[PATCH] drm: fix the usage after free

[PATCH] drm: fix the usage after free

[Jammy Zhou]

From: Mathias Tillman <master.homer@gmail.com>

For readdir_r(), the next directory entry is returned in caller-allocted
buffer (pointered by pent here).

https://bugs.freedesktop.org/show_bug.cgi?id=91704

Signed-off-by: Jammy Zhou <Jammy.Zhou@amd.com>
---
 xf86drm.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/xf86drm.c b/xf86drm.c
index 5e02969..a7cc643 100644
--- a/xf86drm.c
+++ b/xf86drm.c
@@ -2803,11 +2803,12 @@ static char *drmGetMinorNameForFD(int fd, int type)
 
 	while (readdir_r(sysdir, pent, &ent) == 0 && ent != NULL) {
 		if (strncmp(ent->d_name, name, len) == 0) {
+			snprintf(dev_name, sizeof(dev_name), DRM_DIR_NAME "/%s",
+				 ent->d_name);
+
 			free(pent);
 			closedir(sysdir);
 
-			snprintf(dev_name, sizeof(dev_name), DRM_DIR_NAME "/%s",
-				 ent->d_name);
 			return strdup(dev_name);
 		}
 	}
-- 
1.9.1

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH] drm: fix the usage after free

[Christian König]

On 24.08.2015 05:56, Jammy Zhou wrote:
> From: Mathias Tillman <master.homer@gmail.com>
>
> For readdir_r(), the next directory entry is returned in caller-allocted
> buffer (pointered by pent here).
>
> https://bugs.freedesktop.org/show_bug.cgi?id=91704
>
> Signed-off-by: Jammy Zhou <Jammy.Zhou@amd.com>

Would be more convenient if Mathias would add his Signed-off-by as well 
and send out the patch, cause he is the original author.

Anyway the patch is clearly a nice catch and Reviewed-by: Christian 
König <christian.koenig@amd.com>

Regards,
Christian.

> ---
>   xf86drm.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/xf86drm.c b/xf86drm.c
> index 5e02969..a7cc643 100644
> --- a/xf86drm.c
> +++ b/xf86drm.c
> @@ -2803,11 +2803,12 @@ static char *drmGetMinorNameForFD(int fd, int type)
>   
>   	while (readdir_r(sysdir, pent, &ent) == 0 && ent != NULL) {
>   		if (strncmp(ent->d_name, name, len) == 0) {
> +			snprintf(dev_name, sizeof(dev_name), DRM_DIR_NAME "/%s",
> +				 ent->d_name);
> +
>   			free(pent);
>   			closedir(sysdir);
>   
> -			snprintf(dev_name, sizeof(dev_name), DRM_DIR_NAME "/%s",
> -				 ent->d_name);
>   			return strdup(dev_name);
>   		}
>   	}

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel

RE: [PATCH] drm: fix the usage after free

[Zhou, Jammy]

> Would be more convenient if Mathias would add his Signed-off-by as well and send out the patch, cause he is the original author.

Agreed. Just was not quite sure if Mathias is working on the libdrm project directly or not based on the comments in the bugzilla "hopefully the fix can be pushed to master soon".

Regards,
Jammy

-----Original Message-----
From: Christian König [mailto:deathsimple@vodafone.de] 
Sent: Monday, August 24, 2015 3:52 PM
To: Zhou, Jammy; dri-devel@lists.freedesktop.org; master.homer@gmail.com
Subject: Re: [PATCH] drm: fix the usage after free

On 24.08.2015 05:56, Jammy Zhou wrote:
> From: Mathias Tillman <master.homer@gmail.com>
>
> For readdir_r(), the next directory entry is returned in 
> caller-allocted buffer (pointered by pent here).
>
> https://bugs.freedesktop.org/show_bug.cgi?id=91704
>
> Signed-off-by: Jammy Zhou <Jammy.Zhou@amd.com>

Would be more convenient if Mathias would add his Signed-off-by as well and send out the patch, cause he is the original author.

Anyway the patch is clearly a nice catch and Reviewed-by: Christian König <christian.koenig@amd.com>

Regards,
Christian.

> ---
>   xf86drm.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/xf86drm.c b/xf86drm.c
> index 5e02969..a7cc643 100644
> --- a/xf86drm.c
> +++ b/xf86drm.c
> @@ -2803,11 +2803,12 @@ static char *drmGetMinorNameForFD(int fd, int 
> type)
>   
>   	while (readdir_r(sysdir, pent, &ent) == 0 && ent != NULL) {
>   		if (strncmp(ent->d_name, name, len) == 0) {
> +			snprintf(dev_name, sizeof(dev_name), DRM_DIR_NAME "/%s",
> +				 ent->d_name);
> +
>   			free(pent);
>   			closedir(sysdir);
>   
> -			snprintf(dev_name, sizeof(dev_name), DRM_DIR_NAME "/%s",
> -				 ent->d_name);
>   			return strdup(dev_name);
>   		}
>   	}

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH] drm: fix the usage after free

[Mathias Tillman]

[-- Attachment #1.1: Type: text/plain, Size: 2348 bytes --]

Sorry, no I am not a developer working on libdrm, this is my first
contribution to it in fact. How would I go about adding my Signed-Off?

On Mon, 24 Aug 2015 at 09:59 Zhou, Jammy <Jammy.Zhou@amd.com> wrote:

> > Would be more convenient if Mathias would add his Signed-off-by as well
> and send out the patch, cause he is the original author.
>
> Agreed. Just was not quite sure if Mathias is working on the libdrm
> project directly or not based on the comments in the bugzilla "hopefully
> the fix can be pushed to master soon".
>
> Regards,
> Jammy
>
> -----Original Message-----
> From: Christian König [mailto:deathsimple@vodafone.de]
> Sent: Monday, August 24, 2015 3:52 PM
> To: Zhou, Jammy; dri-devel@lists.freedesktop.org; master.homer@gmail.com
> Subject: Re: [PATCH] drm: fix the usage after free
>
> On 24.08.2015 05:56, Jammy Zhou wrote:
> > From: Mathias Tillman <master.homer@gmail.com>
> >
> > For readdir_r(), the next directory entry is returned in
> > caller-allocted buffer (pointered by pent here).
> >
> > https://bugs.freedesktop.org/show_bug.cgi?id=91704
> >
> > Signed-off-by: Jammy Zhou <Jammy.Zhou@amd.com>
>
> Would be more convenient if Mathias would add his Signed-off-by as well
> and send out the patch, cause he is the original author.
>
> Anyway the patch is clearly a nice catch and Reviewed-by: Christian König <
> christian.koenig@amd.com>
>
> Regards,
> Christian.
>
> > ---
> >   xf86drm.c | 5 +++--
> >   1 file changed, 3 insertions(+), 2 deletions(-)
> >
> > diff --git a/xf86drm.c b/xf86drm.c
> > index 5e02969..a7cc643 100644
> > --- a/xf86drm.c
> > +++ b/xf86drm.c
> > @@ -2803,11 +2803,12 @@ static char *drmGetMinorNameForFD(int fd, int
> > type)
> >
> >       while (readdir_r(sysdir, pent, &ent) == 0 && ent != NULL) {
> >               if (strncmp(ent->d_name, name, len) == 0) {
> > +                     snprintf(dev_name, sizeof(dev_name), DRM_DIR_NAME
> "/%s",
> > +                              ent->d_name);
> > +
> >                       free(pent);
> >                       closedir(sysdir);
> >
> > -                     snprintf(dev_name, sizeof(dev_name), DRM_DIR_NAME
> "/%s",
> > -                              ent->d_name);
> >                       return strdup(dev_name);
> >               }
> >       }
>
>

[-- Attachment #1.2: Type: text/html, Size: 3427 bytes --]

[-- Attachment #2: Type: text/plain, Size: 159 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH] drm: fix the usage after free

[Christian König]

[-- Attachment #1.1: Type: text/plain, Size: 3509 bytes --]

Hi Mathias,

thanks for the good help and no problem with the Signed-off-by line. If 
you don't object we will just add a "Signed-off-by: Mathias Tillman 
<master.homer@gmail.com>" line when we push this patch to the repository.

It's just for tracking who created which code and who might know why 
something is implemented as it is, but since it's rather obvious what's 
wrong here there probably won't be any more questions about his.

I honestly don't remember if I have commit access to libdrm myself, but 
going to check. If not Alex or somebody else need to commit this.

Regards,
Christian.

On 24.08.2015 10:03, Mathias Tillman wrote:
> Sorry, no I am not a developer working on libdrm, this is my first 
> contribution to it in fact. How would I go about adding my Signed-Off?
>
> On Mon, 24 Aug 2015 at 09:59 Zhou, Jammy <Jammy.Zhou@amd.com 
> <mailto:Jammy.Zhou@amd.com>> wrote:
>
>     > Would be more convenient if Mathias would add his Signed-off-by
>     as well and send out the patch, cause he is the original author.
>
>     Agreed. Just was not quite sure if Mathias is working on the
>     libdrm project directly or not based on the comments in the
>     bugzilla "hopefully the fix can be pushed to master soon".
>
>     Regards,
>     Jammy
>
>     -----Original Message-----
>     From: Christian König [mailto:deathsimple@vodafone.de
>     <mailto:deathsimple@vodafone.de>]
>     Sent: Monday, August 24, 2015 3:52 PM
>     To: Zhou, Jammy; dri-devel@lists.freedesktop.org
>     <mailto:dri-devel@lists.freedesktop.org>; master.homer@gmail.com
>     <mailto:master.homer@gmail.com>
>     Subject: Re: [PATCH] drm: fix the usage after free
>
>     On 24.08.2015 05:56, Jammy Zhou wrote:
>     > From: Mathias Tillman <master.homer@gmail.com
>     <mailto:master.homer@gmail.com>>
>     >
>     > For readdir_r(), the next directory entry is returned in
>     > caller-allocted buffer (pointered by pent here).
>     >
>     > https://bugs.freedesktop.org/show_bug.cgi?id=91704
>     >
>     > Signed-off-by: Jammy Zhou <Jammy.Zhou@amd.com
>     <mailto:Jammy.Zhou@amd.com>>
>
>     Would be more convenient if Mathias would add his Signed-off-by as
>     well and send out the patch, cause he is the original author.
>
>     Anyway the patch is clearly a nice catch and Reviewed-by:
>     Christian König <christian.koenig@amd.com
>     <mailto:christian.koenig@amd.com>>
>
>     Regards,
>     Christian.
>
>     > ---
>     >   xf86drm.c | 5 +++--
>     >   1 file changed, 3 insertions(+), 2 deletions(-)
>     >
>     > diff --git a/xf86drm.c b/xf86drm.c
>     > index 5e02969..a7cc643 100644
>     > --- a/xf86drm.c
>     > +++ b/xf86drm.c
>     > @@ -2803,11 +2803,12 @@ static char *drmGetMinorNameForFD(int
>     fd, int
>     > type)
>     >
>     >       while (readdir_r(sysdir, pent, &ent) == 0 && ent != NULL) {
>     >               if (strncmp(ent->d_name, name, len) == 0) {
>     > +                     snprintf(dev_name, sizeof(dev_name),
>     DRM_DIR_NAME "/%s",
>     > +                              ent->d_name);
>     > +
>     >                       free(pent);
>     >                       closedir(sysdir);
>     >
>     > -                     snprintf(dev_name, sizeof(dev_name),
>     DRM_DIR_NAME "/%s",
>     > -                              ent->d_name);
>     >                       return strdup(dev_name);
>     >               }
>     >       }
>


[-- Attachment #1.2: Type: text/html, Size: 5760 bytes --]

[-- Attachment #2: Type: text/plain, Size: 159 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH] drm: fix the usage after free

[Mathias Tillman]

[-- Attachment #1.1: Type: text/plain, Size: 3264 bytes --]

Okay, that won't be a problem at all.

On Mon, 24 Aug 2015 at 10:20 Christian König <deathsimple@vodafone.de>
wrote:

> Hi Mathias,
>
> thanks for the good help and no problem with the Signed-off-by line. If
> you don't object we will just add a "Signed-off-by: Mathias Tillman
> <master.homer@gmail.com> <master.homer@gmail.com>" line when we push this
> patch to the repository.
>
> It's just for tracking who created which code and who might know why
> something is implemented as it is, but since it's rather obvious what's
> wrong here there probably won't be any more questions about his.
>
> I honestly don't remember if I have commit access to libdrm myself, but
> going to check. If not Alex or somebody else need to commit this.
>
> Regards,
> Christian.
>
>
> On 24.08.2015 10:03, Mathias Tillman wrote:
>
> Sorry, no I am not a developer working on libdrm, this is my first
> contribution to it in fact. How would I go about adding my Signed-Off?
>
> On Mon, 24 Aug 2015 at 09:59 Zhou, Jammy <Jammy.Zhou@amd.com> wrote:
>
>> > Would be more convenient if Mathias would add his Signed-off-by as well
>> and send out the patch, cause he is the original author.
>>
>> Agreed. Just was not quite sure if Mathias is working on the libdrm
>> project directly or not based on the comments in the bugzilla "hopefully
>> the fix can be pushed to master soon".
>>
>> Regards,
>> Jammy
>>
>> -----Original Message-----
>> From: Christian König [mailto:deathsimple@vodafone.de]
>> Sent: Monday, August 24, 2015 3:52 PM
>> To: Zhou, Jammy; dri-devel@lists.freedesktop.org; master.homer@gmail.com
>> Subject: Re: [PATCH] drm: fix the usage after free
>>
>> On 24.08.2015 05:56, Jammy Zhou wrote:
>> > From: Mathias Tillman <master.homer@gmail.com>
>> >
>> > For readdir_r(), the next directory entry is returned in
>> > caller-allocted buffer (pointered by pent here).
>> >
>> > https://bugs.freedesktop.org/show_bug.cgi?id=91704
>> >
>> > Signed-off-by: Jammy Zhou <Jammy.Zhou@amd.com>
>>
>> Would be more convenient if Mathias would add his Signed-off-by as well
>> and send out the patch, cause he is the original author.
>>
>> Anyway the patch is clearly a nice catch and Reviewed-by: Christian König
>> <christian.koenig@amd.com>
>>
>> Regards,
>> Christian.
>>
>> > ---
>> >   xf86drm.c | 5 +++--
>> >   1 file changed, 3 insertions(+), 2 deletions(-)
>> >
>> > diff --git a/xf86drm.c b/xf86drm.c
>> > index 5e02969..a7cc643 100644
>> > --- a/xf86drm.c
>> > +++ b/xf86drm.c
>> > @@ -2803,11 +2803,12 @@ static char *drmGetMinorNameForFD(int fd, int
>> > type)
>> >
>> >       while (readdir_r(sysdir, pent, &ent) == 0 && ent != NULL) {
>> >               if (strncmp(ent->d_name, name, len) == 0) {
>> > +                     snprintf(dev_name, sizeof(dev_name), DRM_DIR_NAME
>> "/%s",
>> > +                              ent->d_name);
>> > +
>> >                       free(pent);
>> >                       closedir(sysdir);
>> >
>> > -                     snprintf(dev_name, sizeof(dev_name), DRM_DIR_NAME
>> "/%s",
>> > -                              ent->d_name);
>> >                       return strdup(dev_name);
>> >               }
>> >       }
>>
>>
>

[-- Attachment #1.2: Type: text/html, Size: 5748 bytes --]

[-- Attachment #2: Type: text/plain, Size: 159 bytes --]

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: [PATCH] drm: fix the usage after free

[Emil Velikov]

Hi guys,

On 24 August 2015 at 09:20, Christian König <deathsimple@vodafone.de> wrote:
> Hi Mathias,
>
> thanks for the good help and no problem with the Signed-off-by line. If you
> don't object we will just add a "Signed-off-by: Mathias Tillman
> <master.homer@gmail.com>" line when we push this patch to the repository.
>
> It's just for tracking who created which code and who might know why
> something is implemented as it is, but since it's rather obvious what's
> wrong here there probably won't be any more questions about his.
>
> I honestly don't remember if I have commit access to libdrm myself, but
> going to check. If not Alex or somebody else need to commit this.
>
Seems like you do :)

> Regards,
> Christian.
>
> On 24.08.2015 10:03, Mathias Tillman wrote:
>
> Sorry, no I am not a developer working on libdrm, this is my first
> contribution to it in fact. How would I go about adding my Signed-Off?
>
Mathias, you can pass "-s" to git commit which will add the tag for
you. Here [1] can check what signed-off-by stands for.

If you have other patches in the future feel free to send them
directly to the mailing list.

Thanks for fixing my goof-up :)
Emil

[1] https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/tree/Documentation/SubmittingPatches#n409
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/dri-devel