[PATCH v2] drm: fix crash in drm_minor_alloc_release

[Daniel Vetter]

On Tue, Nov 08, 2022 at 07:38:23PM +0100, Stanislaw Gruszka wrote:
> If drm_sysfs_minor_alloc() fail in drm_minor_alloc() we can end up
> freeing invalid minor->kdev pointer and drm_minor_alloc_release()
> will crash like below:
> 
> RIP: 0010:kobject_put+0x19/0x1c0
> RSP: 0018:ffffbc7001637c38 EFLAGS: 00010282
> RAX: ffffffffa8d6deb0 RBX: 00000000ffffffff RCX: ffff9cb5912d4540
> RDX: ffffffffa9c45ec5 RSI: ffff9cb5902f2b68 RDI: fffffffffffffff4
> RBP: fffffffffffffff4 R08: ffffffffa9c40dec R09: 0000000000000008
> R10: ffffffffaa81f7d2 R11: 00000000aa81f7ca R12: ffff9cb5912d4540
> R13: ffff9cb5912d4540 R14: dead000000000122 R15: dead000000000100
> FS:  00007f56b06e6740(0000) GS:ffff9cb728b40000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000030 CR3: 000000011285b004 CR4: 0000000000170ee0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7: 0000000000000400
> Call Trace:
>  <TASK>
>  drm_minor_alloc_release+0x19/0x50
>  drm_managed_release+0xab/0x150
>  drm_dev_init+0x21f/0x2f0
>  __devm_drm_dev_alloc+0x3c/0xa0
>  ivpu_probe+0x59/0x797 [intel_vpu 127058409b05eb2f99dcdecd3330bee28d6b3e76]
>  pci_device_probe+0xa4/0x160
>  really_probe+0x164/0x340
>  __driver_probe_device+0x10d/0x190
>  device_driver_attach+0x26/0x50
>  bind_store+0x9f/0x120
>  kernfs_fop_write_iter+0x12d/0x1c0
>  new_sync_write+0x106/0x180
>  vfs_write+0x216/0x2a0
>  ksys_write+0x65/0xe0
>  do_syscall_64+0x35/0x80
>  entry_SYSCALL_64_after_hwframe+0x44/0xae
> 
> Fix this crash by returning NULL minor->kdev on error.
> 
> Fixes: f96306f9892b ("drm: manage drm_minor cleanup with drmm_")
> Signed-off-by: Stanislaw Gruszka <stanislaw.gruszka at linux.intel.com>

Reviewed-by: Daniel Vetter <daniel.vetter at ffwll.ch>

On the entire drmm thing, you can avoid these if you do a drmm for every
little thing, that way you never get stuff that might or might not be set
up in the cleanup handler. But for one-off internal things that's a bit
overkill, and C utterly sucks at taking care of the boilerplate.
-Daniel

> ---
> v2: return minor->kdev NULL pointer instead of checking for IS_ERR in
>     drm_minor_alloc_release()
> 
>  drivers/gpu/drm/drm_drv.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
> index 8214a0b1ab7f..8d70b634d008 100644
> --- a/drivers/gpu/drm/drm_drv.c
> +++ b/drivers/gpu/drm/drm_drv.c
> @@ -142,8 +142,11 @@ static int drm_minor_alloc(struct drm_device *dev, unsigned int type)
>  		return r;
>  
>  	minor->kdev = drm_sysfs_minor_alloc(minor);
> -	if (IS_ERR(minor->kdev))
> -		return PTR_ERR(minor->kdev);
> +	if (IS_ERR(minor->kdev)) {
> +		r = PTR_ERR(minor->kdev);
> +		minor->kdev = NULL;
> +		return r;
> +	}
>  
>  	*drm_minor_get_slot(dev, type) = minor;
>  	return 0;
> -- 
> 2.25.1
> 

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch