From e0b1644a472e806b7b8c0110de81913bb2dbc918 Mon Sep 17 00:00:00 2001 From: Charan Teja Reddy Date: Mon, 14 Dec 2020 11:18:09 +0800 Subject: [PATCH] BACKPORT: dmabuf: fix NULL pointer dereference in dma_buf_release() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit NULL pointer dereference is observed while exporting the dmabuf but failed to allocate the 'struct file' which results into the dropping of the allocated dentry corresponding to this file in the dmabuf fs, which is ending up in dma_buf_release() and accessing the uninitialzed dentry->d_fsdata. Call stack on 5.4 is below: dma_buf_release+0x2c/0x254 drivers/dma-buf/dma-buf.c:88 __dentry_kill+0x294/0x31c fs/dcache.c:584 dentry_kill fs/dcache.c:673 [inline] dput+0x250/0x380 fs/dcache.c:859 path_put+0x24/0x40 fs/namei.c:485 alloc_file_pseudo+0x1a4/0x200 fs/file_table.c:235 dma_buf_getfile drivers/dma-buf/dma-buf.c:473 [inline] dma_buf_export+0x25c/0x3ec drivers/dma-buf/dma-buf.c:585 Fix this by checking for the valid pointer in the dentry->d_fsdata. cherry picked from commit 19a508bd1ad8e444de86873bf2f2b2ab8edd6552 Bug: 175512919 Link: https://patchwork.freedesktop.org/patch/391319/ Change-Id: I3856a387d1902fd2b39b016e81283f082089131c Cc: [5.7+] Signed-off-by: Charan Teja Reddy Signed-off-by: Christian König Reviewed-by: Christian König Signed-off-by: Chao Hao Signed-off-by: Chun-Hung Wu --- drivers/dma-buf/dma-buf.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index 92f04a31c326..8e820bb0ec85 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -59,6 +59,8 @@ static void dma_buf_release(struct dentry *dentry) struct dma_buf *dmabuf; dmabuf = dentry->d_fsdata; + if (unlikely(!dmabuf)) + return; BUG_ON(dmabuf->vmapping_counter);