From nobody Mon Apr 29 07:11:50 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9ECEDC77B7A for ; Fri, 2 Jun 2023 21:05:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236467AbjFBVFI (ORCPT ); Fri, 2 Jun 2023 17:05:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35610 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236169AbjFBVFC (ORCPT ); Fri, 2 Jun 2023 17:05:02 -0400 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DC175E45; Fri, 2 Jun 2023 14:05:01 -0700 (PDT) Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 352J64Zk017098; Fri, 2 Jun 2023 21:04:59 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicinc.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=qcppdkim1; bh=2t5Q8jvXuR0HuNXjcwpUz4E1BgD0D0RZFqnR78v/kig=; b=P6MmjXClbQURaSRy0DOb53/uEdUMoU5z6HbGbQaXTyf2HWO2aP8Zk+v5DBA74CF43xw8 STDcMTFwh4Z4muPU0x1wdBSSx77rxrRvi9InOFk4+0uu4imRDtBHXIMyxvXDjxegG4x8 PjhJAA2dTtTrs9YDaWST+h+no6tejNtVY0JStN9ZkLqb6HCw+W+c6t/Gr2RQlAhr0AhJ 6EXVNQrpX9PiP6nUR46jIMZq7e4E3vaU6dh7lDy2I3HsdKziBL4aBeKpDJxEQySXDJfK DGPQgeGbrwOUzmR4NfUDjk1Fz7nsB3JGTt6rZ8d+XtFyHoOB+Ete8VE+YnmATQ5RnlkR SQ== Received: from nalasppmta01.qualcomm.com (Global_NAT1.qualcomm.com [129.46.96.20]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 3qydr5hg98-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Jun 2023 21:04:59 +0000 Received: from nalasex01a.na.qualcomm.com (nalasex01a.na.qualcomm.com [10.47.209.196]) by NALASPPMTA01.qualcomm.com (8.17.1.5/8.17.1.5) with ESMTPS id 352L4w4O031397 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 2 Jun 2023 21:04:58 GMT Received: from jhugo-lnx.qualcomm.com (10.80.80.8) by nalasex01a.na.qualcomm.com (10.47.209.196) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.42; Fri, 2 Jun 2023 14:04:57 -0700 From: Jeffrey Hugo To: CC: , , , , , , , Pranjal Ramajor Asha Kanojiya , Jeffrey Hugo Subject: [PATCH 1/2] accel/qaic: Free user handle on interrupted mutex Date: Fri, 2 Jun 2023 15:04:39 -0600 Message-ID: <20230602210440.8411-2-quic_jhugo@quicinc.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230602210440.8411-1-quic_jhugo@quicinc.com> References: <20230602210440.8411-1-quic_jhugo@quicinc.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.80.80.8] X-ClientProxiedBy: nasanex01a.na.qualcomm.com (10.52.223.231) To nalasex01a.na.qualcomm.com (10.47.209.196) X-QCInternal: smtphost X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=5800 signatures=585085 X-Proofpoint-ORIG-GUID: lPDFZuZdp3vIIgEoLI4N_rFVa-vkrqF9 X-Proofpoint-GUID: lPDFZuZdp3vIIgEoLI4N_rFVa-vkrqF9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.254,Aquarius:18.0.957,Hydra:6.0.573,FMLib:17.11.176.26 definitions=2023-06-02_16,2023-06-02_02,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 adultscore=0 clxscore=1015 mlxscore=0 spamscore=0 mlxlogscore=893 priorityscore=1501 suspectscore=0 malwarescore=0 lowpriorityscore=0 impostorscore=0 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2304280000 definitions=main-2306020163 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Carl Vanderlip After user handle is allocated, if mutex is interrupted, we do not free the user handle and return an error. Kref had been initialized, but not added to users list, so device teardown would also not call free_usr. Fixes: c501ca23a6a3 ("accel/qaic: Add uapi and core driver file") Signed-off-by: Carl Vanderlip Reviewed-by: Pranjal Ramajor Asha Kanojiya Reviewed-by: Jeffrey Hugo Signed-off-by: Jeffrey Hugo --- drivers/accel/qaic/qaic_drv.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/accel/qaic/qaic_drv.c b/drivers/accel/qaic/qaic_drv.c index 2d0828db28d8..961cd341b414 100644 --- a/drivers/accel/qaic/qaic_drv.c +++ b/drivers/accel/qaic/qaic_drv.c @@ -97,6 +97,7 @@ static int qaic_open(struct drm_device *dev, struct drm_f= ile *file) =20 cleanup_usr: cleanup_srcu_struct(&usr->qddev_lock); + ida_free(&qaic_usrs, usr->handle); free_usr: kfree(usr); dev_unlock: --=20 2.40.1 From nobody Mon Apr 29 07:11:50 2024 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 89B1BC7EE29 for ; Fri, 2 Jun 2023 21:05:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236126AbjFBVFK (ORCPT ); Fri, 2 Jun 2023 17:05:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35620 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236423AbjFBVFE (ORCPT ); Fri, 2 Jun 2023 17:05:04 -0400 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B764B197; Fri, 2 Jun 2023 14:05:03 -0700 (PDT) Received: from pps.filterd (m0279866.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 352KXb37024509; Fri, 2 Jun 2023 21:05:01 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=quicinc.com; h=from : to : cc : subject : date : message-id : in-reply-to : references : mime-version : content-transfer-encoding : content-type; s=qcppdkim1; bh=rudHhuOEFo80iwVEJ5/Pzd3vaSKEsnfQGFbEXor5irM=; b=lT5Jvb1dPzua3uCa/gwU8QVQGzXidJ8KmYCMnMuuyeyViz+f+ZoFLTsy9Ett87R9OGsA /BesMPhfKv0+iqmiipcN313Uyc9oYU+3xQ030+UCRwvQqp53yB/d7k4OKZ823R/uB/pj Zy5x+68GO6gGHjjdye1L+4kTeb8GjVCFmCiODjM9rU8qrxsCD3EexhTXYuEqAhdtzMEM rFh7VJb/8dm+Hj/490zwLGOW+sb+XICGsU9gDRvz/QY5B8U0CfNzppGtC5DtEVpfbt99 XOyxxYAe6a1iPFQnmrBpnLiTnmO5YWhyskoCTMSk3NIsN1IayvP4rfk+7RFgIO2N9iCV Sw== Received: from nalasppmta04.qualcomm.com (Global_NAT1.qualcomm.com [129.46.96.20]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 3qy1bcjsn8-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 02 Jun 2023 21:05:01 +0000 Received: from nalasex01a.na.qualcomm.com (nalasex01a.na.qualcomm.com [10.47.209.196]) by NALASPPMTA04.qualcomm.com (8.17.1.5/8.17.1.5) with ESMTPS id 352L50he005299 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Fri, 2 Jun 2023 21:05:00 GMT Received: from jhugo-lnx.qualcomm.com (10.80.80.8) by nalasex01a.na.qualcomm.com (10.47.209.196) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.42; Fri, 2 Jun 2023 14:04:59 -0700 From: Jeffrey Hugo To: CC: , , , , , , , Jeffrey Hugo , Pranjal Ramajor Asha Kanojiya Subject: [PATCH 2/2] accel/qaic: Fix NULL pointer deref in qaic_destroy_drm_device() Date: Fri, 2 Jun 2023 15:04:40 -0600 Message-ID: <20230602210440.8411-3-quic_jhugo@quicinc.com> X-Mailer: git-send-email 2.40.1 In-Reply-To: <20230602210440.8411-1-quic_jhugo@quicinc.com> References: <20230602210440.8411-1-quic_jhugo@quicinc.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.80.80.8] X-ClientProxiedBy: nasanex01a.na.qualcomm.com (10.52.223.231) To nalasex01a.na.qualcomm.com (10.47.209.196) X-QCInternal: smtphost X-Proofpoint-Virus-Version: vendor=nai engine=6200 definitions=5800 signatures=585085 X-Proofpoint-ORIG-GUID: jO6v4cEQTPOyKJf9k_z6fjSnn-4RCVxz X-Proofpoint-GUID: jO6v4cEQTPOyKJf9k_z6fjSnn-4RCVxz X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.254,Aquarius:18.0.957,Hydra:6.0.573,FMLib:17.11.176.26 definitions=2023-06-02_16,2023-06-02_02,2023-05-22_02 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 spamscore=0 malwarescore=0 bulkscore=0 mlxscore=0 lowpriorityscore=0 suspectscore=0 mlxlogscore=999 adultscore=0 clxscore=1015 priorityscore=1501 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2304280000 definitions=main-2306020163 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" If qaic_destroy_drm_device() is called before the device has fully initialized it will cause a NULL pointer dereference as the drm device has not yet been created. Fix this with a NULL check. Fixes: c501ca23a6a3 ("accel/qaic: Add uapi and core driver file") Signed-off-by: Jeffrey Hugo Reviewed-by: Carl Vanderlip Reviewed-by: Pranjal Ramajor Asha Kanojiya --- drivers/accel/qaic/qaic_drv.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/accel/qaic/qaic_drv.c b/drivers/accel/qaic/qaic_drv.c index 961cd341b414..b5ba550a0c04 100644 --- a/drivers/accel/qaic/qaic_drv.c +++ b/drivers/accel/qaic/qaic_drv.c @@ -225,6 +225,9 @@ static void qaic_destroy_drm_device(struct qaic_device = *qdev, s32 partition_id) struct qaic_user *usr; =20 qddev =3D qdev->qddev; + qdev->qddev =3D NULL; + if (!qddev) + return; =20 /* * Existing users get unresolvable errors till they close FDs. --=20 2.40.1