linux-stable

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-02 07:04:24 +00:00

No description

Find a file

Yuan Can 596f1ba398 drm/vkms: Fix null-ptr-deref in vkms_release() [ Upstream commit `2fe2a8f40c` ] A null-ptr-deref is triggered when it tries to destroy the workqueue in vkms->output.composer_workq in vkms_release(). KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] CPU: 5 PID: 17193 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf #24 RIP: 0010:destroy_workqueue+0x2f/0x710 ... Call Trace: <TASK> ? vkms_config_debugfs_init+0x50/0x50 [vkms] __devm_drm_dev_alloc+0x15a/0x1c0 [drm] vkms_init+0x245/0x1000 [vkms] do_one_initcall+0xd0/0x4f0 do_init_module+0x1a4/0x680 load_module+0x6249/0x7110 __do_sys_finit_module+0x140/0x200 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The reason is that an OOM happened which triggers the destroy of the workqueue, however, the workqueue is alloced in the later process, thus a null-ptr-deref happened. A simple call graph is shown as below: vkms_init() vkms_create() devm_drm_dev_alloc() __devm_drm_dev_alloc() devm_drm_dev_init() devm_add_action_or_reset() devm_add_action() # an error happened devm_drm_dev_init_release() drm_dev_put() kref_put() drm_dev_release() vkms_release() destroy_workqueue() # null-ptr-deref happened vkms_modeset_init() vkms_output_init() vkms_crtc_init() # where the workqueue get allocated Fix this by checking if composer_workq is NULL before passing it to the destroy_workqueue() in vkms_release(). Fixes: `6c234fe37c` ("drm/vkms: Implement CRC debugfs API") Signed-off-by: Yuan Can <yuancan@huawei.com> Reviewed-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Melissa Wen <melissa.srw@gmail.com> Link: https://patchwork.freedesktop.org/patch/msgid/20221101065156.41584-3-yuancan@huawei.com Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-03-10 09:33:09 +01:00
arch	LoongArch, bpf: Use 4 instructions for function address in JIT	2023-03-10 09:33:06 +01:00
block	block: use proper return value from bio_failfast()	2023-03-10 09:32:47 +01:00
certs	certs: Fix build error when PKCS#11 URI contains semicolon	2023-02-09 11:28:11 +01:00
crypto	crypto: rsa-pkcs1pad - Use akcipher_request_complete	2023-03-10 09:33:03 +01:00
Documentation	attr: use consistent sgid stripping checks	2023-03-03 11:52:25 +01:00
drivers	drm/vkms: Fix null-ptr-deref in vkms_release()	2023-03-10 09:33:09 +01:00
fs	erofs: relinquish volume with mutex held	2023-03-10 09:32:46 +01:00
include	net/mlx4_en: Introduce flexible array to silence overflow warning	2023-03-10 09:33:08 +01:00
init	gcc: disable -Warray-bounds for gcc-11 too	2023-01-14 10:33:43 +01:00
io_uring	use less confusing names for iov_iter direction initializers	2023-02-09 11:28:04 +01:00
ipc	ipc: fix memory leak in init_mqueue_fs()	2022-12-31 13:32:01 +01:00
kernel	bpf: Fix global subprog context argument resolution logic	2023-03-10 09:33:06 +01:00
lib	lib/mpi: Fix buffer overrun when SG is too long	2023-03-10 09:32:52 +01:00
LICENSES	LICENSES/LGPL-2.1: Add LGPL-2.1-or-later as valid identifiers	2021-12-16 14:33:10 +01:00
mm	mm/gup: add folio to list when folio_isolate_lru() succeed	2023-02-22 12:59:54 +01:00
net	l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()	2023-03-10 09:33:07 +01:00
rust	rust: print: avoid evaluating arguments in `pr_*` macros in `unsafe` blocks	2023-02-06 08:06:34 +01:00
samples	ftrace: Export ftrace_free_filter() to modules	2023-02-01 08:34:37 +01:00
scripts	scripts/tags.sh: fix incompatibility with PCRE2	2023-03-03 11:52:25 +01:00
security	randstruct: disable Clang 15 support	2023-02-25 11:25:43 +01:00
sound	ASoC: codecs: es8326: Fix DTS properties reading	2023-03-03 11:52:22 +01:00
tools	sefltests: netdevsim: wait for devlink instance after netns removal	2023-03-10 09:33:08 +01:00
usr	usr/gen_init_cpio.c: remove unnecessary -1 values from int file	2022-10-03 14:21:44 -07:00
virt	kvm/vfio: Fix potential deadlock on vfio group_lock	2023-02-01 08:34:36 +01:00
.clang-format	inet: ping: use hlist_nulls rcu iterator during lookup	2022-12-01 12:42:46 +01:00
.cocciconfig
.get_maintainer.ignore	get_maintainer: add Alan to .get_maintainer.ignore	2022-08-20 15:17:44 -07:00
.gitattributes	.gitattributes: use 'dts' diff driver for dts files	2019-12-04 19:44:11 -08:00
.gitignore	Kbuild: add Rust support	2022-09-28 09:02:20 +02:00
.mailmap	9 hotfixes. 6 for MM, 3 for other areas. Four of these patches address	2022-12-10 17:10:52 -08:00
.rustfmt.toml	rust: add `.rustfmt.toml`	2022-09-28 09:02:20 +02:00
COPYING	COPYING: state that all contributions really are covered by this file	2020-02-10 13:32:20 -08:00
CREDITS	MAINTAINERS: Remove Michal Marek from Kbuild maintainers	2022-11-16 14:53:00 +09:00
Kbuild	Kbuild updates for v6.1	2022-10-10 12:00:45 -07:00
Kconfig	kbuild: ensure full rebuild when the compiler is updated	2020-05-12 13:28:33 +09:00
MAINTAINERS	audit: update the mailing list in MAINTAINERS	2023-02-25 11:25:42 +01:00
Makefile	Linux 6.1.15	2023-03-03 11:52:25 +01:00
README	Drop all 00-INDEX files from Documentation/	2018-09-09 15:08:58 -06:00

README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.