lkml.org 
[lkml]   [2020]   [Feb]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.5 40/80] drm/vgem: Close use-after-free race in vgem_gem_create
    Date
    From: Daniel Vetter <daniel.vetter@ffwll.ch>

    commit 4b848f20eda5974020f043ca14bacf7a7e634fc8 upstream.

    There's two references floating around here (for the object reference,
    not the handle_count reference, that's a different thing):

    - The temporary reference held by vgem_gem_create, acquired by
    creating the object and released by calling
    drm_gem_object_put_unlocked.

    - The reference held by the object handle, created by
    drm_gem_handle_create. This one generally outlives the function,
    except if a 2nd thread races with a GEM_CLOSE ioctl call.

    So usually everything is correct, except in that race case, where the
    access to gem_object->size could be looking at freed data already.
    Which again isn't a real problem (userspace shot its feet off already
    with the race, we could return garbage), but maybe someone can exploit
    this as an information leak.

    Cc: Dan Carpenter <dan.carpenter@oracle.com>
    Cc: Hillf Danton <hdanton@sina.com>
    Reported-by: syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com
    Cc: stable@vger.kernel.org
    Cc: Emil Velikov <emil.velikov@collabora.com>
    Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
    Cc: Sean Paul <seanpaul@chromium.org>
    Cc: Chris Wilson <chris@chris-wilson.co.uk>
    Cc: Eric Anholt <eric@anholt.net>
    Cc: Sam Ravnborg <sam@ravnborg.org>
    Cc: Rob Clark <robdclark@chromium.org>
    Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
    Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20200202132133.1891846-1-daniel.vetter@ffwll.ch
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/gpu/drm/vgem/vgem_drv.c | 9 ++++++---
    1 file changed, 6 insertions(+), 3 deletions(-)

    --- a/drivers/gpu/drm/vgem/vgem_drv.c
    +++ b/drivers/gpu/drm/vgem/vgem_drv.c
    @@ -196,9 +196,10 @@ static struct drm_gem_object *vgem_gem_c
    return ERR_CAST(obj);

    ret = drm_gem_handle_create(file, &obj->base, handle);
    - drm_gem_object_put_unlocked(&obj->base);
    - if (ret)
    + if (ret) {
    + drm_gem_object_put_unlocked(&obj->base);
    return ERR_PTR(ret);
    + }

    return &obj->base;
    }
    @@ -221,7 +222,9 @@ static int vgem_gem_dumb_create(struct d
    args->size = gem_object->size;
    args->pitch = pitch;

    - DRM_DEBUG("Created object of size %lld\n", size);
    + drm_gem_object_put_unlocked(gem_object);
    +
    + DRM_DEBUG("Created object of size %llu\n", args->size);

    return 0;
    }

    \
     
     \ /
      Last update: 2020-02-18 21:05    [W:4.168 / U:0.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site