Messages in this thread | | | Subject | Re: [PATCH] dmabuf: fix NULL pointer dereference in dma_buf_release() | From | Christian König <> | Date | Fri, 18 Sep 2020 13:16:16 +0200 |
| |
Am 18.09.20 um 12:32 schrieb Charan Teja Reddy: > NULL pointer dereference is observed while exporting the dmabuf but > failed to allocate the 'struct file' which results into the dropping of > the allocated dentry corresponding to this file in the dmabuf fs, which > is ending up in dma_buf_release() and accessing the uninitialzed > dentry->d_fsdata. > > Call stack on 5.4 is below: > dma_buf_release+0x2c/0x254 drivers/dma-buf/dma-buf.c:88 > __dentry_kill+0x294/0x31c fs/dcache.c:584 > dentry_kill fs/dcache.c:673 [inline] > dput+0x250/0x380 fs/dcache.c:859 > path_put+0x24/0x40 fs/namei.c:485 > alloc_file_pseudo+0x1a4/0x200 fs/file_table.c:235 > dma_buf_getfile drivers/dma-buf/dma-buf.c:473 [inline] > dma_buf_export+0x25c/0x3ec drivers/dma-buf/dma-buf.c:585 > > Fix this by checking for the valid pointer in the dentry->d_fsdata. > > Fixes: 4ab59c3c638c ("dma-buf: Move dma_buf_release() from fops to dentry_ops") > Cc: <stable@vger.kernel.org> [5.7+] > Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>
Reviewed-by: Christian König <christian.koenig@amd.com>
Going to pick this up for inclusion into drm-misc-next as well.
> --- > drivers/dma-buf/dma-buf.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c > index 58564d82..844967f 100644 > --- a/drivers/dma-buf/dma-buf.c > +++ b/drivers/dma-buf/dma-buf.c > @@ -59,6 +59,8 @@ static void dma_buf_release(struct dentry *dentry) > struct dma_buf *dmabuf; > > dmabuf = dentry->d_fsdata; > + if (unlikely(!dmabuf)) > + return; > > BUG_ON(dmabuf->vmapping_counter); >
| |