linux-kernel - [PATCH 1/3] drm/ttm: Reset num_zones on ttm_mem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190414233729.17956-2-itsbriany@gmail.com>
Date:   Sun, 14 Apr 2019 23:37:27 +0000
From:   Brian Yip <itsbriany@...il.com>
To:     christian.koenig@....com
Cc:     ray.huang@....com, Jerry.Zhang@....com, airlied@...ux.ie,
        daniel@...ll.ch, dri-devel@...ts.freedesktop.org,
        linux-kernel@...r.kernel.org, Brian Yip <itsbriany@...il.com>
Subject: [PATCH 1/3] drm/ttm: Reset num_zones on ttm_mem_global cleanup

num_zones in the ttm_mem_global structure was never reset after calling
ttm_mem_global_release(). Consequently, when multiple GPU drivers
are loaded, and the first one fails to load its firmware, the second
driver will attempt to load its own firmware. Initializing the
second driver invokes ttm_mem_global_init where ttm_mem_global.num_zones
is eventually incremented beyond TTM_MEM_MAX_ZONES.
ttm_mem_global.num_zones is then used to dereference a ttm_mem_zone beyond
the amount of ttm_mem_zones allocated, resulting in a crash.

Signed-off-by: Brian Yip <itsbriany@...il.com>
---
 drivers/gpu/drm/ttm/ttm_memory.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpu/drm/ttm/ttm_memory.c b/drivers/gpu/drm/ttm/ttm_memory.c
index 699fed9e08ee..55ccb9800893 100644
--- a/drivers/gpu/drm/ttm/ttm_memory.c
+++ b/drivers/gpu/drm/ttm/ttm_memory.c
@@ -478,6 +478,9 @@ void ttm_mem_global_release(struct ttm_mem_global *glob)
 			}
 	kobject_del(&glob->kobj);
 	kobject_put(&glob->kobj);
+
+	if (!kref_read(&glob->kobj.kref))
+		glob->num_zones = 0;
 }

 static void ttm_check_swapping(struct ttm_mem_global *glob)
-- 
2.20.1