From: Arjan van de Ven <arjan@linux.intel.com>
Subject: [PATCH] drm: fix crash due to /proc registration race
The DRM layer creates proc entries like this:
ent = create_proc_entry(drm_proc_list[i].name,
S_IFREG | S_IRUGO, minor->dev_root);
if (!ent) {
... stuff ...
}
ent->read_proc = drm_proc_list[i].f;
ent->data = minor;
however that leaves a short window where the /proc file is visible,
but where ->data is not initialized yet.
It appears that this race is actually hit in practice:
http://www.kerneloops.org/search.php?search=drm_name_info
(of course it could be some other race.. but this race appears
to be there at least)
Reported-by: www.kerneloops.org
Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
---
drivers/char/drm/drm_proc.c | 13 ++++++++++++-
1 files changed, 12 insertions(+), 1 deletions(-)
diff --git a/drivers/char/drm/drm_proc.c b/drivers/char/drm/drm_proc.c
index 93b1e04..19e61ad 100644
--- a/drivers/char/drm/drm_proc.c
+++ b/drivers/char/drm/drm_proc.c
@@ -164,9 +164,20 @@ static int drm_name_info(char *buf, char **start, off_t offset, int request,
int *eof, void *data)
{
struct drm_minor *minor = (struct drm_minor *) data;
- struct drm_device *dev = minor->dev;
+ struct drm_device *dev;
int len = 0;
+ /*
+ * When creating the /proc files, there is a tiny race window
+ * where "data" isn't assigned yet... error out rather than dereference
+ */
+ if (!data) {
+ *eof = 1;
+ return 0;
+ }
+
+ dev = minor->dev;
+
if (offset > DRM_PROC_LIMIT) {
*eof = 1;
return 0;
--
1.5.5.1
--
If you want to reach me at my work email, use arjan@linux.intel.com
For development, discussion and tips for power savings,
visit http://www.lesswatts.org
--
