Unverified Commit ed15511a authored by José Expósito's avatar José Expósito Committed by Louis Chauvet
Browse files

drm/vkms: Fix use after free and double free on init error 



If the driver initialization fails, the vkms_exit() function might
access an uninitialized or freed default_config pointer and it might
double free it.

Fix both possible errors by initializing default_config only when the
driver initialization succeeded.

Reported-by: default avatarLouis Chauvet <louis.chauvet@bootlin.com>
Closes: https://lore.kernel.org/all/Z5uDHcCmAwiTsGte@louis-chauvet-laptop/


Fixes: 2df7af93 ("drm/vkms: Add vkms_config type")
Signed-off-by: default avatarJosé Expósito <jose.exposito89@gmail.com>
Reviewed-by: default avatarThomas Zimmermann <tzimmremann@suse.de>
Reviewed-by: default avatarLouis Chauvet <louis.chauvet@bootlin.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20250212084912.3196-1-jose.exposito89@gmail.com


Signed-off-by: default avatarLouis Chauvet <louis.chauvet@bootlin.com>
parent ff3881cc

drivers/gpu/drm/vkms/vkms_drv.c

+9 −6
Original line number Diff line number Diff line
@@ -235,19 +235,21 @@ static int __init vkms_init(void) 
	if (!config)

		return -ENOMEM;



	default_config = config;



	config->cursor = enable_cursor;

	config->writeback = enable_writeback;

	config->overlay = enable_overlay;



	ret = vkms_create(config);

	if (ret)

	if (ret) {

		kfree(config);



		return ret;

	}



	default_config = config;



	return 0;

}



static void vkms_destroy(struct vkms_config *config)

{

	struct platform_device *pdev;
@@ -269,9 +271,10 @@ static void vkms_destroy(struct vkms_config *config) 


static void __exit vkms_exit(void)

{

	if (default_config->dev)

		vkms_destroy(default_config);

	if (!default_config)

		return;



	vkms_destroy(default_config);

	kfree(default_config);

}