linux-kernel - Re: [PATCH] drm/vkms: Fix use after free and double free on init error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3af06a6e-adb9-4e72-ab4d-23dbf37258b4@bootlin.com>
Date: Wed, 12 Feb 2025 15:06:00 +0100
From: Louis Chauvet <louis.chauvet@...tlin.com>
To: Thomas Zimmermann <tzimmermann@...e.de>,
 José Expósito <jose.exposito89@...il.com>
Cc: hamohammed.sa@...il.com, simona@...ll.ch, melissa.srw@...il.com,
 maarten.lankhorst@...ux.intel.com, mripard@...nel.org, airlied@...il.com,
 sylphrenadin@...il.com, dri-devel@...ts.freedesktop.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm/vkms: Fix use after free and double free on init
 error



Le 12/02/2025 à 09:53, Thomas Zimmermann a écrit :
> 
> 
> Am 12.02.25 um 09:49 schrieb José Expósito:
>> If the driver initialization fails, the vkms_exit() function might
>> access an uninitialized or freed default_config pointer and it might
>> double free it.
>>
>> Fix both possible errors by initializing default_config only when the
>> driver initialization succeeded.
>>
>> Reported-by: Louis Chauvet <louis.chauvet@...tlin.com>
>> Link: https://lore.kernel.org/all/Z5uDHcCmAwiTsGte@louis-chauvet-laptop/
>> Fixes: 2df7af93fdad ("drm/vkms: Add vkms_config type")
>> Signed-off-by: José Expósito <jose.exposito89@...il.com>
> 
> Reviewed-by: Thomas Zimmermann <tzimmremann@...e.de>

Reviewed-by: Louis Chauvet <louis.chauvet@...tlin.com>

lore.kernel.org is broken currently, to avoid doing mistakes, I will 
wait for it to be working again so I can apply your patch using dim+b4.

(I removed danvet.vetter@...l.ch from CC, the mail server rejected the mail)

Thanks!
Louis Chauvet

> Thanks for posting this patch separately.
> 
> Best regards
> Thomas
> 
>> ---
>>    drivers/gpu/drm/vkms/vkms_drv.c | 15 +++++++++------
>>    1 file changed, 9 insertions(+), 6 deletions(-)
>>
>> diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
>> index 7c142bfc3bd9..b6de91134a22 100644
>> --- a/drivers/gpu/drm/vkms/vkms_drv.c
>> +++ b/drivers/gpu/drm/vkms/vkms_drv.c
>> @@ -235,17 +235,19 @@ static int __init vkms_init(void)
>>    	if (!config)
>>    		return -ENOMEM;
>>    
>> -	default_config = config;
>> -
>>    	config->cursor = enable_cursor;
>>    	config->writeback = enable_writeback;
>>    	config->overlay = enable_overlay;
>>    
>>    	ret = vkms_create(config);
>> -	if (ret)
>> +	if (ret) {
>>    		kfree(config);
>> +		return ret;
>> +	}
>>    
>> -	return ret;
>> +	default_config = config;
>> +
>> +	return 0;
>>    }
>>    
>>    static void vkms_destroy(struct vkms_config *config)
>> @@ -269,9 +271,10 @@ static void vkms_destroy(struct vkms_config *config)
>>    
>>    static void __exit vkms_exit(void)
>>    {
>> -	if (default_config->dev)
>> -		vkms_destroy(default_config);
>> +	if (!default_config)
>> +		return;
>>    
>> +	vkms_destroy(default_config);
>>    	kfree(default_config);
>>    }
>>    
> 

-- 
Louis Chauvet, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com