mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
* [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create
@ 2023-08-14 14:49 Karol Herbst
  2023-08-16  9:30 ` Borislav Petkov
  2023-08-16 20:47 ` Lyude Paul
  0 siblings, 2 replies; 20+ messages in thread
From: Karol Herbst @ 2023-08-14 14:49 UTC (permalink / raw)
  To: linux-kernel
  Cc: Ben Skeggs, Lyude Paul, dri-devel, nouveau, Borislav Petkov,
	Takashi Iwai, Karol Herbst

We can't simply free the connector after calling drm_connector_init on it.
We need to clean up the drm side first.

It might not fix all regressions from 2b5d1c29f6c4 ("drm/nouveau/disp:
PIOR DP uses GPIO for HPD, not PMGR AUX interrupts"), but at least it
fixes a memory corruption in error handling related to that commit.

Link: https://lore.kernel.org/lkml/20230806213107.GFZNARG6moWpFuSJ9W@fat_crate.local/
Fixes: 95983aea8003 ("drm/nouveau/disp: add connector class")
Signed-off-by: Karol Herbst <kherbst@redhat.com>
---
 drivers/gpu/drm/nouveau/nouveau_connector.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index a2e0033e8a260..622f6eb9a8bfd 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -1408,8 +1408,7 @@ nouveau_connector_create(struct drm_device *dev,
 		ret = nvif_conn_ctor(&disp->disp, nv_connector->base.name, nv_connector->index,
 				     &nv_connector->conn);
 		if (ret) {
-			kfree(nv_connector);
-			return ERR_PTR(ret);
+			goto drm_conn_err;
 		}
 
 		ret = nvif_conn_event_ctor(&nv_connector->conn, "kmsHotplug",
@@ -1426,8 +1425,7 @@ nouveau_connector_create(struct drm_device *dev,
 			if (ret) {
 				nvif_event_dtor(&nv_connector->hpd);
 				nvif_conn_dtor(&nv_connector->conn);
-				kfree(nv_connector);
-				return ERR_PTR(ret);
+				goto drm_conn_err;
 			}
 		}
 	}
@@ -1475,4 +1473,9 @@ nouveau_connector_create(struct drm_device *dev,
 
 	drm_connector_register(connector);
 	return connector;
+
+drm_conn_err:
+	drm_connector_cleanup(connector);
+	kfree(nv_connector);
+	return ERR_PTR(ret);
 }
-- 
2.41.0


^ permalink raw reply	[flat|nested] 20+ messages in thread
end of thread, other threads:[~2023-08-17 15:18 UTC | newest]

Thread overview: 20+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-08-14 14:49 [PATCH] drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create Karol Herbst
2023-08-16  9:30 ` Borislav Petkov
2023-08-16  9:51   ` Karol Herbst
2023-08-16 10:03     ` Borislav Petkov
2023-08-16 10:11       ` Borislav Petkov
2023-08-16 10:14         ` Borislav Petkov
2023-08-16 10:36           ` Takashi Iwai
2023-08-16 14:53     ` Borislav Petkov
2023-08-16 14:57       ` Karol Herbst
2023-08-16 15:12         ` Borislav Petkov
2023-08-16 21:27           ` Karol Herbst
2023-08-16 22:13             ` Borislav Petkov
2023-08-16 23:18               ` Karol Herbst
2023-08-17  8:10                 ` Borislav Petkov
2023-08-17  9:58                   ` Karol Herbst
2023-08-17 10:00                     ` Karol Herbst
2023-08-17 10:11                       ` Borislav Petkov
2023-08-17 10:24                         ` Karol Herbst
2023-08-17 15:17                           ` Borislav Petkov
2023-08-16 20:47 ` Lyude Paul

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®