[PATCH] drm/colorop: Release the object ID in drm_colorop_cleanup()

[PATCH] drm/colorop: Release the object ID in drm_colorop_cleanup()

[Changyul Lee]

The drm_plane_colorop_*_init() functions add the colorop to the mode
object IDR, but drm_colorop_cleanup() does not remove it, unlike
drm_plane_cleanup(). When a driver frees a colorop after a failed
pipeline setup, its ID still points to the freed object.

vkms ignores the setup error and registers the device anyway, so the
stale ID can be looked up from userspace. With one allocation in
drm_plane_colorop_curve_1d_init() failed through failslab, querying
the IDs with DRM_IOCTL_MODE_OBJ_GETPROPERTIES gives:

  BUG: KASAN: slab-use-after-free in __drm_mode_object_find+0x2e8/0x320
  Read of size 4 at addr ffff88800b681020 by task getprops/79
  Call Trace:
   __drm_mode_object_find
   drm_mode_obj_get_properties_ioctl
   drm_ioctl_kernel

Call drm_mode_object_unregister() in drm_colorop_cleanup().

Fixes: 9cf87f864d83 ("drm/colorop: Add destroy functions for color pipeline")
Signed-off-by: Changyul Lee <lcy8047@gmail.com>
---
 drivers/gpu/drm/drm_colorop.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/gpu/drm/drm_colorop.c b/drivers/gpu/drm/drm_colorop.c
index 95da03d6c65c..edfb4d72d166 100644
--- a/drivers/gpu/drm/drm_colorop.c
+++ b/drivers/gpu/drm/drm_colorop.c
@@ -183,6 +183,8 @@ void drm_colorop_cleanup(struct drm_colorop *colorop)
 
 	if (colorop->state)
 		drm_colorop_atomic_destroy_state(colorop, colorop->state);
+
+	drm_mode_object_unregister(dev, &colorop->base);
 }
 EXPORT_SYMBOL(drm_colorop_cleanup);
 

base-commit: 3944ca3e6b7d25e545e8ef6498f69941e8e0c8ae
-- 
2.43.0