| From d642931256ce424258f04e4f5f32cddafad65447 Mon Sep 17 00:00:00 2001 |
| From: Daniel Vetter <daniel.vetter@ffwll.ch> |
| Date: Sun, 2 Feb 2020 14:21:33 +0100 |
| Subject: [PATCH] drm/vgem: Close use-after-free race in vgem_gem_create |
| |
| commit 4b848f20eda5974020f043ca14bacf7a7e634fc8 upstream. |
| |
| There's two references floating around here (for the object reference, |
| not the handle_count reference, that's a different thing): |
| |
| - The temporary reference held by vgem_gem_create, acquired by |
| creating the object and released by calling |
| drm_gem_object_put_unlocked. |
| |
| - The reference held by the object handle, created by |
| drm_gem_handle_create. This one generally outlives the function, |
| except if a 2nd thread races with a GEM_CLOSE ioctl call. |
| |
| So usually everything is correct, except in that race case, where the |
| access to gem_object->size could be looking at freed data already. |
| Which again isn't a real problem (userspace shot its feet off already |
| with the race, we could return garbage), but maybe someone can exploit |
| this as an information leak. |
| |
| Cc: Dan Carpenter <dan.carpenter@oracle.com> |
| Cc: Hillf Danton <hdanton@sina.com> |
| Reported-by: syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com |
| Cc: stable@vger.kernel.org |
| Cc: Emil Velikov <emil.velikov@collabora.com> |
| Cc: Daniel Vetter <daniel.vetter@ffwll.ch> |
| Cc: Sean Paul <seanpaul@chromium.org> |
| Cc: Chris Wilson <chris@chris-wilson.co.uk> |
| Cc: Eric Anholt <eric@anholt.net> |
| Cc: Sam Ravnborg <sam@ravnborg.org> |
| Cc: Rob Clark <robdclark@chromium.org> |
| Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk> |
| Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> |
| Link: https://patchwork.freedesktop.org/patch/msgid/20200202132133.1891846-1-daniel.vetter@ffwll.ch |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c |
| index 11a8f99ba18c..19d9ac82b62a 100644 |
| --- a/drivers/gpu/drm/vgem/vgem_drv.c |
| +++ b/drivers/gpu/drm/vgem/vgem_drv.c |
| @@ -189,9 +189,10 @@ static struct drm_gem_object *vgem_gem_create(struct drm_device *dev, |
| return ERR_CAST(obj); |
| |
| ret = drm_gem_handle_create(file, &obj->base, handle); |
| - drm_gem_object_put_unlocked(&obj->base); |
| - if (ret) |
| + if (ret) { |
| + drm_gem_object_put_unlocked(&obj->base); |
| return ERR_PTR(ret); |
| + } |
| |
| return &obj->base; |
| } |
| @@ -214,7 +215,9 @@ static int vgem_gem_dumb_create(struct drm_file *file, struct drm_device *dev, |
| args->size = gem_object->size; |
| args->pitch = pitch; |
| |
| - DRM_DEBUG_DRIVER("Created object of size %lld\n", size); |
| + drm_gem_object_put_unlocked(gem_object); |
| + |
| + DRM_DEBUG_DRIVER("Created object of size %llu\n", args->size); |
| |
| return 0; |
| } |
| -- |
| 2.7.4 |
| |