Re: [PATCH] dmabuf: fix NULL pointer dereference in dma_buf_release()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Am 18.09.20 um 12:32 schrieb Charan Teja Reddy:
NULL pointer dereference is observed while exporting the dmabuf but
failed to allocate the 'struct file' which results into the dropping of
the allocated dentry corresponding to this file in the dmabuf fs, which
is ending up in dma_buf_release() and accessing the uninitialzed
dentry->d_fsdata.

Call stack on 5.4 is below:
  dma_buf_release+0x2c/0x254 drivers/dma-buf/dma-buf.c:88
  __dentry_kill+0x294/0x31c fs/dcache.c:584
  dentry_kill fs/dcache.c:673 [inline]
  dput+0x250/0x380 fs/dcache.c:859
  path_put+0x24/0x40 fs/namei.c:485
  alloc_file_pseudo+0x1a4/0x200 fs/file_table.c:235
  dma_buf_getfile drivers/dma-buf/dma-buf.c:473 [inline]
  dma_buf_export+0x25c/0x3ec drivers/dma-buf/dma-buf.c:585

Fix this by checking for the valid pointer in the dentry->d_fsdata.

Fixes: 4ab59c3c638c ("dma-buf: Move dma_buf_release() from fops to dentry_ops")
Cc: <stable@xxxxxxxxxxxxxxx> [5.7+]
Signed-off-by: Charan Teja Reddy <charante@xxxxxxxxxxxxxx>

Reviewed-by: Christian König <christian.koenig@xxxxxxx>

Going to pick this up for inclusion into drm-misc-next as well.

---
  drivers/dma-buf/dma-buf.c | 2 ++
  1 file changed, 2 insertions(+)

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index 58564d82..844967f 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -59,6 +59,8 @@ static void dma_buf_release(struct dentry *dentry)
  	struct dma_buf *dmabuf;
dmabuf = dentry->d_fsdata;
+	if (unlikely(!dmabuf))
+		return;
BUG_ON(dmabuf->vmapping_counter);

_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.freedesktop.org/mailman/listinfo/dri-devel




[Index of Archives]     [Linux DRI Users]     [Linux Intel Graphics]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [XFree86]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux