linux-kernel - Re: [PATCH] drm/vkms: Fix use after free and double free on init error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <bfc71d72-2f23-4c8c-b278-7e9aad3bf72d@suse.de>
Date: Wed, 12 Feb 2025 09:53:09 +0100
From: Thomas Zimmermann <tzimmermann@...e.de>
To: José Expósito <jose.exposito89@...il.com>,
 louis.chauvet@...tlin.com
Cc: hamohammed.sa@...il.com, simona@...ll.ch, melissa.srw@...il.com,
 maarten.lankhorst@...ux.intel.com, mripard@...nel.org, airlied@...il.com,
 danvet.vetter@...l.ch, sylphrenadin@...il.com,
 dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm/vkms: Fix use after free and double free on init
 error



Am 12.02.25 um 09:49 schrieb José Expósito:
> If the driver initialization fails, the vkms_exit() function might
> access an uninitialized or freed default_config pointer and it might
> double free it.
>
> Fix both possible errors by initializing default_config only when the
> driver initialization succeeded.
>
> Reported-by: Louis Chauvet <louis.chauvet@...tlin.com>
> Link: https://lore.kernel.org/all/Z5uDHcCmAwiTsGte@louis-chauvet-laptop/
> Fixes: 2df7af93fdad ("drm/vkms: Add vkms_config type")
> Signed-off-by: José Expósito <jose.exposito89@...il.com>

Reviewed-by: Thomas Zimmermann <tzimmremann@...e.de>

Thanks for posting this patch separately.

Best regards
Thomas

> ---
>   drivers/gpu/drm/vkms/vkms_drv.c | 15 +++++++++------
>   1 file changed, 9 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
> index 7c142bfc3bd9..b6de91134a22 100644
> --- a/drivers/gpu/drm/vkms/vkms_drv.c
> +++ b/drivers/gpu/drm/vkms/vkms_drv.c
> @@ -235,17 +235,19 @@ static int __init vkms_init(void)
>   	if (!config)
>   		return -ENOMEM;
>   
> -	default_config = config;
> -
>   	config->cursor = enable_cursor;
>   	config->writeback = enable_writeback;
>   	config->overlay = enable_overlay;
>   
>   	ret = vkms_create(config);
> -	if (ret)
> +	if (ret) {
>   		kfree(config);
> +		return ret;
> +	}
>   
> -	return ret;
> +	default_config = config;
> +
> +	return 0;
>   }
>   
>   static void vkms_destroy(struct vkms_config *config)
> @@ -269,9 +271,10 @@ static void vkms_destroy(struct vkms_config *config)
>   
>   static void __exit vkms_exit(void)
>   {
> -	if (default_config->dev)
> -		vkms_destroy(default_config);
> +	if (!default_config)
> +		return;
>   
> +	vkms_destroy(default_config);
>   	kfree(default_config);
>   }
>   

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)