Re: [PATCH v3] Memory leak error in qxl unbind

=E2=80=A6
> Fix: Check ret from ttm_pool_mgr_init; if non-zero, goto out cleans up
>refcount + debugfs.
=E2=80=A6
> Fix: err_shrinker: label that finalizes + destroys all 64 pool types
> before returning.
>=20
> You must apply the patch from the link "[PATCH v3] drm/qxl: fix
> use-after-free in qxl_irq_handler on PCI" before testing.
> If you don't apply this patch, you will get a UAF error when running
> the script above.
>=20
> Fix: "Unchecked list_lru_init() return value in ttm_pool_type_init()
> causes a deterministic NULL pointer dereference in the newly added
> error path."
> Now check list_lru_init return value in ttm_pool_type_take, check if
> pt->pages.node is NULL in ttm_pool_type_fini and ttm_pool_type_init
> return value in ttm_pool_mgr_init.
>=20
> Solved new issues:
> - [High] The patch introduces a use-after-free race condition between `t=
tm_pool_type_fini()` and the active memory shrinker `ttm_pool_shrink()` by=
 calling `list_lru_destroy()` prematurely.

How do you think about to add any tags (like =E2=80=9CFixes=E2=80=9D and =
=E2=80=9CCc=E2=80=9D) accordingly?

See also:
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/=
Documentation/process/submitting-patches.rst?h=3Dv7.2-rc5#n145
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/=
Documentation/process/stable-kernel-rules.rst?h=3Dv7.2-rc5#n34


> Solved pre-existing issues:
> - [High] `ttm_pool_type_init()` ignores the return value of `list_lru_in=
it()`, leading to a NULL pointer dereference if allocation fails.
> - [High] `ttm_pool_shrink()` assumes `shrinker_list` is never empty, cau=
sing memory corruption and crashes during module unload if triggered.

Would another change description variant become better?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Do=
cumentation/process/submitting-patches.rst?h=3Dv7.2-rc5#n81


=E2=80=A6
> Signed-off-by: =C3=93scar Meg=C3=ADa L=C3=B3pez <[email protected]>
> ---
>  drivers/gpu/drm/drm_gem.c        |  1 +
=E2=80=A6

Some contributors would appreciate patch version descriptions.
https://lore.kernel.org/all/?q=3D%22This+looks+like+a+new+version+of+a+pre=
viously+submitted+patch%22
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Do=
cumentation/process/submitting-patches.rst?h=3Dv7.2-rc5#n310

Regards,
Markus