From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
Xie Yongji <xieyongji@bytedance.com>,
dri-devel@lists.freedesktop.org,
virtualization@lists.linux-foundation.org
Subject: [PATCH AUTOSEL 4.4 09/31] drm/virtio: Fix double free on probe failure
Date: Tue, 6 Jul 2021 07:29:09 -0400 [thread overview]
Message-ID: <20210706112931.2066397-9-sashal@kernel.org> (raw)
In-Reply-To: <20210706112931.2066397-1-sashal@kernel.org>
From: Xie Yongji <xieyongji@bytedance.com>
[ Upstream commit cec7f1774605a5ef47c134af62afe7c75c30b0ee ]
The virtio_gpu_init() will free vgdev and vgdev->vbufs on failure.
But such failure will be caught by virtio_gpu_probe() and then
virtio_gpu_release() will be called to do some cleanup which
will free vgdev and vgdev->vbufs again. So let's set dev->dev_private
to NULL to avoid double free.
Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20210517084913.403-2-xieyongji@bytedance.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/virtio/virtgpu_kms.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c
index 88ed5e235e55..fcf9b572ec03 100644
--- a/drivers/gpu/drm/virtio/virtgpu_kms.c
+++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
@@ -233,6 +233,7 @@ int virtio_gpu_driver_load(struct drm_device *dev, unsigned long flags)
err_vbufs:
vgdev->vdev->config->del_vqs(vgdev->vdev);
err_vqs:
+ dev->dev_private = NULL;
kfree(vgdev);
return ret;
}
--
2.30.2
_______________________________________________
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
Xie Yongji <xieyongji@bytedance.com>,
Gerd Hoffmann <kraxel@redhat.com>,
dri-devel@lists.freedesktop.org,
virtualization@lists.linux-foundation.org
Subject: [PATCH AUTOSEL 4.4 09/31] drm/virtio: Fix double free on probe failure
Date: Tue, 6 Jul 2021 07:29:09 -0400 [thread overview]
Message-ID: <20210706112931.2066397-9-sashal@kernel.org> (raw)
In-Reply-To: <20210706112931.2066397-1-sashal@kernel.org>
From: Xie Yongji <xieyongji@bytedance.com>
[ Upstream commit cec7f1774605a5ef47c134af62afe7c75c30b0ee ]
The virtio_gpu_init() will free vgdev and vgdev->vbufs on failure.
But such failure will be caught by virtio_gpu_probe() and then
virtio_gpu_release() will be called to do some cleanup which
will free vgdev and vgdev->vbufs again. So let's set dev->dev_private
to NULL to avoid double free.
Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20210517084913.403-2-xieyongji@bytedance.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/virtio/virtgpu_kms.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c
index 88ed5e235e55..fcf9b572ec03 100644
--- a/drivers/gpu/drm/virtio/virtgpu_kms.c
+++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
@@ -233,6 +233,7 @@ int virtio_gpu_driver_load(struct drm_device *dev, unsigned long flags)
err_vbufs:
vgdev->vdev->config->del_vqs(vgdev->vdev);
err_vqs:
+ dev->dev_private = NULL;
kfree(vgdev);
return ret;
}
--
2.30.2
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Xie Yongji <xieyongji@bytedance.com>,
Gerd Hoffmann <kraxel@redhat.com>,
Sasha Levin <sashal@kernel.org>,
dri-devel@lists.freedesktop.org,
virtualization@lists.linux-foundation.org
Subject: [PATCH AUTOSEL 4.4 09/31] drm/virtio: Fix double free on probe failure
Date: Tue, 6 Jul 2021 07:29:09 -0400 [thread overview]
Message-ID: <20210706112931.2066397-9-sashal@kernel.org> (raw)
In-Reply-To: <20210706112931.2066397-1-sashal@kernel.org>
From: Xie Yongji <xieyongji@bytedance.com>
[ Upstream commit cec7f1774605a5ef47c134af62afe7c75c30b0ee ]
The virtio_gpu_init() will free vgdev and vgdev->vbufs on failure.
But such failure will be caught by virtio_gpu_probe() and then
virtio_gpu_release() will be called to do some cleanup which
will free vgdev and vgdev->vbufs again. So let's set dev->dev_private
to NULL to avoid double free.
Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20210517084913.403-2-xieyongji@bytedance.com
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/virtio/virtgpu_kms.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c
index 88ed5e235e55..fcf9b572ec03 100644
--- a/drivers/gpu/drm/virtio/virtgpu_kms.c
+++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
@@ -233,6 +233,7 @@ int virtio_gpu_driver_load(struct drm_device *dev, unsigned long flags)
err_vbufs:
vgdev->vdev->config->del_vqs(vgdev->vdev);
err_vqs:
+ dev->dev_private = NULL;
kfree(vgdev);
return ret;
}
--
2.30.2
next prev parent reply other threads:[~2021-07-06 11:29 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-06 11:29 [PATCH AUTOSEL 4.4 01/31] net: pch_gbe: Use proper accessors to BE data in pch_ptp_match() Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 02/31] hugetlb: clear huge pte during flush function on mips platform Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 03/31] atm: iphase: fix possible use-after-free in ia_module_exit() Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 04/31] mISDN: fix possible use-after-free in HFC_cleanup() Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 05/31] atm: nicstar: Fix possible use-after-free in nicstar_cleanup() Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 06/31] net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 07/31] reiserfs: add check for invalid 1st journal block Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 08/31] drm/virtio: Fixes a potential NULL pointer dereference on probe failure Sasha Levin
2021-07-06 11:29 ` Sasha Levin
2021-07-06 11:29 ` Sasha Levin
2021-07-12 21:59 ` Pavel Machek
2021-07-12 21:59 ` Pavel Machek
2021-07-14 16:49 ` Sasha Levin
2021-07-14 16:49 ` Sasha Levin
2021-07-14 16:49 ` Sasha Levin
2021-07-06 11:29 ` Sasha Levin [this message]
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 09/31] drm/virtio: Fix double free " Sasha Levin
2021-07-06 11:29 ` Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 10/31] udf: Fix NULL pointer dereference in udf_symlink function Sasha Levin
2021-07-06 11:29 ` [Intel-wired-lan] [PATCH AUTOSEL 4.4 11/31] e100: handle eeprom as little endian Sasha Levin
2021-07-06 11:29 ` Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 12/31] ipv6: use prandom_u32() for ID generation Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 13/31] RDMA/cxgb4: Fix missing error code in create_qp() Sasha Levin
2021-07-06 11:29 ` [dm-devel] [PATCH AUTOSEL 4.4 14/31] dm space maps: don't reset space map allocation cursor when committing Sasha Levin
2021-07-06 11:29 ` Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 15/31] net: micrel: check return value after calling platform_get_resource() Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 16/31] net: moxa: Use devm_platform_get_and_ioremap_resource() Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 17/31] selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 18/31] xfrm: Fix error reporting in xfrm_state_construct Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 19/31] wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 20/31] wl1251: Fix possible buffer overflow in wl1251_cmd_scan Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 21/31] cw1200: add missing MODULE_DEVICE_TABLE Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 22/31] atm: nicstar: use 'dma_free_coherent' instead of 'kfree' Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 23/31] atm: nicstar: register the interrupt handler in the right place Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 24/31] sfc: avoid double pci_remove of VFs Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 25/31] sfc: error code if SRIOV cannot be disabled Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 26/31] wireless: wext-spy: Fix out-of-bounds warning Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 27/31] RDMA/cma: Fix rdma_resolve_route() memory leak Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 28/31] Bluetooth: Fix the HCI to MGMT status conversion table Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 29/31] Bluetooth: Shutdown controller after workqueues are flushed or cancelled Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 30/31] Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 31/31] sctp: add size validation when walking chunks Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210706112931.2066397-9-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=virtualization@lists.linux-foundation.org \
--cc=xieyongji@bytedance.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.