[PATCH] drm/bochs: Do not put DRM device in PCI remove callback

[Thomas Zimmermann]

ping for review


Am 03.01.25 um 10:55 schrieb Thomas Zimmermann:
> Removing the bochs PCI device should mark the DRM device as unplugged
> without removing it. Hence clear the respective call to drm_dev_put()
> from bochs_pci_remove().
>
> Fixes a double unref in devm_drm_dev_init_release(). An example error
> message is shown below:
>
> [   32.958338] BUG: KASAN: use-after-free in drm_dev_put.part.0+0x1b/0x90
> [   32.958850] Write of size 4 at addr ffff888152134004 by task (udev-worker)/591
> [   32.959574] CPU: 3 UID: 0 PID: 591 Comm: (udev-worker) Tainted: G            E      6.13.0-rc2-1-default+ #3417
> [   32.960316] Tainted: [E]=UNSIGNED_MODULE
> [   32.960637] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014
> [   32.961429] Call Trace:
> [   32.961433]  <TASK>
> [   32.961439]  dump_stack_lvl+0x68/0x90
> [   32.961452]  print_address_description.constprop.0+0x88/0x330
> [   32.961461]  ? preempt_count_sub+0x14/0xc0
> [   32.961473]  print_report+0xe2/0x1d0
> [   32.961479]  ? srso_alias_return_thunk+0x5/0xfbef5
> [   32.963725]  ? __virt_addr_valid+0x143/0x320
> [   32.964077]  ? srso_alias_return_thunk+0x5/0xfbef5
> [   32.964463]  ? drm_dev_put.part.0+0x1b/0x90
> [   32.964817]  kasan_report+0xce/0x1a0
> [   32.965123]  ? drm_dev_put.part.0+0x1b/0x90
> [   32.965474]  kasan_check_range+0xff/0x1c0
> [   32.965806]  drm_dev_put.part.0+0x1b/0x90
> [   32.966138]  release_nodes+0x84/0xc0
> [   32.966447]  devres_release_all+0xd2/0x110
> [   32.966788]  ? __pfx_devres_release_all+0x10/0x10
> [   32.967177]  ? preempt_count_sub+0x14/0xc0
> [   32.967523]  device_unbind_cleanup+0x16/0xc0
> [   32.967886]  really_probe+0x1b7/0x570
> [   32.968207]  __driver_probe_device+0xca/0x1b0
> [   32.968568]  driver_probe_device+0x4a/0xf0
> [   32.968907]  __driver_attach+0x10b/0x290
> [   32.969239]  ? __pfx___driver_attach+0x10/0x10
> [   32.969598]  bus_for_each_dev+0xc0/0x110
> [   32.969923]  ? __pfx_bus_for_each_dev+0x10/0x10
> [   32.970291]  ? bus_add_driver+0x17a/0x2b0
> [   32.970622]  ? srso_alias_return_thunk+0x5/0xfbef5
> [   32.971011]  bus_add_driver+0x19a/0x2b0
> [   32.971335]  driver_register+0xd8/0x160
> [   32.971671]  ? __pfx_bochs_pci_driver_init+0x10/0x10 [bochs]
> [   32.972130]  do_one_initcall+0xba/0x390
> [...]
>
> After unplugging the DRM device, clients will close their references.
> Closing the final reference will also release the DRM device.
>
> Reported-by: Dr. David Alan Gilbert <dave at treblig.org>
> Closes: https://lore.kernel.org/lkml/Z18dbfDAiFadsSdg@gallifrey/
> Fixes: 04826f588682 ("drm/bochs: Allocate DRM device in struct bochs_device")
> Cc: Thomas Zimmermann <tzimmermann at suse.de>
> Cc: Gerd Hoffmann <kraxel at redhat.com>
> Cc: virtualization at lists.linux.dev
> Signed-off-by: Thomas Zimmermann <tzimmermann at suse.de>
> ---
>   drivers/gpu/drm/tiny/bochs.c | 1 -
>   1 file changed, 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/tiny/bochs.c b/drivers/gpu/drm/tiny/bochs.c
> index 89a699370a59..c67e1f906785 100644
> --- a/drivers/gpu/drm/tiny/bochs.c
> +++ b/drivers/gpu/drm/tiny/bochs.c
> @@ -757,7 +757,6 @@ static void bochs_pci_remove(struct pci_dev *pdev)
>   
>   	drm_dev_unplug(dev);
>   	drm_atomic_helper_shutdown(dev);
> -	drm_dev_put(dev);
>   }
>   
>   static void bochs_pci_shutdown(struct pci_dev *pdev)

-- 
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)