| Message ID | 20250211110912.15409-2-jose.exposito89@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/vkms: Allow to configure device | expand |
Hi Am 11.02.25 um 12:08 schrieb José Expósito: > If the driver initialization fails, the vkms_exit() function might > access an uninitialized or freed default_config pointer and it might > double free it. > > Fix both possible errors by initializing default_config only when the > driver initialization succeeded. Could you send this patch separately, so that it can go into drm-misc-fixes quickly? Best regards Thomas > > Reported-by: Louis Chauvet <louis.chauvet@bootlin.com> > Link: https://lore.kernel.org/all/Z5uDHcCmAwiTsGte@louis-chauvet-laptop/ > Fixes: 2df7af93fdad ("drm/vkms: Add vkms_config type") > Signed-off-by: José Expósito <jose.exposito89@gmail.com> > --- > drivers/gpu/drm/vkms/vkms_drv.c | 15 +++++++++------ > 1 file changed, 9 insertions(+), 6 deletions(-) > > diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c > index 7c142bfc3bd9..b6de91134a22 100644 > --- a/drivers/gpu/drm/vkms/vkms_drv.c > +++ b/drivers/gpu/drm/vkms/vkms_drv.c > @@ -235,17 +235,19 @@ static int __init vkms_init(void) > if (!config) > return -ENOMEM; > > - default_config = config; > - > config->cursor = enable_cursor; > config->writeback = enable_writeback; > config->overlay = enable_overlay; > > ret = vkms_create(config); > - if (ret) > + if (ret) { > kfree(config); > + return ret; > + } > > - return ret; > + default_config = config; > + > + return 0; > } > > static void vkms_destroy(struct vkms_config *config) > @@ -269,9 +271,10 @@ static void vkms_destroy(struct vkms_config *config) > > static void __exit vkms_exit(void) > { > - if (default_config->dev) > - vkms_destroy(default_config); > + if (!default_config) > + return; > > + vkms_destroy(default_config); > kfree(default_config); > } >
Hi Thomas, On Tue, Feb 11, 2025 at 03:33:55PM +0100, Thomas Zimmermann wrote: > Hi > > Am 11.02.25 um 12:08 schrieb José Expósito: > > If the driver initialization fails, the vkms_exit() function might > > access an uninitialized or freed default_config pointer and it might > > double free it. > > > > Fix both possible errors by initializing default_config only when the > > driver initialization succeeded. > > Could you send this patch separately, so that it can go into drm-misc-fixes > quickly? Sure, I just sent it as a separate patch. Thanks, Jose > Best regards > Thomas > > > > > Reported-by: Louis Chauvet <louis.chauvet@bootlin.com> > > Link: https://lore.kernel.org/all/Z5uDHcCmAwiTsGte@louis-chauvet-laptop/ > > Fixes: 2df7af93fdad ("drm/vkms: Add vkms_config type") > > Signed-off-by: José Expósito <jose.exposito89@gmail.com> > > --- > > drivers/gpu/drm/vkms/vkms_drv.c | 15 +++++++++------ > > 1 file changed, 9 insertions(+), 6 deletions(-) > > > > diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c > > index 7c142bfc3bd9..b6de91134a22 100644 > > --- a/drivers/gpu/drm/vkms/vkms_drv.c > > +++ b/drivers/gpu/drm/vkms/vkms_drv.c > > @@ -235,17 +235,19 @@ static int __init vkms_init(void) > > if (!config) > > return -ENOMEM; > > - default_config = config; > > - > > config->cursor = enable_cursor; > > config->writeback = enable_writeback; > > config->overlay = enable_overlay; > > ret = vkms_create(config); > > - if (ret) > > + if (ret) { > > kfree(config); > > + return ret; > > + } > > - return ret; > > + default_config = config; > > + > > + return 0; > > } > > static void vkms_destroy(struct vkms_config *config) > > @@ -269,9 +271,10 @@ static void vkms_destroy(struct vkms_config *config) > > static void __exit vkms_exit(void) > > { > > - if (default_config->dev) > > - vkms_destroy(default_config); > > + if (!default_config) > > + return; > > + vkms_destroy(default_config); > > kfree(default_config); > > } > > -- > -- > Thomas Zimmermann > Graphics Driver Developer > SUSE Software Solutions Germany GmbH > Frankenstrasse 146, 90461 Nuernberg, Germany > GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman > HRB 36809 (AG Nuernberg) >
diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c index 7c142bfc3bd9..b6de91134a22 100644 --- a/drivers/gpu/drm/vkms/vkms_drv.c +++ b/drivers/gpu/drm/vkms/vkms_drv.c @@ -235,17 +235,19 @@ static int __init vkms_init(void) if (!config) return -ENOMEM; - default_config = config; - config->cursor = enable_cursor; config->writeback = enable_writeback; config->overlay = enable_overlay; ret = vkms_create(config); - if (ret) + if (ret) { kfree(config); + return ret; + } - return ret; + default_config = config; + + return 0; } static void vkms_destroy(struct vkms_config *config) @@ -269,9 +271,10 @@ static void vkms_destroy(struct vkms_config *config) static void __exit vkms_exit(void) { - if (default_config->dev) - vkms_destroy(default_config); + if (!default_config) + return; + vkms_destroy(default_config); kfree(default_config); }
If the driver initialization fails, the vkms_exit() function might access an uninitialized or freed default_config pointer and it might double free it. Fix both possible errors by initializing default_config only when the driver initialization succeeded. Reported-by: Louis Chauvet <louis.chauvet@bootlin.com> Link: https://lore.kernel.org/all/Z5uDHcCmAwiTsGte@louis-chauvet-laptop/ Fixes: 2df7af93fdad ("drm/vkms: Add vkms_config type") Signed-off-by: José Expósito <jose.exposito89@gmail.com> --- drivers/gpu/drm/vkms/vkms_drv.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)