[PATCH] drm/hisilicon: Fix use-after-free

[Daniel Vetter]

On Mon, Dec 14, 2020 at 12:17 PM Thomas Zimmermann <tzimmermann at suse.de> wrote:
>
> Hi
>
> Am 14.12.20 um 11:32 schrieb Tian Tao:
> > Fix the problem of dev being released twice.
> > ------------[ cut here ]------------
> > refcount_t: underflow; use-after-free.
> > WARNING: CPU: 75 PID: 15700 at lib/refcount.c:28 refcount_warn_saturate+0xd4/0x150
> > CPU: 75 PID: 15700 Comm: rmmod Tainted: G            E     5.10.0-rc3+ #3
> > Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDDA, BIOS 0.88 07/24/2019
> > pstate: 40400009 (nZcv daif +PAN -UAO -TCO BTYPE=--)
> > pc : refcount_warn_saturate+0xd4/0x150
> > lr : refcount_warn_saturate+0xd4/0x150
> > sp : ffff2028150cbc00
> > x29: ffff2028150cbc00 x28: ffff2028150121c0
> > x27: 0000000000000000 x26: 0000000000000000
> > x25: 0000000000000000 x24: 0000000000000003
> > x23: 0000000000000000 x22: ffff2028150cbc90
> > x21: ffff2020038a30a8 x20: ffff2028150cbc90
> > x19: ffff0020cd938020 x18: 0000000000000010
> > x17: 0000000000000000 x16: 0000000000000000
> > x15: ffffffffffffffff x14: ffff2028950cb88f
> > x13: ffff2028150cb89d x12: 0000000000000000
> > x11: 0000000005f5e0ff x10: ffff2028150cb800
> > x9 : 00000000ffffffd0 x8 : 75203b776f6c6672
> > x7 : ffff800011a6f7c8 x6 : 0000000000000001
> > x5 : 0000000000000000 x4 : 0000000000000000
> > x3 : 0000000000000000 x2 : ffff202ffe2f9dc0
> > x1 : ffffa02fecf40000 x0 : 0000000000000026
> > Call trace:
> >   refcount_warn_saturate+0xd4/0x150
> >   devm_drm_dev_init_release+0x50/0x70
> >   devm_action_release+0x20/0x30
> >   release_nodes+0x13c/0x218
> >   devres_release_all+0x80/0x170
> >   device_release_driver_internal+0x128/0x1f0
> >   driver_detach+0x6c/0xe0
> >   bus_remove_driver+0x74/0x100
> >   driver_unregister+0x34/0x60
> >   pci_unregister_driver+0x24/0xd8
> >   hibmc_pci_driver_exit+0x14/0xe858 [hibmc_drm]
> >   __arm64_sys_delete_module+0x1fc/0x2d0
> >   el0_svc_common.constprop.3+0xa8/0x188
> >   do_el0_svc+0x80/0xa0
> >   el0_sync_handler+0x8c/0xb0
> >   el0_sync+0x15c/0x180
> > CPU: 75 PID: 15700 Comm: rmmod Tainted: G            E     5.10.0-rc3+ #3
> > Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDDA, BIOS 0.88 07/24/2019
> > Call trace:
> >   dump_backtrace+0x0/0x208
> >   show_stack+0x2c/0x40
> >   dump_stack+0xd8/0x10c
> >   __warn+0xac/0x128
> >   report_bug+0xcc/0x180
> >   bug_handler+0x24/0x78
> >   call_break_hook+0x80/0xa0
> >   brk_handler+0x28/0x68
> >   do_debug_exception+0x9c/0x148
> >   el1_sync_handler+0x7c/0x128
> >   el1_sync+0x80/0x100
> >   refcount_warn_saturate+0xd4/0x150
> >   devm_drm_dev_init_release+0x50/0x70
> >   devm_action_release+0x20/0x30
> >   release_nodes+0x13c/0x218
> >   devres_release_all+0x80/0x170
> >   device_release_driver_internal+0x128/0x1f0
> >   driver_detach+0x6c/0xe0
> >   bus_remove_driver+0x74/0x100
> >   driver_unregister+0x34/0x60
> >   pci_unregister_driver+0x24/0xd8
> >   hibmc_pci_driver_exit+0x14/0xe858 [hibmc_drm]
> >   __arm64_sys_delete_module+0x1fc/0x2d0
> >   el0_svc_common.constprop.3+0xa8/0x188
> >   do_el0_svc+0x80/0xa0
> >   el0_sync_handler+0x8c/0xb0
> >   el0_sync+0x15c/0x180
> > ---[ end trace 00718630d6e5ff18 ]---
> >
> > Signed-off-by: Tian Tao <tiantao6 at hisilicon.com>
>
> Acked-by: Thomas Zimmermann <tzimmermann at suse.de>
>
> > ---
> >   drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 1 -
> >   1 file changed, 1 deletion(-)
> >
> > diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
> > index 7e91ef1..e3ab765b 100644
> > --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
> > +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
> > @@ -364,7 +364,6 @@ static void hibmc_pci_remove(struct pci_dev *pdev)
> >
> >       drm_dev_unregister(dev);
> >       hibmc_unload(dev);
> > -     drm_dev_put(dev);

This is incomplete, you also need to remove the drm_dev_put from
hibmc_pci_probe.

Cheers, Daniel

> >   }
> >
> >   static const struct pci_device_id hibmc_pci_table[] = {
> >
>
> --
> Thomas Zimmermann
> Graphics Driver Developer
> SUSE Software Solutions Germany GmbH
> Maxfeldstr. 5, 90409 Nürnberg, Germany
> (HRB 36809, AG Nürnberg)
> Geschäftsführer: Felix Imendörffer
>


-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch