Evolution-X-Devices/kernel_nothing_sm7325
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

BACKPORT: dmabuf: fix NULL pointer dereference in dma_buf_release()

Browse Source 
NULL pointer dereference is observed while exporting the dmabuf but
failed to allocate the 'struct file' which results into the dropping
of the allocated dentry corresponding to this file in the dmabuf fs,
which is ending up in dma_buf_release() and accessing the
uninitialzed dentry->d_fsdata.

    Call stack on 5.4 is below:
    dma_buf_release+0x2c/0x254 drivers/dma-buf/dma-buf.c:88
    __dentry_kill+0x294/0x31c fs/dcache.c:584
    dentry_kill fs/dcache.c:673 [inline]
    dput+0x250/0x380 fs/dcache.c:859
    path_put+0x24/0x40 fs/namei.c:485
    alloc_file_pseudo+0x1a4/0x200
    fs/file_table.c:235
    dma_buf_getfile drivers/dma-buf/dma-buf.c:473 [inline]
    dma_buf_export+0x25c/0x3ec
    drivers/dma-buf/dma-buf.c:585

Fix this by checking for the valid pointer in the dentry->d_fsdata.

cherry picked from commit 19a508bd1ad8e444de86873bf2f2b2ab8edd6552

Bug: 175512919

Link: https://patchwork.freedesktop.org/patch/391319/
Change-Id: I3856a387d1902fd2b39b016e81283f082089131c
Cc: <stable@vger.kernel.org> [5.7+]
Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>
Signed-off-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Chao Hao <chao.hao@mediatek.com>
Signed-off-by: Chun-Hung Wu <chun-hung.wu@mediatek.com>
This commit is contained in:
Charan Teja Reddy
2020-12-14 11:18:09 +08:00
committed by Todd Kjos
parent 5d835560a3
commit e0b1644a47
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/dma-buf/dma-buf.c
View File

@@ -59,6 +59,8 @@ static void dma_buf_release(struct dentry *dentry)
struct dma_buf *dmabuf;
dmabuf = dentry->d_fsdata;
if (unlikely(!dmabuf))
return;
BUG_ON(dmabuf->vmapping_counter);