Received: by 2002:a05:6a10:8c0a:0:0:0:0 with SMTP id go10csp1977056pxb; Fri, 5 Mar 2021 04:36:24 -0800 (PST) X-Google-Smtp-Source: ABdhPJz3G8o9OSSJ95bM7K2f1iI/4GMagXYK0/9Mz2LBeMhJ8X68D1IssywZfqqL7+KQMTgFI9BB X-Received: by 2002:a17:906:894:: with SMTP id n20mr2001589eje.57.1614947783803; Fri, 05 Mar 2021 04:36:23 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1614947783; cv=none; d=google.com; s=arc-20160816; b=hvRKiq+2ONmo00y2GEX1lix16pDNHb82Ip+sBe7+UGz9UmYYS5NRFjebIR6as5cXvR n/KPEAcnFW6MliMDUjHH5RO8UxpVORJHkFcdWkSwamQduU/Egqeo3g8W9MucGsvKCEt/ C8OJHxO59JWzG6ZevUpuNM+vcSXBJtbagrTBucTvs1An3lbRz/Oie5K/O/A0uc1mvzbb RtvBDeFFX85WA355Q04x6podijYB5LsxofURBpypjlMXdNO1awOR4YCDQyfHm7Sgw3Ec Y8XE+iagDkq4CC16FmWrYesU/GO+2rWaApvdA6Nu7JMURhVxWIdKaLV5aTopKpw+VUjT LkhA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=PN4EiinnZQoF4bIGqgMqKgUNNzD7jHdJhvHWLkyFgQg=; b=fi2xhSdLfQRUw8JlRz/5Mlidsfq1nlIA1V/64fp21DLWun3CaLoBaOzxI3GarJQWdA qYcUULB7Jf0GuQots6KIYhV4cmBS0r31MgJ2NkwbejrbV2BkVJZiQ5uDYAlCGIykJjp5 CDAcFhQMOMjtx1UOCTBObYB/yl3ej3f674y3r67IyTv6E0NT2SE3lQtfmAGk8B08R3Rp 8Vl7adEEYrf9XSnR8gt2giGuNie4/7XYjd+CjCJ+xVEKLi3Qz/6nNuLDTy4+Y/nAP0pg eCrCO4TBdFKdZ/fTyRqx4X6SAjeUMIakwsQBDHW0a4HaSh4Fj3/EUJKnrbGUKfmQDX0a 8ofw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=hjLUDFu4; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id b22si1263064ejj.279.2021.03.05.04.36.00; Fri, 05 Mar 2021 04:36:23 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=hjLUDFu4; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232709AbhCEMfO (ORCPT + 99 others); Fri, 5 Mar 2021 07:35:14 -0500 Received: from mail.kernel.org ([198.145.29.99]:45814 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232547AbhCEMe1 (ORCPT ); Fri, 5 Mar 2021 07:34:27 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 7F4D86501A; Fri, 5 Mar 2021 12:34:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1614947667; bh=KogIUWx0wSgC1pHiOsxhvP2cHLrrTApNm26ILaWxtHk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hjLUDFu4MKVU3PeO6gpqTO4zwgLqKjBnBs2W3utYqoAh8JMAlGMKzPJxBfR4g9tsA er2bVvkLSNO7Rj2uMWf8PK5yOPJ9XmayigM9iYa0BEekxKFW4pAyuNVo2LPn3ll5+L Njk/EqqyatzeS0bhYYDUkpZdeZqKw0UnoQRTmoas= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tian Tao , Thomas Zimmermann , Sasha Levin Subject: [PATCH 5.4 41/72] drm/hisilicon: Fix use-after-free Date: Fri, 5 Mar 2021 13:21:43 +0100 Message-Id: <20210305120859.355536960@linuxfoundation.org> X-Mailer: git-send-email 2.30.1 In-Reply-To: <20210305120857.341630346@linuxfoundation.org> References: <20210305120857.341630346@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tian Tao [ Upstream commit c855af2f9c5c60760fd1bed7889a81bc37d2591d ] Fix the problem of dev being released twice. ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 75 PID: 15700 at lib/refcount.c:28 refcount_warn_saturate+0xd4/0x150 CPU: 75 PID: 15700 Comm: rmmod Tainted: G E 5.10.0-rc3+ #3 Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDDA, BIOS 0.88 07/24/2019 pstate: 40400009 (nZcv daif +PAN -UAO -TCO BTYPE=--) pc : refcount_warn_saturate+0xd4/0x150 lr : refcount_warn_saturate+0xd4/0x150 sp : ffff2028150cbc00 x29: ffff2028150cbc00 x28: ffff2028150121c0 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000003 x23: 0000000000000000 x22: ffff2028150cbc90 x21: ffff2020038a30a8 x20: ffff2028150cbc90 x19: ffff0020cd938020 x18: 0000000000000010 x17: 0000000000000000 x16: 0000000000000000 x15: ffffffffffffffff x14: ffff2028950cb88f x13: ffff2028150cb89d x12: 0000000000000000 x11: 0000000005f5e0ff x10: ffff2028150cb800 x9 : 00000000ffffffd0 x8 : 75203b776f6c6672 x7 : ffff800011a6f7c8 x6 : 0000000000000001 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff202ffe2f9dc0 x1 : ffffa02fecf40000 x0 : 0000000000000026 Call trace: refcount_warn_saturate+0xd4/0x150 devm_drm_dev_init_release+0x50/0x70 devm_action_release+0x20/0x30 release_nodes+0x13c/0x218 devres_release_all+0x80/0x170 device_release_driver_internal+0x128/0x1f0 driver_detach+0x6c/0xe0 bus_remove_driver+0x74/0x100 driver_unregister+0x34/0x60 pci_unregister_driver+0x24/0xd8 hibmc_pci_driver_exit+0x14/0xe858 [hibmc_drm] __arm64_sys_delete_module+0x1fc/0x2d0 el0_svc_common.constprop.3+0xa8/0x188 do_el0_svc+0x80/0xa0 el0_sync_handler+0x8c/0xb0 el0_sync+0x15c/0x180 CPU: 75 PID: 15700 Comm: rmmod Tainted: G E 5.10.0-rc3+ #3 Hardware name: Huawei TaiShan 200 (Model 2280)/BC82AMDDA, BIOS 0.88 07/24/2019 Call trace: dump_backtrace+0x0/0x208 show_stack+0x2c/0x40 dump_stack+0xd8/0x10c __warn+0xac/0x128 report_bug+0xcc/0x180 bug_handler+0x24/0x78 call_break_hook+0x80/0xa0 brk_handler+0x28/0x68 do_debug_exception+0x9c/0x148 el1_sync_handler+0x7c/0x128 el1_sync+0x80/0x100 refcount_warn_saturate+0xd4/0x150 devm_drm_dev_init_release+0x50/0x70 devm_action_release+0x20/0x30 release_nodes+0x13c/0x218 devres_release_all+0x80/0x170 device_release_driver_internal+0x128/0x1f0 driver_detach+0x6c/0xe0 bus_remove_driver+0x74/0x100 driver_unregister+0x34/0x60 pci_unregister_driver+0x24/0xd8 hibmc_pci_driver_exit+0x14/0xe858 [hibmc_drm] __arm64_sys_delete_module+0x1fc/0x2d0 el0_svc_common.constprop.3+0xa8/0x188 do_el0_svc+0x80/0xa0 el0_sync_handler+0x8c/0xb0 el0_sync+0x15c/0x180 ---[ end trace 00718630d6e5ff18 ]--- Signed-off-by: Tian Tao Acked-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/1607941973-32287-1-git-send-email-tiantao6@hisilicon.com Signed-off-by: Sasha Levin --- drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c index c103005b0a33..a34ef5ec7d42 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c @@ -376,7 +376,6 @@ static void hibmc_pci_remove(struct pci_dev *pdev) drm_dev_unregister(dev); hibmc_unload(dev); - drm_dev_put(dev); } static struct pci_device_id hibmc_pci_table[] = { -- 2.30.1