> When allocating a `qxl_release` structure with `kmalloc()`, the underlying > memory contained uninitialized garbage. Specifically, `release->base.flags` > (part of the embedded `dma_fence`) was not cleared. > > This garbage in `base.flags` caused helper functions such as > `dma_fence_was_initialized()` to return true even for releases where the > fence was never actually initialized (e.g. via `dma_fence_init()`). > > Consequently, during release cleanup in `qxl_release_free()`, the driver > attempted to put/free an uninitialized `dma_fence`, leading to refcount > underflows (`refcount_t: underflow; use-after-free`) and subsequent NULL > pointer dereferences in `dma_fence_signal_timestamp_locked()`. > > Fix this by switching from `kmalloc()` to `kzalloc_obj()` in > `qxl_release_alloc()`, ensuring all fields (including embedded fence > [ ... ] > BUG: kernel NULL pointer dereference, address: 0000000000000028 > ... > RIP: 0010:dma_fence_signal_timestamp_locked+0x32/0x120 > > Signed-off-by: Jiri Slaby (SUSE) <[email protected]>
Sashiko has reviewed this patch and found no issues. -- Sashiko AI review ยท https://sashiko.dev/#/patchset/d9930eabe544a4bec5d55113ccd6b1bcd2998bd6.1793704291.git.jirisl...@kernel.org?part=1
