Cc'ing some others

On Mon., 16 Jul. 2018, 23:33 Damir Shaikhutdinov, < Damir.Shaikhutdinov@opensynergy.com> wrote:

Hi Dave!

I'm debugging virtio gpu unloading path in kernel 4.14, and found some bug that presents even in 4.18.

In file drivers/gpu/drm/virtio/virtgpu_display.c:

static void virtio_gpu_conn_destroy https://elixir.bootlin.com/linux/v4.18-rc5/ident/virtio_gpu_conn_destroy(struct drm_connector https://elixir.bootlin.com/linux/v4.18-rc5/ident/drm_connector *connector){ struct virtio_gpu_output https://elixir.bootlin.com/linux/v4.18-rc5/ident/virtio_gpu_output *virtio_gpu_output https://elixir.bootlin.com/linux/v4.18-rc5/ident/virtio_gpu_output = drm_connector_to_virtio_gpu_output https://elixir.bootlin.com/linux/v4.18-rc5/ident/drm_connector_to_virtio_gpu_output(connector);

drm_connector_unregister https://elixir.bootlin.com/linux/v4.18-rc5/ident/drm_connector_unregister(connector); drm_connector_cleanup https://elixir.bootlin.com/linux/v4.18-rc5/ident/drm_connector_cleanup(connector); kfree https://elixir.bootlin.com/linux/v4.18-rc5/ident/kfree(virtio_gpu_output https://elixir.bootlin.com/linux/v4.18-rc5/ident/virtio_gpu_output); // <--- here is the bug}

https://elixir.bootlin.com/linux/v4.18-rc5/source/drivers/gpu/drm/virtio/vir...

This virtio_gpu_output pointer in this function points to a memory NOT allocated by k*alloc, but to an element of outputs array in struct virtio device.

You can find the actual code that initialize connector few lines lower:

struct virtio_gpu_output https://elixir.bootlin.com/linux/v4.18-rc5/ident/virtio_gpu_output *output https://elixir.bootlin.com/linux/v4.18-rc5/ident/output = vgdev->outputs https://elixir.bootlin.com/linux/v4.18-rc5/ident/outputs + index; struct drm_connector https://elixir.bootlin.com/linux/v4.18-rc5/ident/drm_connector *connector = &output https://elixir.bootlin.com/linux/v4.18-rc5/ident/output->conn https://elixir.bootlin.com/linux/v4.18-rc5/ident/conn;

.... drm_connector_init https://elixir.bootlin.com/linux/v4.18-rc5/ident/drm_connector_init(dev, connector, &virtio_gpu_connector_funcs https://elixir.bootlin.com/linux/v4.18-rc5/ident/virtio_gpu_connector_funcs, DRM_MODE_CONNECTOR_VIRTUAL https://elixir.bootlin.com/linux/v4.18-rc5/ident/DRM_MODE_CONNECTOR_VIRTUAL);

So, connector points to a field "conn" inside struct "virtio_gpu_output", which is an element of array vgdev->outputs, and not something that was allocated separately.

Kfree-ing it is an error.

Can you confirm that bug?

With best regards,

Damir Shaikhutdinov Senior Software Engineer

OpenSynergy GmbH Rotherstr. 20, 10245 Berlin

Phone: +49 30 60 98 54 0. Fax: +49 30 60 98 54 0 -99 EMail: damir.shaikhutdinov@opensynergy.com www.opensynergy.com

Handelsregister/Commercial Registry: Amtsgericht Charlottenburg, HRB 108616B Geschäftsführung: Stefaan Sonck Thiebaut, Rolf Morich