linux-kernel - Re: [PATCH v2] gpu: radeon: fix a potential NULL-pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <deadaf61-e92f-829c-8a96-7017519c5617@daenzer.net>
Date:   Tue, 26 Mar 2019 10:51:04 +0100
From:   Michel Dänzer <michel@...nzer.net>
To:     Kangjie Lu <kjlu@....edu>
Cc:     "David (ChunMing) Zhou" <David1.Zhou@....com>,
        David Airlie <airlied@...ux.ie>, linux-kernel@...r.kernel.org,
        amd-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
        Daniel Vetter <daniel@...ll.ch>, pakki001@....edu,
        Alex Deucher <alexander.deucher@....com>,
        Christian König <christian.koenig@....com>
Subject: Re: [PATCH v2] gpu: radeon: fix a potential NULL-pointer dereference

On 2019-03-25 10:05 p.m., Kangjie Lu wrote:
> In case alloc_workqueue fails, the fix frees memory and
> returns -ENOMEM to avoid potential NULL pointer dereference.
> 
> Signed-off-by: Kangjie Lu <kjlu@....edu>
> ---
> v2: use radeon_crtc_destroy to properly clean up resources as
> suggested by Michel Dänzer <michel@...nzer.net>
> 
>  [...]
> 
> @@ -671,13 +671,18 @@ static void radeon_crtc_init(struct drm_device *dev, int index)
>  
>  	radeon_crtc = kzalloc(sizeof(struct radeon_crtc) + (RADEONFB_CONN_LIMIT * sizeof(struct drm_connector *)), GFP_KERNEL);
>  	if (radeon_crtc == NULL)
> -		return;
> +		return -ENOMEM;
>  
>  	drm_crtc_init(dev, &radeon_crtc->base, &radeon_crtc_funcs);
>  
>  	drm_mode_crtc_set_gamma_size(&radeon_crtc->base, 256);
>  	radeon_crtc->crtc_id = index;
>  	radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0);
> +	if (!radeon_crtc->flip_queue) {
> +		DRM_ERROR("failed to allocate the flip queue\n");
> +		radeon_crtc_destroy(&radeon_crtc->base);
> +		return -ENOMEM;
> +	}

radeon_crtc_destroy currently unconditionally calls:

	destroy_workqueue(radeon_crtc->flip_queue);

AFAICT destroy_workqueue will blow up if NULL is passed to it, so
radeon_crtc_destroy needs to check for that.


-- 
Earthling Michel Dänzer               |              https://www.amd.com
Libre software enthusiast             |             Mesa and X developer