From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Tian Tao <tiantao6@hisilicon.com>,
Thomas Zimmermann <tzimmermann@suse.de>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.4 41/72] drm/hisilicon: Fix use-after-free
Date: Fri, 5 Mar 2021 13:21:43 +0100 [thread overview]
Message-ID: <20210305120859.355536960@linuxfoundation.org> (raw)
In-Reply-To: <20210305120857.341630346@linuxfoundation.org>
From: Tian Tao <tiantao6@hisilicon.com>
[ Upstream commit c855af2f9c5c60760fd1bed7889a81bc37d2591d ]
Fix the problem of dev being released twice.
------------[ cut here ]------------
refcount_t: underflow; use-after-free.
WARNING: CPU: 75 PID: 15700 at lib/refcount.c:28 refcount_warn_saturate+0xd4/0x150
CPU: 75 PID: 15700 Comm: rmmod Tainted: G E 5.10.0-rc3+ #3
Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDDA, BIOS 0.88 07/24/2019
pstate: 40400009 (nZcv daif +PAN -UAO -TCO BTYPE=--)
pc : refcount_warn_saturate+0xd4/0x150
lr : refcount_warn_saturate+0xd4/0x150
sp : ffff2028150cbc00
x29: ffff2028150cbc00 x28: ffff2028150121c0
x27: 0000000000000000 x26: 0000000000000000
x25: 0000000000000000 x24: 0000000000000003
x23: 0000000000000000 x22: ffff2028150cbc90
x21: ffff2020038a30a8 x20: ffff2028150cbc90
x19: ffff0020cd938020 x18: 0000000000000010
x17: 0000000000000000 x16: 0000000000000000
x15: ffffffffffffffff x14: ffff2028950cb88f
x13: ffff2028150cb89d x12: 0000000000000000
x11: 0000000005f5e0ff x10: ffff2028150cb800
x9 : 00000000ffffffd0 x8 : 75203b776f6c6672
x7 : ffff800011a6f7c8 x6 : 0000000000000001
x5 : 0000000000000000 x4 : 0000000000000000
x3 : 0000000000000000 x2 : ffff202ffe2f9dc0
x1 : ffffa02fecf40000 x0 : 0000000000000026
Call trace:
refcount_warn_saturate+0xd4/0x150
devm_drm_dev_init_release+0x50/0x70
devm_action_release+0x20/0x30
release_nodes+0x13c/0x218
devres_release_all+0x80/0x170
device_release_driver_internal+0x128/0x1f0
driver_detach+0x6c/0xe0
bus_remove_driver+0x74/0x100
driver_unregister+0x34/0x60
pci_unregister_driver+0x24/0xd8
hibmc_pci_driver_exit+0x14/0xe858 [hibmc_drm]
__arm64_sys_delete_module+0x1fc/0x2d0
el0_svc_common.constprop.3+0xa8/0x188
do_el0_svc+0x80/0xa0
el0_sync_handler+0x8c/0xb0
el0_sync+0x15c/0x180
CPU: 75 PID: 15700 Comm: rmmod Tainted: G E 5.10.0-rc3+ #3
Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDDA, BIOS 0.88 07/24/2019
Call trace:
dump_backtrace+0x0/0x208
show_stack+0x2c/0x40
dump_stack+0xd8/0x10c
__warn+0xac/0x128
report_bug+0xcc/0x180
bug_handler+0x24/0x78
call_break_hook+0x80/0xa0
brk_handler+0x28/0x68
do_debug_exception+0x9c/0x148
el1_sync_handler+0x7c/0x128
el1_sync+0x80/0x100
refcount_warn_saturate+0xd4/0x150
devm_drm_dev_init_release+0x50/0x70
devm_action_release+0x20/0x30
release_nodes+0x13c/0x218
devres_release_all+0x80/0x170
device_release_driver_internal+0x128/0x1f0
driver_detach+0x6c/0xe0
bus_remove_driver+0x74/0x100
driver_unregister+0x34/0x60
pci_unregister_driver+0x24/0xd8
hibmc_pci_driver_exit+0x14/0xe858 [hibmc_drm]
__arm64_sys_delete_module+0x1fc/0x2d0
el0_svc_common.constprop.3+0xa8/0x188
do_el0_svc+0x80/0xa0
el0_sync_handler+0x8c/0xb0
el0_sync+0x15c/0x180
---[ end trace 00718630d6e5ff18 ]---
Signed-off-by: Tian Tao <tiantao6@hisilicon.com>
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/1607941973-32287-1-git-send-email-tiantao6@hisilicon.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
index c103005b0a33..a34ef5ec7d42 100644
--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
+++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
@@ -376,7 +376,6 @@ static void hibmc_pci_remove(struct pci_dev *pdev)
drm_dev_unregister(dev);
hibmc_unload(dev);
- drm_dev_put(dev);
}
static struct pci_device_id hibmc_pci_table[] = {
--
2.30.1
next prev parent reply other threads:[~2021-03-05 12:35 UTC|newest]
Thread overview: 81+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-05 12:21 [PATCH 5.4 00/72] 5.4.103-rc1 review Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 01/72] net: usb: qmi_wwan: support ZTE P685M modem Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 02/72] Input: elantech - fix protocol errors for some trackpoints in SMBus mode Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 03/72] nvme-pci: refactor nvme_unmap_data Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 04/72] nvme-pci: fix error unwind in nvme_map_data Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 05/72] arm64 module: set plt* section addresses to 0x0 Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 06/72] MIPS: VDSO: Use CLANG_FLAGS instead of filtering out --target= Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 07/72] JFS: more checks for invalid superblock Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 08/72] udlfb: Fix memory leak in dlfb_usb_probe Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 09/72] media: mceusb: sanity check for prescaler value Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 10/72] erofs: fix shift-out-of-bounds of blkszbits Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 11/72] media: v4l2-ctrls.c: fix shift-out-of-bounds in std_validate Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 12/72] xfs: Fix assert failure in xfs_setattr_size() Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 13/72] net/af_iucv: remove WARN_ONCE on malformed RX packets Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 14/72] smackfs: restrict bytes count in smackfs write functions Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 15/72] net: fix up truesize of cloned skb in skb_prepare_for_shift() Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 16/72] nbd: handle device refs for DESTROY_ON_DISCONNECT properly Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 17/72] mm/hugetlb.c: fix unnecessary address expansion of pmd sharing Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 18/72] net: bridge: use switchdev for port flags set through sysfs too Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 19/72] net: ag71xx: remove unnecessary MTU reservation Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 20/72] net: fix dev_ifsioc_locked() race condition Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 21/72] dt-bindings: ethernet-controller: fix fixed-link specification Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 22/72] dt-bindings: net: btusb: DT fix s/interrupt-name/interrupt-names/ Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 23/72] MIPS: Drop 32-bit asm string functions Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 24/72] drm/virtio: use kvmalloc for large allocations Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 25/72] rsi: Fix TX EAPOL packet handling against iwlwifi AP Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 26/72] rsi: Move card interrupt handling to RX thread Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 27/72] rcu/nocb: Trigger self-IPI on late deferred wake up before user resume Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 28/72] staging: fwserial: Fix error handling in fwserial_create Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 29/72] x86/reboot: Add Zotac ZBOX CI327 nano PCI reboot quirk Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 30/72] vt/consolemap: do font sum unsigned Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 31/72] wlcore: Fix command execute failure 19 for wl12xx Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 32/72] Bluetooth: hci_h5: Set HCI_QUIRK_SIMULTANEOUS_DISCOVERY for btrtl Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 33/72] pktgen: fix misuse of BUG_ON() in pktgen_thread_worker() Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 34/72] ath10k: fix wmi mgmt tx queue full due to race condition Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 35/72] x86/build: Treat R_386_PLT32 relocation as R_386_PC32 Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 36/72] Bluetooth: Fix null pointer dereference in amp_read_loc_assoc_final_data Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 37/72] staging: most: sound: add sanity check for function argument Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 38/72] staging: bcm2835-audio: Replace unsafe strcpy() with strscpy() Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 39/72] brcmfmac: Add DMI nvram filename quirk for Predia Basic tablet Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 40/72] brcmfmac: Add DMI nvram filename quirk for Voyo winpad A15 tablet Greg Kroah-Hartman
2021-03-05 12:21 ` Greg Kroah-Hartman [this message]
2021-03-05 12:21 ` [PATCH 5.4 42/72] crypto: tcrypt - avoid signed overflow in byte count Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 43/72] drm/amdgpu: Add check to prevent IH overflow Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 44/72] PCI: Add a REBAR size quirk for Sapphire RX 5600 XT Pulse Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 45/72] drm/amd/display: Guard against NULL pointer deref when get_i2c_info fails Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 46/72] media: uvcvideo: Allow entities with no pads Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 47/72] f2fs: handle unallocated section and zone on pinned/atgc Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 48/72] f2fs: fix to set/clear I_LINKABLE under i_lock Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 49/72] nvme-core: add cancel tagset helpers Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 50/72] nvme-rdma: add clean action for failed reconnection Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 51/72] nvme-tcp: " Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 52/72] ASoC: Intel: Add DMI quirk table to soc_intel_is_byt_cr() Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 53/72] btrfs: fix error handling in commit_fs_roots Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 54/72] perf/x86/kvm: Add Cascade Lake Xeon steppings to isolation_ucodes[] Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 55/72] parisc: Bump 64-bit IRQ stack size to 64 KB Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 56/72] sched/features: Fix hrtick reprogramming Greg Kroah-Hartman
2021-03-05 12:21 ` [PATCH 5.4 57/72] ASoC: Intel: bytcr_rt5640: Add quirk for the Estar Beauty HD MID 7316R tablet Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 5.4 58/72] ASoC: Intel: bytcr_rt5640: Add quirk for the Voyo Winpad A15 tablet Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 5.4 59/72] ASoC: Intel: bytcr_rt5651: Add quirk for the Jumper EZpad 7 tablet Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 5.4 60/72] ASoC: Intel: bytcr_rt5640: Add quirk for the Acer One S1002 tablet Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 5.4 61/72] scsi: iscsi: Restrict sessions and handles to admin capabilities Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 5.4 62/72] sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 5.4 63/72] scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 5.4 64/72] scsi: iscsi: Verify lengths on passthrough PDUs Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 5.4 65/72] Xen/gnttab: handle p2m update errors on a per-slot basis Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 5.4 66/72] xen-netback: respect gnttab_map_refs()s return value Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 5.4 67/72] zsmalloc: account the number of compacted pages correctly Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 5.4 68/72] swap: fix swapfile read/write offset Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 5.4 69/72] media: v4l: ioctl: Fix memory leak in video_usercopy Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 5.4 70/72] ALSA: hda/realtek: Add quirk for Clevo NH55RZQ Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 5.4 71/72] ALSA: hda/realtek: Add quirk for Intel NUC 10 Greg Kroah-Hartman
2021-03-05 12:22 ` [PATCH 5.4 72/72] ALSA: hda/realtek: Apply dual codec quirks for MSI Godlike X570 board Greg Kroah-Hartman
2021-03-05 17:51 ` [PATCH 5.4 00/72] 5.4.103-rc1 review Jon Hunter
2021-03-06 0:57 ` Samuel Zou
2021-03-06 9:55 ` Greg Kroah-Hartman
2021-03-06 3:23 ` Guenter Roeck
2021-03-06 9:55 ` Greg Kroah-Hartman
2021-03-06 5:25 ` Florian Fainelli
2021-03-06 9:55 ` Naresh Kamboju
2021-03-06 16:33 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210305120859.355536960@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=tiantao6@hisilicon.com \
--cc=tzimmermann@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.