If drm_sysfs_minor_alloc() fail in drm_minor_alloc() we can end up
freeing invalid minor->kdev pointer and drm_minor_alloc_release()
will crash like below:
RIP: 0010:kobject_put+0x19/0x1c0
RSP: 0018:ffffbc7001637c38 EFLAGS: 00010282
RAX: ffffffffa8d6deb0 RBX: 00000000ffffffff RCX: ffff9cb5912d4540
RDX: ffffffffa9c45ec5 RSI: ffff9cb5902f2b68 RDI: fffffffffffffff4
RBP: fffffffffffffff4 R08: ffffffffa9c40dec R09: 0000000000000008
R10: ffffffffaa81f7d2 R11: 00000000aa81f7ca R12: ffff9cb5912d4540
R13: ffff9cb5912d4540 R14: dead000000000122 R15: dead000000000100
FS: 00007f56b06e6740(0000) GS:ffff9cb728b40000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000030 CR3: 000000011285b004 CR4: 0000000000170ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7: 0000000000000400
Call Trace:
<TASK>
drm_minor_alloc_release+0x19/0x50
drm_managed_release+0xab/0x150
drm_dev_init+0x21f/0x2f0
__devm_drm_dev_alloc+0x3c/0xa0
ivpu_probe+0x59/0x797 [intel_vpu 127058409b05eb2f99dcdecd3330bee28d6b3e76]
pci_device_probe+0xa4/0x160
really_probe+0x164/0x340
__driver_probe_device+0x10d/0x190
device_driver_attach+0x26/0x50
bind_store+0x9f/0x120
kernfs_fop_write_iter+0x12d/0x1c0
new_sync_write+0x106/0x180
vfs_write+0x216/0x2a0
ksys_write+0x65/0xe0
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x44/0xae
Fix this crash by checking minor->kdev when freeing.
Signed-off-by: Stanislaw Gruszka <stanislaw.grus...@linux.intel.com>
---
drivers/gpu/drm/drm_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 8214a0b1ab7f..e3a1243dd2ae 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -102,7 +102,8 @@ static void drm_minor_alloc_release(struct drm_device *dev,
void *data)
WARN_ON(dev != minor->dev);
- put_device(minor->kdev);
+ if (!IS_ERR(minor->kdev))
+ put_device(minor->kdev);
spin_lock_irqsave(&drm_minor_lock, flags);
idr_remove(&drm_minors_idr, minor->index);
--
2.25.1
