Skip to contentSkip to conversation

drm: use after free in drm_pci_exit()

PATCH In review Dan Carpenter 3 participants 3 messages Jan 20, 2014 – Mar 17, 2014

Subsystems (3)
DRM drivers DRM misc Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 drm: use after free in drm_pci_exit()

We can't use "dev" after we freed it on the line before.

Fixes b3f2333de8e8 ('drm: restrict the device list for shadow attached drivers')
Signed-off-by Dan Carpenter <[email protected]>
drivers/gpu/drm/drm_pci.c +1 -1
index 5736aaa7e86c..f7af69bcf3f4 100644
@@ -468,8 +468,8 @@ void drm_pci_exit(struct drm_driver *driver, struct pci_driver *pdriver)
 	} else {
 		list_for_each_entry_safe(dev, tmp, &driver->legacy_dev_list,
 					 legacy_dev_list) {
-			drm_put_dev(dev);
 			list_del(&dev->legacy_dev_list);
+			drm_put_dev(dev);
 		}
 	}
 	DRM_INFO("Module unloaded\n");
Tested-by Reviewed-by Reviewed-by John Hubbard on v1 1/1
#1 lore raw
Quoted 4 lines · Dan Carpenter

We can't use "dev" after we freed it on the line before.

Fixes b3f2333de8e8 ('drm: restrict the device list for shadow attached drivers')
Signed-off-by Dan Carpenter <[email protected]>

I just ran into this same problem, and this change fixes it.

Tested-by Aaron Plattner <[email protected]>
Reviewed-by Aaron Plattner <[email protected]>

and since he just sent me an independently-developed identical change,

Reviewed-by John Hubbard <[email protected]>
Quoted 15 lines
drivers/gpu/drm/drm_pci.c +1 -2
index 5736aaa7e86c..f7af69bcf3f4 100644
@@ -468,8 +468,8 @@ void drm_pci_exit(struct drm_driver *driver, struct pci_driver *pdriver)
  	} else {
  		list_for_each_entry_safe(dev, tmp, &driver->legacy_dev_list,
  					 legacy_dev_list) {
-			drm_put_dev(dev);
  			list_del(&dev->legacy_dev_list);
+			drm_put_dev(dev);
  		}
  	}
  	DRM_INFO("Module unloaded\n");
--
#2 lore raw
Quoted 9 lines · Aaron Plattner
Quoted 6 lines · Dan Carpenter

We can't use "dev" after we freed it on the line before.

Fixes b3f2333de8e8 ('drm: restrict the device list for shadow attached

drivers')

Signed-off-by Dan Carpenter <[email protected]>
Quoted 8 lines

I just ran into this same problem, and this change fixes it.

Tested-by Aaron Plattner <[email protected]>
Reviewed-by Aaron Plattner <[email protected]>

and since he just sent me an independently-developed identical change,

Reviewed-by John Hubbard <[email protected]>

Hey, I have such a patch too!

http://patchwork.freedesktop.org/patch/19163/

Dave? I think I'll just send a pull for my random pile of drm core patches I've shepharded ...

Cheers, Daniel

Signature · 3 lines
Daniel Vetter
Software Engineer, Intel Corporation
+41 (0) 79 365 57 48 - http://blog.ffwll.ch