| From 8490d6a7e0a0a6fab5c2d82d57a3937306660864 Mon Sep 17 00:00:00 2001 |
| From: Steve Cohen <cohens@codeaurora.org> |
| Date: Mon, 20 Jul 2020 18:30:50 -0400 |
| Subject: drm: hold gem reference until object is no longer accessed |
| |
| From: Steve Cohen <cohens@codeaurora.org> |
| |
| commit 8490d6a7e0a0a6fab5c2d82d57a3937306660864 upstream. |
| |
| A use-after-free in drm_gem_open_ioctl can happen if the |
| GEM object handle is closed between the idr lookup and |
| retrieving the size from said object since a local reference |
| is not being held at that point. Hold the local reference |
| while the object can still be accessed to fix this and |
| plug the potential security hole. |
| |
| Signed-off-by: Steve Cohen <cohens@codeaurora.org> |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> |
| Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/gpu/drm/drm_gem.c | 10 ++++------ |
| 1 file changed, 4 insertions(+), 6 deletions(-) |
| |
| --- a/drivers/gpu/drm/drm_gem.c |
| +++ b/drivers/gpu/drm/drm_gem.c |
| @@ -652,9 +652,6 @@ err: |
| * @file_priv: drm file-private structure |
| * |
| * Open an object using the global name, returning a handle and the size. |
| - * |
| - * This handle (of course) holds a reference to the object, so the object |
| - * will not go away until the handle is deleted. |
| */ |
| int |
| drm_gem_open_ioctl(struct drm_device *dev, void *data, |
| @@ -679,14 +676,15 @@ drm_gem_open_ioctl(struct drm_device *de |
| |
| /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ |
| ret = drm_gem_handle_create_tail(file_priv, obj, &handle); |
| - drm_gem_object_unreference_unlocked(obj); |
| if (ret) |
| - return ret; |
| + goto err; |
| |
| args->handle = handle; |
| args->size = obj->size; |
| |
| - return 0; |
| +err: |
| + drm_gem_object_unreference_unlocked(obj); |
| + return ret; |
| } |
| |
| /** |