Skip to contentSkip to conversation

dmabuf: fix NULL pointer dereference in dma_buf_release()

PATCH In review Charan Teja Reddy 3 participants 3 messages Sep 18, 2020

Subsystems (3)
Stable branch Media (V4L/DVB) DMA buffer sharing framework
lore
Share & tools
lore

Charan Teja Reddy

author
#0 lore raw

PATCH 1/1 dmabuf: fix NULL pointer dereference in dma_buf_release()

NULL pointer dereference is observed while exporting the dmabuf but failed to allocate the 'struct file' which results into the dropping of the allocated dentry corresponding to this file in the dmabuf fs, which is ending up in dma_buf_release() and accessing the uninitialzed dentry->d_fsdata.

Call stack on 5.4 is below:

 dma_buf_release+0x2c/0x254 drivers/dma-buf/dma-buf.c:88
 __dentry_kill+0x294/0x31c fs/dcache.c:584
 dentry_kill fs/dcache.c:673 [inline]
 dput+0x250/0x380 fs/dcache.c:859
 path_put+0x24/0x40 fs/namei.c:485
 alloc_file_pseudo+0x1a4/0x200 fs/file_table.c:235
 dma_buf_getfile drivers/dma-buf/dma-buf.c:473 [inline]
 dma_buf_export+0x25c/0x3ec drivers/dma-buf/dma-buf.c:585

Fix this by checking for the valid pointer in the dentry->d_fsdata.

Fixes 4ab59c3c638c ("dma-buf: Move dma_buf_release() from fops to dentry_ops")
Cc <[email protected]> [5.7+]
Signed-off-by Charan Teja Reddy <[email protected]>
---
 drivers/dma-buf/dma-buf.c | 2 ++
 1 file changed, 2 insertions(+)
drivers/dma-buf/dma-buf.c +2 -0
index 58564d82..844967f 100644
@@ -59,6 +59,8 @@ static void dma_buf_release(struct dentry *dentry)
 	struct dma_buf *dmabuf;
 
 	dmabuf = dentry->d_fsdata;
+	if (unlikely(!dmabuf))
+		return;
 
 	BUG_ON(dmabuf->vmapping_counter);
Signature · 2 lines
QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a
member of the Code Aurora Forum, hosted by The Linux Foundation
maintainer Reviewed-by on v1 1/1
#1 lore raw

Am 18.09.20 um 12:32 schrieb Charan Teja Reddy:

Quoted 16 lines

NULL pointer dereference is observed while exporting the dmabuf but failed to allocate the 'struct file' which results into the dropping of the allocated dentry corresponding to this file in the dmabuf fs, which is ending up in dma_buf_release() and accessing the uninitialzed dentry->d_fsdata.

Call stack on 5.4 is below:

  dma_buf_release+0x2c/0x254 drivers/dma-buf/dma-buf.c:88
  __dentry_kill+0x294/0x31c fs/dcache.c:584
  dentry_kill fs/dcache.c:673 [inline]
  dput+0x250/0x380 fs/dcache.c:859
  path_put+0x24/0x40 fs/namei.c:485
  alloc_file_pseudo+0x1a4/0x200 fs/file_table.c:235
  dma_buf_getfile drivers/dma-buf/dma-buf.c:473 [inline]
  dma_buf_export+0x25c/0x3ec drivers/dma-buf/dma-buf.c:585
Quoted 5 lines

Fix this by checking for the valid pointer in the dentry->d_fsdata.

Fixes 4ab59c3c638c ("dma-buf: Move dma_buf_release() from fops to dentry_ops")
Cc <[email protected]> [5.7+]
Signed-off-by Charan Teja Reddy <[email protected]>
Reviewed-by Christian König <[email protected]>

Going to pick this up for inclusion into drm-misc-next as well.

Quoted 9 lines
---
  drivers/dma-buf/dma-buf.c | 2 ++
  1 file changed, 2 insertions(+)
drivers/dma-buf/dma-buf.c +0 -0
index 58564d82..844967f 100644

drivers/dma-buf/dma-buf.c static void dma_buf_release(struct dentry *dentry) · line 66

Quoted 8 lines
drivers/dma-buf/dma-buf.c +2 -0
@@ -59,6 +59,8 @@ static void dma_buf_release(struct dentry *dentry)
  	struct dma_buf *dmabuf;
 
  	dmabuf = dentry->d_fsdata;
+	if (unlikely(!dmabuf))
+		return;
 
  	BUG_ON(dmabuf->vmapping_counter);

_______________________________________________
dri-devel mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/dri-devel

#2 lore raw
Quoted 19 lines · Christian König

Am 18.09.20 um 12:32 schrieb Charan Teja Reddy:

Quoted 18 lines

NULL pointer dereference is observed while exporting the dmabuf but failed to allocate the 'struct file' which results into the dropping of the allocated dentry corresponding to this file in the dmabuf fs, which is ending up in dma_buf_release() and accessing the uninitialzed dentry->d_fsdata.

Call stack on 5.4 is below:

  dma_buf_release+0x2c/0x254 drivers/dma-buf/dma-buf.c:88
  __dentry_kill+0x294/0x31c fs/dcache.c:584
  dentry_kill fs/dcache.c:673 [inline]
  dput+0x250/0x380 fs/dcache.c:859
  path_put+0x24/0x40 fs/namei.c:485
  alloc_file_pseudo+0x1a4/0x200 fs/file_table.c:235
  dma_buf_getfile drivers/dma-buf/dma-buf.c:473 [inline]
  dma_buf_export+0x25c/0x3ec drivers/dma-buf/dma-buf.c:585

Fix this by checking for the valid pointer in the dentry->d_fsdata.

Quoted 7 lines
Quoted 3 lines
Fixes 4ab59c3c638c ("dma-buf: Move dma_buf_release() from fops to dentry_ops")
Cc <[email protected]> [5.7+]
Signed-off-by Charan Teja Reddy <[email protected]>
Reviewed-by Christian König <[email protected]>

Going to pick this up for inclusion into drm-misc-next as well.

drm-misc-fixes since this is a bugfix that needs to be backported. -Daniel

Quoted 20 lines
Quoted 10 lines
---
  drivers/dma-buf/dma-buf.c | 2 ++
  1 file changed, 2 insertions(+)
drivers/dma-buf/dma-buf.c +0 -0
index 58564d82..844967f 100644

drivers/dma-buf/dma-buf.c static void dma_buf_release(struct dentry *dentry) · line 63

Quoted 5 lines
drivers/dma-buf/dma-buf.c +2 -0
@@ -59,6 +59,8 @@ static void dma_buf_release(struct dentry *dentry)
  	struct dma_buf *dmabuf;
  	dmabuf = dentry->d_fsdata;
+	if (unlikely(!dmabuf))
+		return;
  	BUG_ON(dmabuf->vmapping_counter);

_______________________________________________
dri-devel mailing list
[email protected]
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Signature · 3 lines
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch