linux-kernel - Re: [PATCH 2/2] drm/ast: Fix connector leak during driver unload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20181129020034.GA10328@tungsten.ozlabs.ibm.com>
Date:   Thu, 29 Nov 2018 13:00:35 +1100
From:   Sam Bobroff <sbobroff@...ux.ibm.com>
To:     Dave Airlie <airlied@...il.com>
Cc:     Dave Airlie <airlied@...hat.com>, Dave Airlie <airlied@...ux.ie>,
        dri-devel <dri-devel@...ts.freedesktop.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 2/2] drm/ast: Fix connector leak during driver unload

On Thu, Nov 29, 2018 at 09:40:53AM +1000, Dave Airlie wrote:
> On Mon, 5 Nov 2018 at 15:59, Sam Bobroff <sbobroff@...ux.ibm.com> wrote:
> >
> > When unloading the ast driver, a warning message is printed by
> > drm_mode_config_cleanup() because a reference is still held to one of
> > the drm_connector structs.
> >
> > Correct this by calling drm_framebuffer_remove() in
> > ast_fbdev_destroy().
> >
> > Signed-off-by: Sam Bobroff <sbobroff@...ux.ibm.com>
> > ---
> >  drivers/gpu/drm/ast/ast_fb.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/drivers/gpu/drm/ast/ast_fb.c b/drivers/gpu/drm/ast/ast_fb.c
> > index 0cd827e11fa2..655372ea81e9 100644
> > --- a/drivers/gpu/drm/ast/ast_fb.c
> > +++ b/drivers/gpu/drm/ast/ast_fb.c
> > @@ -263,6 +263,10 @@ static void ast_fbdev_destroy(struct drm_device *dev,
> >  {
> >         struct ast_framebuffer *afb = &afbdev->afb;
> >
> > +       /* drm_framebuffer_remove() expects us to hold a ref, which it
> > +        * will drop, so take one: */
> > +       drm_framebuffer_get(&afb->base);
> > +       drm_framebuffer_remove(&afb->base);
> 
> This doesn't seem corret, no other driver does this pattern, and I
> can't believe ast is special here.
>
> The get just doesn't make sense.

Thanks for having a look at this, as I said in the cover letter I was
concerned that it might not be a good fix.

But the AST driver does seem to be special (or just old?) because it
embeds the drm_framebuffer directly into ast_fbdev and (almost all)
other drivers dynamically allocate and reference count theirs.

The drm_framebuffer_get() certainly looks weird but it is there in order
to cause drm_framebuffer_remove() to call legacy_remove_fb(), which it
won't do unless the refcount is at least 2. (And because the
drm_framebuffer isn't dynamically allocated in this case we don't really
care about the reference count anyway.)

An alternative might be to call legacy_remove_fb() directly, but it's
declared static.  Do you think it would be better to expose it and call
it directly from the AST driver code? Or is there some other better way
to put the drm_connectors?

> Dave.

Cheers,
Sam.

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)