public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm: fix crash due to /proc registration race
@ 2008-06-01  3:39 Arjan van de Ven
  2008-06-01  4:48 ` [PATCH] drm: make drm use create_proc_read_entry() instead Arjan van de Ven
  0 siblings, 1 reply; 5+ messages in thread
From: Arjan van de Ven @ 2008-06-01  3:39 UTC (permalink / raw)
  To: airlied; +Cc: linux-kernel



From: Arjan van de Ven <arjan@linux.intel.com>
Subject: [PATCH] drm: fix crash due to /proc registration race

The DRM layer creates proc entries like this:

                ent = create_proc_entry(drm_proc_list[i].name,
                                        S_IFREG | S_IRUGO, minor->dev_root);
                if (!ent) {
			... stuff ...
                }
                ent->read_proc = drm_proc_list[i].f;
                ent->data = minor;

however that leaves a short window where the /proc file is visible,
but where ->data is not initialized yet.
It appears that this race is actually hit in practice:
http://www.kerneloops.org/search.php?search=drm_name_info

(of course it could be some other race.. but this race appears
to be there at least)

Reported-by: www.kerneloops.org
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
---
 drivers/char/drm/drm_proc.c |   13 ++++++++++++-
 1 files changed, 12 insertions(+), 1 deletions(-)

diff --git a/drivers/char/drm/drm_proc.c b/drivers/char/drm/drm_proc.c
index 93b1e04..19e61ad 100644
--- a/drivers/char/drm/drm_proc.c
+++ b/drivers/char/drm/drm_proc.c
@@ -164,9 +164,20 @@ static int drm_name_info(char *buf, char **start, off_t offset, int request,
 			 int *eof, void *data)
 {
 	struct drm_minor *minor = (struct drm_minor *) data;
-	struct drm_device *dev = minor->dev;
+	struct drm_device *dev;
 	int len = 0;
 
+	/*
+	 * When creating the /proc files, there is a tiny race window
+	 * where "data" isn't assigned yet... error out rather than dereference
+	 */
+	if (!data) {
+		*eof = 1;
+		return 0;
+	}
+
+	dev = minor->dev;
+
 	if (offset > DRM_PROC_LIMIT) {
 		*eof = 1;
 		return 0;
-- 
1.5.5.1


-- 
If you want to reach me at my work email, use arjan@linux.intel.com
For development, discussion and tips for power savings, 
visit http://www.lesswatts.org

^ permalink raw reply related	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2008-06-01 10:14 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-06-01  3:39 [PATCH] drm: fix crash due to /proc registration race Arjan van de Ven
2008-06-01  4:48 ` [PATCH] drm: make drm use create_proc_read_entry() instead Arjan van de Ven
2008-06-01  9:25   ` Alexey Dobriyan
2008-06-01  9:36     ` Al Viro
2008-06-01 10:10       ` [PATCH] drm: switch to seq_files Alexey Dobriyan

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox