LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Zwane Mwaikambo <zwanem@gmail.com>
To: tcamuso@redhat.com
Cc: Linux Kernel <linux-kernel@vger.kernel.org>,
	dri-devel@lists.freedesktop.org, dkwon@redhat.com
Subject: Re: [PATCH] drm: assure aux_dev is nonzero before using it
Date: Mon, 10 Aug 2020 10:11:50 -0700 (PDT)	[thread overview]
Message-ID: <alpine.DEB.2.21.2008101004110.27032@montezuma.home> (raw)

Hi Folks,
	I know this thread eventually dropped off due to not identifying 
the underlying issue. It's still occuring on 5.8 and in my case it 
happened because the udev device nodes for the DP aux devices were not 
cleaned up whereas the kernel had no association with them. I can 
reproduce the bug just by creating a device node for a non-existent minor 
device and calling open().

To me it still makes sense to just check aux_dev because the chardev has 
no way to check before calling.

(gdb) list *drm_dp_aux_dev_get_by_minor+0x29
0x17b39 is in drm_dp_aux_dev_get_by_minor (drivers/gpu/drm/drm_dp_aux_dev.c:65).
60      static struct drm_dp_aux_dev *drm_dp_aux_dev_get_by_minor(unsigned index)
61      {
62              struct drm_dp_aux_dev *aux_dev = NULL;
63
64              mutex_lock(&aux_idr_mutex);
65              aux_dev = idr_find(&aux_idr, index);
66              if (!kref_get_unless_zero(&aux_dev->refcount))
67                      aux_dev = NULL;
68              mutex_unlock(&aux_idr_mutex);
69
(gdb) p/x &((struct drm_dp_aux_dev *)(0x0))->refcount
$8 = 0x18

static int auxdev_open(struct inode *inode, struct file *file)
{
    unsigned int minor = iminor(inode);
    struct drm_dp_aux_dev *aux_dev;

    aux_dev = drm_dp_aux_dev_get_by_minor(minor);
    if (!aux_dev)
        return -ENODEV;

    file->private_data = aux_dev;
    return 0;
}



             reply	other threads:[~2020-08-10 17:20 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-08-10 17:11 Zwane Mwaikambo [this message]
2020-08-11  8:58 ` Daniel Vetter
2020-08-11 22:16   ` Zwane Mwaikambo
2020-08-12 14:10     ` Daniel Vetter
2020-08-12 15:44       ` Lyude Paul
2020-08-12 20:21         ` Zwane Mwaikambo
2020-09-04  7:21           ` [PATCH]] drm/dp check aux_dev before use in drm_dp_aux_dev_get_by_minor() Zwane Mwaikambo
2020-09-07 11:05             ` Ville Syrjälä
2020-09-08 16:18               ` Zwane Mwaikambo
2020-08-18 17:58         ` [PATCH] drm: assure aux_dev is nonzero before using it Zwane Mwaikambo
2020-09-08 18:41           ` Lyude Paul
  -- strict thread matches above, loose matches on Subject: below --
2019-05-23 11:09 tcamuso
2019-05-24  8:36 ` Jani Nikula
2019-05-24 10:48   ` tony camuso
2019-05-24 11:58     ` Ville Syrjälä
2019-07-10 13:47   ` Tony Camuso
2019-07-10 13:56     ` Ville Syrjälä
2019-07-12 16:07       ` Tony Camuso
2019-07-12 17:06         ` Ville Syrjälä
2019-07-12 17:35           ` Tony Camuso
2019-09-23 15:03           ` Tony Camuso
2019-09-23 15:22             ` Ville Syrjälä

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=alpine.DEB.2.21.2008101004110.27032@montezuma.home \
    --to=zwanem@gmail.com \
    --cc=dkwon@redhat.com \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=tcamuso@redhat.com \
    --subject='Re: [PATCH] drm: assure aux_dev is nonzero before using it' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).