Re: [PATCH v3] Memory leak error in qxl unbind

[Markus Elfring]

…
> Fix: Check ret from ttm_pool_mgr_init; if non-zero, goto out cleans up
>refcount + debugfs.
…
> Fix: err_shrinker: label that finalizes + destroys all 64 pool types
> before returning.
> 
> You must apply the patch from the link "[PATCH v3] drm/qxl: fix
> use-after-free in qxl_irq_handler on PCI" before testing.
> If you don't apply this patch, you will get a UAF error when running
> the script above.
> 
> Fix: "Unchecked list_lru_init() return value in ttm_pool_type_init()
> causes a deterministic NULL pointer dereference in the newly added
> error path."
> Now check list_lru_init return value in ttm_pool_type_take, check if
> pt->pages.node is NULL in ttm_pool_type_fini and ttm_pool_type_init
> return value in ttm_pool_mgr_init.
> 
> Solved new issues:
> - [High] The patch introduces a use-after-free race condition between `ttm_pool_type_fini()` and the active memory shrinker `ttm_pool_shrink()` by calling `list_lru_destroy()` prematurely.

How do you think about to add any tags (like “Fixes” and “Cc”) accordingly?

See also:
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.2-rc5#n145
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v7.2-rc5#n34


> Solved pre-existing issues:
> - [High] `ttm_pool_type_init()` ignores the return value of `list_lru_init()`, leading to a NULL pointer dereference if allocation fails.
> - [High] `ttm_pool_shrink()` assumes `shrinker_list` is never empty, causing memory corruption and crashes during module unload if triggered.

Would another change description variant become better?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.2-rc5#n81


…
> Signed-off-by: Óscar Megía López <megia.oscar@xxxxxxxxx>
> ---
>  drivers/gpu/drm/drm_gem.c        |  1 +
…

Some contributors would appreciate patch version descriptions.
https://lore.kernel.org/all/?q=%22This+looks+like+a+new+version+of+a+previously+submitted+patch%22
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.2-rc5#n310

Regards,
Markus