From: Pavel Machek <pavel@denx.de>
To: Sasha Levin <sashal@kernel.org>
Cc: linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org,
virtualization@lists.linux-foundation.org,
Xie Yongji <xieyongji@bytedance.com>,
stable@vger.kernel.org, Gerd Hoffmann <kraxel@redhat.com>
Subject: Re: [PATCH AUTOSEL 4.4 08/31] drm/virtio: Fixes a potential NULL pointer dereference on probe failure
Date: Mon, 12 Jul 2021 23:59:37 +0200 [thread overview]
Message-ID: <20210712215937.GA9488@amd> (raw)
In-Reply-To: <20210706112931.2066397-8-sashal@kernel.org>
[-- Attachment #1: Type: text/plain, Size: 835 bytes --]
Hi!
> From: Xie Yongji <xieyongji@bytedance.com>
>
> [ Upstream commit 17f46f488a5d82c5568e6e786cd760bba1c2ee09 ]
>
> The dev->dev_private might not be allocated if virtio_gpu_pci_quirk()
> or virtio_gpu_init() failed. In this case, we should avoid the cleanup
> in virtio_gpu_release().
The check is in wrong place at least in 4.4:
> +++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
> @@ -257,6 +257,9 @@ int virtio_gpu_driver_unload(struct drm_device *dev)
> flush_work(&vgdev->config_changed_work);
> vgdev->vdev->config->del_vqs(vgdev->vdev);
>
> + if (!vgdev)
> + return;
> +
Pointer is dereferenced before being tested.
Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
WARNING: multiple messages have this Message-ID (diff)
From: Pavel Machek <pavel@denx.de>
To: Sasha Levin <sashal@kernel.org>
Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
Xie Yongji <xieyongji@bytedance.com>,
Gerd Hoffmann <kraxel@redhat.com>,
dri-devel@lists.freedesktop.org,
virtualization@lists.linux-foundation.org
Subject: Re: [PATCH AUTOSEL 4.4 08/31] drm/virtio: Fixes a potential NULL pointer dereference on probe failure
Date: Mon, 12 Jul 2021 23:59:37 +0200 [thread overview]
Message-ID: <20210712215937.GA9488@amd> (raw)
In-Reply-To: <20210706112931.2066397-8-sashal@kernel.org>
[-- Attachment #1: Type: text/plain, Size: 835 bytes --]
Hi!
> From: Xie Yongji <xieyongji@bytedance.com>
>
> [ Upstream commit 17f46f488a5d82c5568e6e786cd760bba1c2ee09 ]
>
> The dev->dev_private might not be allocated if virtio_gpu_pci_quirk()
> or virtio_gpu_init() failed. In this case, we should avoid the cleanup
> in virtio_gpu_release().
The check is in wrong place at least in 4.4:
> +++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
> @@ -257,6 +257,9 @@ int virtio_gpu_driver_unload(struct drm_device *dev)
> flush_work(&vgdev->config_changed_work);
> vgdev->vdev->config->del_vqs(vgdev->vdev);
>
> + if (!vgdev)
> + return;
> +
Pointer is dereferenced before being tested.
Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]
next prev parent reply other threads:[~2021-07-12 22:07 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-06 11:29 [PATCH AUTOSEL 4.4 01/31] net: pch_gbe: Use proper accessors to BE data in pch_ptp_match() Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 02/31] hugetlb: clear huge pte during flush function on mips platform Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 03/31] atm: iphase: fix possible use-after-free in ia_module_exit() Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 04/31] mISDN: fix possible use-after-free in HFC_cleanup() Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 05/31] atm: nicstar: Fix possible use-after-free in nicstar_cleanup() Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 06/31] net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 07/31] reiserfs: add check for invalid 1st journal block Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 08/31] drm/virtio: Fixes a potential NULL pointer dereference on probe failure Sasha Levin
2021-07-06 11:29 ` Sasha Levin
2021-07-06 11:29 ` Sasha Levin
2021-07-12 21:59 ` Pavel Machek [this message]
2021-07-12 21:59 ` Pavel Machek
2021-07-14 16:49 ` Sasha Levin
2021-07-14 16:49 ` Sasha Levin
2021-07-14 16:49 ` Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 09/31] drm/virtio: Fix double free " Sasha Levin
2021-07-06 11:29 ` Sasha Levin
2021-07-06 11:29 ` Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 10/31] udf: Fix NULL pointer dereference in udf_symlink function Sasha Levin
2021-07-06 11:29 ` [Intel-wired-lan] [PATCH AUTOSEL 4.4 11/31] e100: handle eeprom as little endian Sasha Levin
2021-07-06 11:29 ` Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 12/31] ipv6: use prandom_u32() for ID generation Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 13/31] RDMA/cxgb4: Fix missing error code in create_qp() Sasha Levin
2021-07-06 11:29 ` [dm-devel] [PATCH AUTOSEL 4.4 14/31] dm space maps: don't reset space map allocation cursor when committing Sasha Levin
2021-07-06 11:29 ` Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 15/31] net: micrel: check return value after calling platform_get_resource() Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 16/31] net: moxa: Use devm_platform_get_and_ioremap_resource() Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 17/31] selinux: use __GFP_NOWARN with GFP_NOWAIT in the AVC Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 18/31] xfrm: Fix error reporting in xfrm_state_construct Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 19/31] wlcore/wl12xx: Fix wl12xx get_mac error if device is in ELP Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 20/31] wl1251: Fix possible buffer overflow in wl1251_cmd_scan Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 21/31] cw1200: add missing MODULE_DEVICE_TABLE Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 22/31] atm: nicstar: use 'dma_free_coherent' instead of 'kfree' Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 23/31] atm: nicstar: register the interrupt handler in the right place Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 24/31] sfc: avoid double pci_remove of VFs Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 25/31] sfc: error code if SRIOV cannot be disabled Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 26/31] wireless: wext-spy: Fix out-of-bounds warning Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 27/31] RDMA/cma: Fix rdma_resolve_route() memory leak Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 28/31] Bluetooth: Fix the HCI to MGMT status conversion table Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 29/31] Bluetooth: Shutdown controller after workqueues are flushed or cancelled Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 30/31] Bluetooth: btusb: fix bt fiwmare downloading failure issue for qca btsoc Sasha Levin
2021-07-06 11:29 ` [PATCH AUTOSEL 4.4 31/31] sctp: add size validation when walking chunks Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210712215937.GA9488@amd \
--to=pavel@denx.de \
--cc=dri-devel@lists.freedesktop.org \
--cc=kraxel@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=virtualization@lists.linux-foundation.org \
--cc=xieyongji@bytedance.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.