lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Mon, 15 Apr 2019 06:25:44 +0000
From:   "Koenig, Christian" <Christian.Koenig@....com>
To:     Brian Yip <itsbriany@...il.com>
CC:     "Huang, Ray" <Ray.Huang@....com>,
        "Zhang, Jerry" <Jerry.Zhang@....com>,
        "airlied@...ux.ie" <airlied@...ux.ie>,
        "daniel@...ll.ch" <daniel@...ll.ch>,
        "dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/3] drm/ttm: Reset num_zones on ttm_mem_global cleanup

Am 15.04.19 um 01:37 schrieb Brian Yip:
> num_zones in the ttm_mem_global structure was never reset after calling
> ttm_mem_global_release(). Consequently, when multiple GPU drivers
> are loaded, and the first one fails to load its firmware, the second
> driver will attempt to load its own firmware. Initializing the
> second driver invokes ttm_mem_global_init where ttm_mem_global.num_zones
> is eventually incremented beyond TTM_MEM_MAX_ZONES.
> ttm_mem_global.num_zones is then used to dereference a ttm_mem_zone beyond
> the amount of ttm_mem_zones allocated, resulting in a crash.
>
> Signed-off-by: Brian Yip <itsbriany@...il.com>
> ---
>   drivers/gpu/drm/ttm/ttm_memory.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_memory.c b/drivers/gpu/drm/ttm/ttm_memory.c
> index 699fed9e08ee..55ccb9800893 100644
> --- a/drivers/gpu/drm/ttm/ttm_memory.c
> +++ b/drivers/gpu/drm/ttm/ttm_memory.c
> @@ -478,6 +478,9 @@ void ttm_mem_global_release(struct ttm_mem_global *glob)
>   			}
>   	kobject_del(&glob->kobj);
>   	kobject_put(&glob->kobj);
> +
> +	if (!kref_read(&glob->kobj.kref))
> +		glob->num_zones = 0;

NAK. It's nice to see that somebody tries to take care of this problem, 
but this is certainly not the right fix.

Instead of all of this the problem is simply that the glob structure is 
not zero initialized in ttm_mem_global_init(), a simple memset should do 
the trick.

Regards,
Christian.

>   }
>   
>   static void ttm_check_swapping(struct ttm_mem_global *glob)

Powered by blists - more mailing lists