Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.31 as permitted sender) client-ip=23.128.96.31;
From:   Donald Robson <donald.robson@imgtec.com>
To:     <dri-devel@lists.freedesktop.org>, <linux-kernel@vger.kernel.org>
CC:     <frank.binns@imgtec.com>, <donald.robson@imgtec.com>,
        <matt.coster@imgtec.com>, <maarten.lankhorst@linux.intel.com>,
        <mripard@kernel.org>, <tzimmermann@suse.de>, <airlied@gmail.com>,
        <daniel@ffwll.ch>
Subject: [PATCH] drm/imagination: Fixed oops when misusing ioctl CREATE_HWRT_DATASET
Date:   Fri,  8 Dec 2023 16:30:19 +0000
Message-Id: <20231208163019.95913-1-donald.robson@imgtec.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?sx4jlMVNcNsPSjZkI3HMrjEXNZtGsJtxrwTHShidotEPrOplvUf9QmD4qATW?=
 =?us-ascii?Q?CWnwgRU+eZlFc2CUKTmTvCA3YTvleYTZLUXNf9m8LfPcKSjWGDTRa7bh6qs8?=
 =?us-ascii?Q?qulHTQUtw2Xek8sNX5BCQevWMYz5gMv7B80FIy6Z1BCSPNEHxJlgsm4RmCk9?=
 =?us-ascii?Q?ryp/3Acw0xUxcseJsetqAJPOTkZn6pT49xLPFDTR1pUN7TodRI2j1Y+6xif3?=
 =?us-ascii?Q?tVW8xohsA6ooLinsAaPWhVVwcthdaJZrCyu0qYuzSDWqE/6PGjhS3xNqD5Z1?=
 =?us-ascii?Q?ncCvlnASiO9MnrTM3TkwF9c2l8BJSSflaLK7qjgOVGueL1TO+EZ4bVRf+PjU?=
 =?us-ascii?Q?VfALonsWD5gO5qrY/LA9z1gN9wM5e31a1GPBZVq+uktAlJjvHhKMbpToO496?=
 =?us-ascii?Q?gxLIEpxxvGJ1TswaKB3TIGfl22EIo+KlrpsepY3peR0Y9TqCDqwda1Jc7W6e?=
 =?us-ascii?Q?IH9eZQMu0jhlESixblo/mmRm9QVk1GFZD11/QrvOfzN4DpA8MmahdIFJzM5w?=
 =?us-ascii?Q?qsaEZa3BB4UZHyW7KpDK70XtEs0mxSfhhUIAKhWzfMY7Ugx29/6jXtMI8PKE?=
 =?us-ascii?Q?6IqI8zQ09WZLApijzCQ6VV9bu+ijuL0IIlS64BKIQcJ2opmTFY26mfrjHtD1?=
 =?us-ascii?Q?T/+NiHws/ZzIkApXMlIRCvFPilb0ttPjhKgo1iMWrhwQ1J8op444y/HzxFqM?=
 =?us-ascii?Q?V4FLy/5ov6bFdbq7ayRSm7dKHhq3jMsE1f/xY69nDGx6fvFrXtUOTUVHowXo?=
 =?us-ascii?Q?nvwUPLrZVf1YTGx+HnAtMFD3qyFEhlYAYdsOcn5oHwZAxeTWwmWkmsyAlav6?=
 =?us-ascii?Q?vjWBc+YGtPNxz/x1rMuXNVPg+WKtSHg2ZiepxS3TVm/2ZG3A0rQdyhgk0mPe?=
 =?us-ascii?Q?/lbO5ZPuhiGULg6vI/4SaGL8EEv6fHFT40+4XLFZ4CmFyR2tP1ZQi8JvLvKy?=
 =?us-ascii?Q?moh2fpdpxAmY/KWWYCaJK619uCJVYOu1fpWB19u+8E4wmjvU8e51sdQbrJxM?=
 =?us-ascii?Q?ZWfGz96Yb96S+ShwONKtHPXH1UQI8Y7qcbEYedZs4BS+MpZXqLSV/WYYI0LT?=
 =?us-ascii?Q?fkeNFzeeegqw2w/SPBtYlbgBL93ABlRPZxUgfnyIzFKyao/dDum+q/BwCNIl?=
 =?us-ascii?Q?ztdAQx8okSXhTOY4HwEyN8E1GMwz9TnRudY6D897MmMDym0nEn4OnHv7DhEX?=
 =?us-ascii?Q?n7Hxj6uRpmUWBtKUx9YHaksAt556X99PzGFaEch5Xo1Ekb8c4mg961fcRsOb?=
 =?us-ascii?Q?PJ+YMmW9h7HttUA/qk2uwyBci2dhsljWwdtavwfBgfXK3WFYcokAY5pnd0vC?=
 =?us-ascii?Q?86HY1qnT02Jkm29pqvo2d7KUqDaSgVbrrZ/lW7KrURAm61KWbdaZDEXgY+8t?=
 =?us-ascii?Q?8ax1FHVJ7/Op3k25XXomUI6ZMuVANLKlNv3L52oi1FSzcYbRovEDXRVUnIso?=
 =?us-ascii?Q?mPOYbblCOL8i1cHi6eZcVj3MPk2jCnWujbdpLXbj1okF1bcmKOrQlFh4sn0L?=
 =?us-ascii?Q?NrhlpqLaCRyamU5G8oR+NBtt2s0vmgWGyWdsKEMaTd0sgXjc1dndgKXUv8uD?=
 =?us-ascii?Q?9tSrsm8CDtMBkhkgwjo4/WINmxzTYV6U36u6DPUihv5TeeK6LEWD9vNXnT6q?=
 =?us-ascii?Q?bw=3D=3D?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 4dac6a65-a628-4e57-c9db-08dbf80b0845
X-MS-Exchange-CrossTenant-AuthSource: LO2P265MB4600.GBRP265.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Dec 2023 16:30:47.1292
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 0d5fd8bb-e8c2-4e0a-8dd5-2c264f7140fe
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: VxEd1755un8LFpdxUmMSy1KgddrTJZo4rmMViRrREB5YzhGsHmHSgVD1KM5eL8bVnpydvhNDBlneJ/m8wxZJFsr5VacXIegAPes8T/sly0Y=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP265MB6102
X-OriginatorOrg: imgtec.com
X-EXCLAIMER-MD-CONFIG: 15a78312-3e47-46eb-9010-2e54d84a9631
X-Proofpoint-ORIG-GUID: Rc1aDK3cqQyp8_dyUOAc9yXl_F8Em3xu
X-Proofpoint-GUID: Rc1aDK3cqQyp8_dyUOAc9yXl_F8Em3xu
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIM_SIGNED,DKIM_VALID,
	DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,
	SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable
	autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on morse.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (morse.vger.email [0.0.0.0]); Fri, 08 Dec 2023 08:31:38 -0800 (PST)

While writing the matching IGT suite I discovered that it's possible to
cause a kernel oops when using DRM_IOCTL_PVR_CREATE_HWRT_DATASET when
the call to hwrt_init_common_fw_structure() fails.

Use an unwind-type error path to avoid cleaning up the object using the
the release function before it is fully resolved.

Signed-off-by: Donald Robson <donald.robson@imgtec.com>
---
 drivers/gpu/drm/imagination/pvr_hwrt.c | 27 +++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/drivers/gpu/drm/imagination/pvr_hwrt.c b/drivers/gpu/drm/imagination/pvr_hwrt.c
index c4213c18489e..54f88d6c01e5 100644
--- a/drivers/gpu/drm/imagination/pvr_hwrt.c
+++ b/drivers/gpu/drm/imagination/pvr_hwrt.c
@@ -458,7 +458,7 @@ pvr_hwrt_dataset_create(struct pvr_file *pvr_file,
 			struct drm_pvr_ioctl_create_hwrt_dataset_args *args)
 {
 	struct pvr_hwrt_dataset *hwrt;
-	int err;
+	int err, i = 0;
 
 	/* Create and fill out the kernel structure */
 	hwrt = kzalloc(sizeof(*hwrt), GFP_KERNEL);
@@ -466,35 +466,36 @@ pvr_hwrt_dataset_create(struct pvr_file *pvr_file,
 	if (!hwrt)
 		return ERR_PTR(-ENOMEM);
 
-	kref_init(&hwrt->ref_count);
-
 	err = hwrt_init_kernel_structure(pvr_file, args, hwrt);
 	if (err < 0)
 		goto err_free;
 
 	err = hwrt_init_common_fw_structure(pvr_file, args, hwrt);
 	if (err < 0)
-		goto err_free;
+		goto err_fini_kernel_structure;
 
-	for (int i = 0; i < ARRAY_SIZE(hwrt->data); i++) {
+	for (; i < ARRAY_SIZE(hwrt->data); i++) {
 		err = hwrt_data_init_fw_structure(pvr_file, hwrt, args,
 						  &args->rt_data_args[i],
 						  &hwrt->data[i]);
-		if (err < 0) {
-			i--;
-			/* Destroy already created structures. */
-			for (; i >= 0; i--)
-				hwrt_data_fini_fw_structure(hwrt, i);
-			goto err_free;
-		}
+		if (err < 0)
+			goto err_fini_data_structures;
 
 		hwrt->data[i].hwrt_dataset = hwrt;
 	}
 
+	kref_init(&hwrt->ref_count);
 	return hwrt;
 
+err_fini_data_structures:
+	while (--i >= 0)
+		hwrt_data_fini_fw_structure(hwrt, i);
+
+err_fini_kernel_structure:
+	hwrt_fini_kernel_structure(hwrt);
+
 err_free:
-	pvr_hwrt_dataset_put(hwrt);
+	kfree(hwrt);
 
 	return ERR_PTR(err);
 }
-- 
2.25.1