Re: [PATCH v3] Memory leak error in qxl unbind
Markus Elfring <[email protected]>
| Newsgroups | org.freedesktop.lists.dri-devel,dev.linux.lists.linux-kernel-mentees,org.kernel.vger.kernel-janitors,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
… > Fix: Check ret from ttm_pool_mgr_init; if non-zero, goto out cleans up >refcount + debugfs. … > Fix: err_shrinker: label that finalizes + destroys all 64 pool types > before returning. > > You must apply the patch from the link "[PATCH v3] drm/qxl: fix > use-after-free in qxl_irq_handler on PCI" before testing. > If you don't apply this patch, you will get a UAF error when running > the script above. > > Fix: "Unchecked list_lru_init() return value in ttm_pool_type_init() > causes a deterministic NULL pointer dereference in the newly added > error path." > Now check list_lru_init return value in ttm_pool_type_take, check if > pt->pages.node is NULL in ttm_pool_type_fini and ttm_pool_type_init > return value in ttm_pool_mgr_init. > > Solved new issues: > - [High] The patch introduces a use-after-free race condition between `ttm_pool_type_fini()` and the active memory shrinker `ttm_pool_shrink()` by calling `list_lru_destroy()` prematurely. How do you think about to add any tags (like “Fixes” and “Cc”) accordingly? See also: * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.2-rc5#n145 * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v7.2-rc5#n34 > Solved pre-existing issues: > - [High] `ttm_pool_type_init()` ignores the return value of `list_lru_init()`, leading to a NULL pointer dereference if allocation fails. > - [High] `ttm_pool_shrink()` assumes `shrinker_list` is never empty, causing memory corruption and crashes during module unload if triggered. Would another change description variant become better? https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.2-rc5#n81 … > Signed-off-by: Óscar Megía López <[email protected]> > --- > drivers/gpu/drm/drm_gem.c | 1 + … Some contributors would appreciate patch version descriptions. https://lore.kernel.org/all/?q=%22This+looks+like+a+new+version+of+a+previously+submitted+patch%22 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.2-rc5#n310 Regards, Markus