| Message ID | 1595284250-31580-1-git-send-email-cohens@codeaurora.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 8490d6a7e0a0a6fab5c2d82d57a3937306660864 |
| Headers | show |
| Series | [V2] drm: hold gem reference until object is no longer accessed | expand |
On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote: > A use-after-free in drm_gem_open_ioctl can happen if the > GEM object handle is closed between the idr lookup and > retrieving the size from said object since a local reference > is not being held at that point. Hold the local reference > while the object can still be accessed to fix this and > plug the potential security hole. > > Signed-off-by: Steve Cohen <cohens@codeaurora.org> > --- > drivers/gpu/drm/drm_gem.c | 10 ++++------ > 1 file changed, 4 insertions(+), 6 deletions(-) > > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c > index 7bf628e..ee2058a 100644 > --- a/drivers/gpu/drm/drm_gem.c > +++ b/drivers/gpu/drm/drm_gem.c > @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data, > * @file_priv: drm file-private structure > * > * Open an object using the global name, returning a handle and the size. > - * > - * This handle (of course) holds a reference to the object, so the object > - * will not go away until the handle is deleted. > */ > int > drm_gem_open_ioctl(struct drm_device *dev, void *data, > @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data, > > /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ > ret = drm_gem_handle_create_tail(file_priv, obj, &handle); > - drm_gem_object_put_unlocked(obj); > if (ret) > - return ret; > + goto err; > > args->handle = handle; > args->size = obj->size; > > - return 0; > +err: > + drm_gem_object_put_unlocked(obj); > + return ret; > } > > /** As this seems to fix an important issue, any reason it wasn't cc: stable on it so that it gets backported properly? How about a "Fixes:" tag so that we know what commit id it fixes so we know how far back to backport things? And a hint to the maintainers that "this is an issue that needs to get into 5.8-final, it shouldn't wait around longer please" would have also been nice to see :) And what chagned from v1, aren't you supposed to list that somewhere in the changelog or below the --- line (never remember what DRM drivers want here...) Care to send a v3? thanks, greg k-h
On Mon, Jul 27, 2020 at 09:55:07PM +0200, Greg KH wrote: > On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote: > > A use-after-free in drm_gem_open_ioctl can happen if the > > GEM object handle is closed between the idr lookup and > > retrieving the size from said object since a local reference > > is not being held at that point. Hold the local reference > > while the object can still be accessed to fix this and > > plug the potential security hole. > > > > Signed-off-by: Steve Cohen <cohens@codeaurora.org> > > --- > > drivers/gpu/drm/drm_gem.c | 10 ++++------ > > 1 file changed, 4 insertions(+), 6 deletions(-) > > > > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c > > index 7bf628e..ee2058a 100644 > > --- a/drivers/gpu/drm/drm_gem.c > > +++ b/drivers/gpu/drm/drm_gem.c > > @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data, > > * @file_priv: drm file-private structure > > * > > * Open an object using the global name, returning a handle and the size. > > - * > > - * This handle (of course) holds a reference to the object, so the object > > - * will not go away until the handle is deleted. > > */ > > int > > drm_gem_open_ioctl(struct drm_device *dev, void *data, > > @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data, > > > > /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ > > ret = drm_gem_handle_create_tail(file_priv, obj, &handle); > > - drm_gem_object_put_unlocked(obj); > > if (ret) > > - return ret; > > + goto err; > > > > args->handle = handle; > > args->size = obj->size; > > > > - return 0; > > +err: > > + drm_gem_object_put_unlocked(obj); > > + return ret; > > } > > > > /** > > As this seems to fix an important issue, any reason it wasn't cc: stable > on it so that it gets backported properly? > > How about a "Fixes:" tag so that we know what commit id it fixes so we > know how far back to backport things? > > And a hint to the maintainers that "this is an issue that needs to get > into 5.8-final, it shouldn't wait around longer please" would have also > been nice to see :) > > And what chagned from v1, aren't you supposed to list that somewhere in > the changelog or below the --- line (never remember what DRM drivers > want here...) > > Care to send a v3? Don't worry, I'm pushing this to drm-misc-fixes now, should still make it to 5.8. Plus cc: stable. I didn't bother with Fixes: since I think the bug is rather old. Also, worst case you leak 32bit of some kernel memory that got reused already (but yeah I know that's often enough to get the foot in somewhere nasty and crack the door open). I think it fell through cracks because Sam said he'll apply, guess that didn't happen. Also yes a changelog, somewhere, for next time around. -Daniel > > thanks, > > greg k-h
On 2020-07-27 16:11, daniel@ffwll.ch wrote: > On Mon, Jul 27, 2020 at 09:55:07PM +0200, Greg KH wrote: >> On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote: >> > A use-after-free in drm_gem_open_ioctl can happen if the >> > GEM object handle is closed between the idr lookup and >> > retrieving the size from said object since a local reference >> > is not being held at that point. Hold the local reference >> > while the object can still be accessed to fix this and >> > plug the potential security hole. >> > >> > Signed-off-by: Steve Cohen <cohens@codeaurora.org> >> > --- >> > drivers/gpu/drm/drm_gem.c | 10 ++++------ >> > 1 file changed, 4 insertions(+), 6 deletions(-) >> > >> > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c >> > index 7bf628e..ee2058a 100644 >> > --- a/drivers/gpu/drm/drm_gem.c >> > +++ b/drivers/gpu/drm/drm_gem.c >> > @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data, >> > * @file_priv: drm file-private structure >> > * >> > * Open an object using the global name, returning a handle and the size. >> > - * >> > - * This handle (of course) holds a reference to the object, so the object >> > - * will not go away until the handle is deleted. >> > */ >> > int >> > drm_gem_open_ioctl(struct drm_device *dev, void *data, >> > @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data, >> > >> > /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ >> > ret = drm_gem_handle_create_tail(file_priv, obj, &handle); >> > - drm_gem_object_put_unlocked(obj); >> > if (ret) >> > - return ret; >> > + goto err; >> > >> > args->handle = handle; >> > args->size = obj->size; >> > >> > - return 0; >> > +err: >> > + drm_gem_object_put_unlocked(obj); >> > + return ret; >> > } >> > >> > /** >> >> As this seems to fix an important issue, any reason it wasn't cc: >> stable >> on it so that it gets backported properly? >> >> How about a "Fixes:" tag so that we know what commit id it fixes so we >> know how far back to backport things? >> >> And a hint to the maintainers that "this is an issue that needs to get >> into 5.8-final, it shouldn't wait around longer please" would have >> also >> been nice to see :) >> >> And what chagned from v1, aren't you supposed to list that somewhere >> in >> the changelog or below the --- line (never remember what DRM drivers >> want here...) >> >> Care to send a v3? > > Don't worry, I'm pushing this to drm-misc-fixes now, should still make > it > to 5.8. Plus cc: stable. I didn't bother with Fixes: since I think the > bug > is rather old. Also, worst case you leak 32bit of some kernel memory > that > got reused already (but yeah I know that's often enough to get the foot > in > somewhere nasty and crack the door open). > > I think it fell through cracks because Sam said he'll apply, guess that > didn't happen. Sam added his Reviewed-By on V1 with a comment to rename the goto label, but in V2 I also updated the API documentation and the commit text for a more complete change and thought he would re-add the tag. > Also yes a changelog, somewhere, for next time around. Apologies, it won't happen again. Should I still submit a V3? It looks like you've got Greg's concerns covered. -Steve > -Daniel > > >> >> thanks, >> >> greg k-h
On Mon, Jul 27, 2020 at 05:54:59PM -0400, cohens@codeaurora.org wrote: > On 2020-07-27 16:11, daniel@ffwll.ch wrote: > > On Mon, Jul 27, 2020 at 09:55:07PM +0200, Greg KH wrote: > > > On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote: > > > > A use-after-free in drm_gem_open_ioctl can happen if the > > > > GEM object handle is closed between the idr lookup and > > > > retrieving the size from said object since a local reference > > > > is not being held at that point. Hold the local reference > > > > while the object can still be accessed to fix this and > > > > plug the potential security hole. > > > > > > > > Signed-off-by: Steve Cohen <cohens@codeaurora.org> > > > > --- > > > > drivers/gpu/drm/drm_gem.c | 10 ++++------ > > > > 1 file changed, 4 insertions(+), 6 deletions(-) > > > > > > > > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c > > > > index 7bf628e..ee2058a 100644 > > > > --- a/drivers/gpu/drm/drm_gem.c > > > > +++ b/drivers/gpu/drm/drm_gem.c > > > > @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data, > > > > * @file_priv: drm file-private structure > > > > * > > > > * Open an object using the global name, returning a handle and the size. > > > > - * > > > > - * This handle (of course) holds a reference to the object, so the object > > > > - * will not go away until the handle is deleted. > > > > */ > > > > int > > > > drm_gem_open_ioctl(struct drm_device *dev, void *data, > > > > @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data, > > > > > > > > /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ > > > > ret = drm_gem_handle_create_tail(file_priv, obj, &handle); > > > > - drm_gem_object_put_unlocked(obj); > > > > if (ret) > > > > - return ret; > > > > + goto err; > > > > > > > > args->handle = handle; > > > > args->size = obj->size; > > > > > > > > - return 0; > > > > +err: > > > > + drm_gem_object_put_unlocked(obj); > > > > + return ret; > > > > } > > > > > > > > /** > > > > > > As this seems to fix an important issue, any reason it wasn't cc: > > > stable > > > on it so that it gets backported properly? > > > > > > How about a "Fixes:" tag so that we know what commit id it fixes so we > > > know how far back to backport things? > > > > > > And a hint to the maintainers that "this is an issue that needs to get > > > into 5.8-final, it shouldn't wait around longer please" would have > > > also > > > been nice to see :) > > > > > > And what chagned from v1, aren't you supposed to list that somewhere > > > in > > > the changelog or below the --- line (never remember what DRM drivers > > > want here...) > > > > > > Care to send a v3? > > > > Don't worry, I'm pushing this to drm-misc-fixes now, should still make > > it > > to 5.8. Plus cc: stable. I didn't bother with Fixes: since I think the > > bug > > is rather old. Also, worst case you leak 32bit of some kernel memory > > that > > got reused already (but yeah I know that's often enough to get the foot > > in > > somewhere nasty and crack the door open). > > > > I think it fell through cracks because Sam said he'll apply, guess that > > didn't happen. > > Sam added his Reviewed-By on V1 with a comment to rename the goto label, > but in V2 I also updated the API documentation and the commit text for > a more complete change and thought he would re-add the tag. > > > Also yes a changelog, somewhere, for next time around. > > Apologies, it won't happen again. Should I still submit a V3? > It looks like you've got Greg's concerns covered. Uh no, but we need another patch to re-add the kerneldoc you deleted. I missed that when merging your patch. Also that's kinda what patch changelogs are for, for blind reviewers like me :-) -Daniel > > -Steve > > > -Daniel > > > > > > > > > > thanks, > > > > > > greg k-h
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 7bf628e..ee2058a 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data, * @file_priv: drm file-private structure * * Open an object using the global name, returning a handle and the size. - * - * This handle (of course) holds a reference to the object, so the object - * will not go away until the handle is deleted. */ int drm_gem_open_ioctl(struct drm_device *dev, void *data, @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data, /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ ret = drm_gem_handle_create_tail(file_priv, obj, &handle); - drm_gem_object_put_unlocked(obj); if (ret) - return ret; + goto err; args->handle = handle; args->size = obj->size; - return 0; +err: + drm_gem_object_put_unlocked(obj); + return ret; } /**
A use-after-free in drm_gem_open_ioctl can happen if the GEM object handle is closed between the idr lookup and retrieving the size from said object since a local reference is not being held at that point. Hold the local reference while the object can still be accessed to fix this and plug the potential security hole. Signed-off-by: Steve Cohen <cohens@codeaurora.org> --- drivers/gpu/drm/drm_gem.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)