From 41167b93062b0e6806ea63ac55c5e63211a34429 Mon Sep 17 00:00:00 2001 From: Xie Yongji Date: Wed, 4 Jan 2023 22:16:08 +0800 Subject: [PATCH 1/2] drm/virtio: Fixes a potential NULL pointer dereference on probe failure mainline inclusion from mainline-v5.13-rc2 commit 17f46f488a5d82c5568e6e786cd760bba1c2ee09 category: bugfix bugzilla: https://gitee.com/openeuler/stratovirt/issues/I66GGJ CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.15&id=17f46f488a5d82c5568e6e786cd760bba1c2ee09 -------------------------------- The dev->dev_private might not be allocated if virtio_gpu_pci_quirk() or virtio_gpu_init() failed. In this case, we should avoid the cleanup in virtio_gpu_release(). Signed-off-by: Xie Yongji Link: http://patchwork.freedesktop.org/patch/msgid/20210517084913.403-1-xieyongji@bytedance.com Signed-off-by: Gerd Hoffmann Signed-off-by: Binfeng Wu --- drivers/gpu/drm/virtio/virtgpu_kms.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c index 8422ca069a72..dd444a8b2bc1 100644 --- a/drivers/gpu/drm/virtio/virtgpu_kms.c +++ b/drivers/gpu/drm/virtio/virtgpu_kms.c @@ -240,6 +240,9 @@ void virtio_gpu_release(struct drm_device *dev) { struct virtio_gpu_device *vgdev = dev->dev_private; + if (!vgdev) + return; + virtio_gpu_modeset_fini(vgdev); virtio_gpu_free_vbufs(vgdev); virtio_gpu_cleanup_cap_cache(vgdev); -- Gitee From f102b55253ea3f738b6464649b3ad297b859bcbf Mon Sep 17 00:00:00 2001 From: Xie Yongji Date: Wed, 4 Jan 2023 22:50:54 +0800 Subject: [PATCH 2/2] drm/virtio: free virtqueues on probe failure mainline inclusion from mainline-v5.13-rc2 commit 058acb33d100c5cceab10d2dd388cf9bc0918908 category: bugfix bugzilla: https://gitee.com/openeuler/stratovirt/issues/I66GGJ CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.15&id=058acb33d100c5cceab10d2dd388cf9bc0918908 -------------------------------- We should call virtio_gpu_deinit() to free virtqueues when drm_dev_register() failed. Signed-off-by: Xie Yongji Link: http://patchwork.freedesktop.org/patch/msgid/20210517084913.403-3-xieyongji@bytedance.com Signed-off-by: Gerd Hoffmann Signed-off-by: Binfeng Wu --- drivers/gpu/drm/virtio/virtgpu_drv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c index b039f493bda9..e3a9309da728 100644 --- a/drivers/gpu/drm/virtio/virtgpu_drv.c +++ b/drivers/gpu/drm/virtio/virtgpu_drv.c @@ -122,11 +122,13 @@ static int virtio_gpu_probe(struct virtio_device *vdev) ret = drm_dev_register(dev, 0); if (ret) - goto err_free; + goto err_deinit; drm_fbdev_generic_setup(vdev->priv, 32); return 0; +err_deinit: + virtio_gpu_deinit(dev); err_free: drm_dev_put(dev); return ret; -- Gitee