Re: [PATCH v2 01/15] drm/vkms: Fix use after free and double free on init error

["José Expósito" <jose.exposito89@gmail.com>]

Hi Thomas,

On Tue, Feb 11, 2025 at 03:33:55PM +0100, Thomas Zimmermann wrote:
> Hi
> 
> Am 11.02.25 um 12:08 schrieb José Expósito:
> > If the driver initialization fails, the vkms_exit() function might
> > access an uninitialized or freed default_config pointer and it might
> > double free it.
> > 
> > Fix both possible errors by initializing default_config only when the
> > driver initialization succeeded.
> 
> Could you send this patch separately, so that it can go into drm-misc-fixes
> quickly?

Sure, I just sent it as a separate patch.

Thanks,
Jose
 
> Best regards
> Thomas
> 
> > 
> > Reported-by: Louis Chauvet <louis.chauvet@bootlin.com>
> > Link: https://lore.kernel.org/all/Z5uDHcCmAwiTsGte@louis-chauvet-laptop/
> > Fixes: 2df7af93fdad ("drm/vkms: Add vkms_config type")
> > Signed-off-by: José Expósito <jose.exposito89@gmail.com>
> > ---
> >   drivers/gpu/drm/vkms/vkms_drv.c | 15 +++++++++------
> >   1 file changed, 9 insertions(+), 6 deletions(-)
> > 
> > diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c
> > index 7c142bfc3bd9..b6de91134a22 100644
> > --- a/drivers/gpu/drm/vkms/vkms_drv.c
> > +++ b/drivers/gpu/drm/vkms/vkms_drv.c
> > @@ -235,17 +235,19 @@ static int __init vkms_init(void)
> >   	if (!config)
> >   		return -ENOMEM;
> > -	default_config = config;
> > -
> >   	config->cursor = enable_cursor;
> >   	config->writeback = enable_writeback;
> >   	config->overlay = enable_overlay;
> >   	ret = vkms_create(config);
> > -	if (ret)
> > +	if (ret) {
> >   		kfree(config);
> > +		return ret;
> > +	}
> > -	return ret;
> > +	default_config = config;
> > +
> > +	return 0;
> >   }
> >   static void vkms_destroy(struct vkms_config *config)
> > @@ -269,9 +271,10 @@ static void vkms_destroy(struct vkms_config *config)
> >   static void __exit vkms_exit(void)
> >   {
> > -	if (default_config->dev)
> > -		vkms_destroy(default_config);
> > +	if (!default_config)
> > +		return;
> > +	vkms_destroy(default_config);
> >   	kfree(default_config);
> >   }
> 
> -- 
> --
> Thomas Zimmermann
> Graphics Driver Developer
> SUSE Software Solutions Germany GmbH
> Frankenstrasse 146, 90461 Nuernberg, Germany
> GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
> HRB 36809 (AG Nuernberg)
>