linux-kernel - [PATCH] drm: Fix boot panic when register

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20170614211652.1882-1-logang@deltatee.com>
Date:   Wed, 14 Jun 2017 15:16:52 -0600
From:   Logan Gunthorpe <logang@...tatee.com>
To:     dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Cc:     Bjorn Helgaas <helgaas@...nel.org>,
        Logan Gunthorpe <logang@...tatee.com>,
        Daniel Vetter <daniel.vetter@...el.com>,
        Jani Nikula <jani.nikula@...ux.intel.com>,
        Sean Paul <seanpaul@...omium.org>,
        David Airlie <airlied@...ux.ie>
Subject: [PATCH] drm: Fix boot panic when register_chrdev fails

This is a bug found by the 0day kernel test robot. When drm is
compiled into the kernel, and register_chrdev fails (due, in this, case
to overfilling the chardev dynamic major numbers), a kernel panic
occurs on boot:

  BUG: unable to handle kernel NULL pointer dereference at
      00000000000000a8
  IP: down_write+0x2a/0x53
  Call Trace:
   start_creating+0x67/0x12e
   debugfs_create_dir+0x12/0x189
   drm_debugfs_init+0x7c/0x1b7
   ? ___might_sleep+0x172/0x192
   ? __might_sleep+0x6b/0xef
   drm_minor_register+0x6b/0x141
   drm_dev_register+0xcd/0x315
   ? pci_enable_device_flags+0x117/0x177
   drm_get_pci_dev+0x106/0x27a
   cirrus_pci_probe+0xfb/0x125
   pci_device_probe+0x11d/0x185
   ...

This is because when register_chrdev fails, it removes drm_debugfs_root.
However, seeing drm is not a module, nothing prevents other code from
calling drm_minor_register after drm_core_init failed and thus using an
invalid drm_debugfs_root.

This commit fixes this issue by setting drm_debugfs_root to NULL after
removal and checking that it's not NULL before using it.

Signed-off-by: Logan Gunthorpe <logang@...tatee.com>
Cc: Daniel Vetter <daniel.vetter@...el.com>
Cc: Jani Nikula <jani.nikula@...ux.intel.com>
Cc: Sean Paul <seanpaul@...omium.org>
Cc: David Airlie <airlied@...ux.ie>
Link: https://lkml.org/lkml/2017/6/4/107
---
 drivers/gpu/drm/drm_drv.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 37b8ad3e30d8..904420304b75 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -214,6 +214,9 @@ static int drm_minor_register(struct drm_device *dev, unsigned int type)
 
 	DRM_DEBUG("\n");
 
+	if (!drm_debugfs_root)
+		return -ENODEV;
+
 	minor = *drm_minor_get_slot(dev, type);
 	if (!minor)
 		return 0;
@@ -935,6 +938,7 @@ static void drm_core_exit(void)
 {
 	unregister_chrdev(DRM_MAJOR, "drm");
 	debugfs_remove(drm_debugfs_root);
+	drm_debugfs_root = NULL;
 	drm_sysfs_destroy();
 	idr_destroy(&drm_minors_idr);
 	drm_connector_ida_destroy();
-- 
2.11.0