| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <df1a9d34-a552-4450-999f-a13bea6005b1@bootlin.com>
Date: Fri, 14 Feb 2025 18:02:11 +0100
From: Louis Chauvet <louis.chauvet@...tlin.com>
To: José Expósito <jose.exposito89@...il.com>
Cc: Thomas Zimmermann <tzimmermann@...e.de>, hamohammed.sa@...il.com,
simona@...ll.ch, melissa.srw@...il.com, maarten.lankhorst@...ux.intel.com,
mripard@...nel.org, airlied@...il.com, sylphrenadin@...il.com,
dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] drm/vkms: Fix use after free and double free on init
error
Le 14/02/2025 à 16:44, José Expósito a écrit :
> On Thu, Feb 13, 2025 at 04:11:20PM +0100, Louis Chauvet wrote:
>> On 12/02/25 - 15:06, Louis Chauvet wrote:
>>>
>>>
>>> Le 12/02/2025 à 09:53, Thomas Zimmermann a écrit :
>>>>
>>>>
>>>> Am 12.02.25 um 09:49 schrieb José Expósito:
>>>>> If the driver initialization fails, the vkms_exit() function might
>>>>> access an uninitialized or freed default_config pointer and it might
>>>>> double free it.
>>>>>
>>>>> Fix both possible errors by initializing default_config only when the
>>>>> driver initialization succeeded.
>>>>>
>>>>> Reported-by: Louis Chauvet <louis.chauvet@...tlin.com>
>>>>> Link: https://lore.kernel.org/all/Z5uDHcCmAwiTsGte@louis-chauvet-laptop/
>>>>> Fixes: 2df7af93fdad ("drm/vkms: Add vkms_config type")
>>>>> Signed-off-by: José Expósito <jose.exposito89@...il.com>
>>>>
>>>> Reviewed-by: Thomas Zimmermann <tzimmremann@...e.de>
>>>
>>> Reviewed-by: Louis Chauvet <louis.chauvet@...tlin.com>
>>>
>>> lore.kernel.org is broken currently, to avoid doing mistakes, I will wait
>>> for it to be working again so I can apply your patch using dim+b4.
>>>
>>> (I removed danvet.vetter@...l.ch from CC, the mail server rejected the mail)
>>>
>>> Thanks!
>>> Louis Chauvet
>>
>> Hello,
>>
>> I tried to apply the commit, but I have a strange issue:
>>
>> $ dim push
>> Enumerating objects: 13, done.
>> Counting objects: 100% (13/13), done.
>> Delta compression using up to 20 threads
>> Compressing objects: 100% (7/7), done.
>> Writing objects: 100% (7/7), 1.67 KiB | 113.00 KiB/s, done.
>> Total 7 (delta 6), reused 0 (delta 0), pack-reused 0 (from 0)
>> remote:
>> remote: ========================================================================
>> remote:
>> remote: Equinix is shutting down its operations with us on April 30, 2025.
>> remote: They have graciously supported us for almost 5 years, but all good
>> remote: things come to an end. Given the time frame, it's going to be hard
>> remote: to make a smooth transition of the cluster to somewhere else
>> remote: ([TBD](https://gitlab.freedesktop.org/freedesktop/freedesktop/-/issues/2011)).
>> remote: Please expect in the next months some hiccups in the service and
>> remote: probably at least a full week of downtime to transfer gitlab to a
>> remote: different place. All help is appreciated.
>> remote:
>> remote: ========================================================================
>> remote:
>> To gitlab.freedesktop.org:drm/misc/kernel.git
>> ff3881cc6a58..ed15511a773d drm-misc-next -> drm-misc-next
>> Pushing drm-misc-fixes to for-linux-next-fixes... Everything up-to-date
>> Done.
>> Out of merge window. Pushing drm-misc-next to for-linux-next...
>> remote:
>> remote: ========================================================================
>> remote:
>> remote: ERROR: Internal API unreachable
>>
>> remote:
>> remote: ========================================================================
>> remote:
>> fatal: Could not read from remote repository.
>>
>> Please make sure you have the correct access rights
>> and the repository exists.
>>
>> Is this expected?
>
> I guess you managed to fix the issue. I git pull-ed this morning and
> the patch was applied.
It is applied to drm-misc/drm-misc-next, but not on drm-misc/for-linux-next.
I don't know if this is important and how to fix the issue if yes.
Louis Chauvet
> Jose
>
>> Thanks,
>> Louis Chauvet
>>
>>>> Thanks for posting this patch separately.
>>>>
>>>> Best regards
>>>> Thomas
>>>>
>>>>> ---
>>>>> drivers/gpu/drm/vkms/vkms_drv.c | 15 +++++++++------
>>>>> 1 file changed, 9 insertions(+), 6 deletions(-)
>>>>>
>>>>> diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
>>>>> index 7c142bfc3bd9..b6de91134a22 100644
>>>>> --- a/drivers/gpu/drm/vkms/vkms_drv.c
>>>>> +++ b/drivers/gpu/drm/vkms/vkms_drv.c
>>>>> @@ -235,17 +235,19 @@ static int __init vkms_init(void)
>>>>> if (!config)
>>>>> return -ENOMEM;
>>>>> - default_config = config;
>>>>> -
>>>>> config->cursor = enable_cursor;
>>>>> config->writeback = enable_writeback;
>>>>> config->overlay = enable_overlay;
>>>>> ret = vkms_create(config);
>>>>> - if (ret)
>>>>> + if (ret) {
>>>>> kfree(config);
>>>>> + return ret;
>>>>> + }
>>>>> - return ret;
>>>>> + default_config = config;
>>>>> +
>>>>> + return 0;
>>>>> }
>>>>> static void vkms_destroy(struct vkms_config *config)
>>>>> @@ -269,9 +271,10 @@ static void vkms_destroy(struct vkms_config *config)
>>>>> static void __exit vkms_exit(void)
>>>>> {
>>>>> - if (default_config->dev)
>>>>> - vkms_destroy(default_config);
>>>>> + if (!default_config)
>>>>> + return;
>>>>> + vkms_destroy(default_config);
>>>>> kfree(default_config);
>>>>> }
>>>>
>>>
>>> --
>>> Louis Chauvet, Bootlin
>>> Embedded Linux and Kernel engineering
>>> https://bootlin.com
>>>
--
Louis Chauvet, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
Powered by blists - more mailing lists