github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-23 14:42:08 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/vkms: Fix use after free and double free on init error

Browse Source 
If the driver initialization fails, the vkms_exit() function might
access an uninitialized or freed default_config pointer and it might
double free it.

Fix both possible errors by initializing default_config only when the
driver initialization succeeded.

Reported-by: Louis Chauvet <louis.chauvet@bootlin.com>
Closes: https://lore.kernel.org/all/Z5uDHcCmAwiTsGte@louis-chauvet-laptop/
Fixes: 2df7af93fd ("drm/vkms: Add vkms_config type")
Signed-off-by: José Expósito <jose.exposito89@gmail.com>
Reviewed-by: Thomas Zimmermann <tzimmremann@suse.de>
Reviewed-by: Louis Chauvet <louis.chauvet@bootlin.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250212084912.3196-1-jose.exposito89@gmail.com
Signed-off-by: Louis Chauvet <louis.chauvet@bootlin.com>
This commit is contained in:
José Expósito 2025-02-12 09:49:12 +01:00 committed by Louis Chauvet
parent ff3881cc6a
commit ed15511a77
No known key found for this signature in database
GPG Key ID: 20AD2EC65B102CE2
1 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/gpu/drm/vkms/vkms_drv.c
View File

@ -235,17 +235,19 @@ static int __init vkms_init(void)
if (!config)
return -ENOMEM;
default_config = config;
config->cursor = enable_cursor;
config->writeback = enable_writeback;
config->overlay = enable_overlay;
ret = vkms_create(config);
if (ret)
if (ret) {
kfree(config);
return ret;
}
return ret;
default_config = config;
return 0;
}
static void vkms_destroy(struct vkms_config *config)
@ -269,9 +271,10 @@ static void vkms_destroy(struct vkms_config *config)
static void __exit vkms_exit(void)
{
if (default_config->dev)
vkms_destroy(default_config);
if (!default_config)
return;
vkms_destroy(default_config);
kfree(default_config);
}