTR_ERR(dev->anon_inode);
    + inode = drm_fs_inode_new();
    + if (IS_ERR(inode)) {
    + ret = PTR_ERR(inode);
    DRM_ERROR("Cannot allocate anonymous inode: %d\n", ret);
    goto err;
    }

    + dev->anon_inode = inode;
    +
    if (drm_core_check_feature(dev, DRIVER_RENDER)) {
    ret = drm_minor_alloc(dev, DRM_MINOR_RENDER);
    if (ret)
    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-24 23:09    [W:2.298 / U:0.684 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site