From patchwork Sun Feb 2 13:21:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Vetter X-Patchwork-Id: 11361603 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id D07241395 for ; Sun, 2 Feb 2020 13:21:45 +0000 (UTC) Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id AE3FB2067C for ; Sun, 2 Feb 2020 13:21:45 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=ffwll.ch header.i=@ffwll.ch header.b="TEmmVDj0" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org AE3FB2067C Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=ffwll.ch Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=dri-devel-bounces@lists.freedesktop.org Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 3E5FF6E05D; Sun, 2 Feb 2020 13:21:41 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mail-wr1-x442.google.com (mail-wr1-x442.google.com [IPv6:2a00:1450:4864:20::442]) by gabe.freedesktop.org (Postfix) with ESMTPS id 754856E04B for ; Sun, 2 Feb 2020 13:21:40 +0000 (UTC) Received: by mail-wr1-x442.google.com with SMTP id w12so3591855wrt.2 for ; Sun, 02 Feb 2020 05:21:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ffwll.ch; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=cHVArCA0NkObFToWw2KI8ZjIcDBFbLQ6CdfkkiPE81Q=; b=TEmmVDj0++o7kGG6MrcVufIc0rC2Ax9HAq77FmojxCjZjUSr5dqABRzdgmF8NGVnHu js8FDD/Qp4TZdq1MNW36F0UpJQl6GLudC3zw+UVQ1VuV17JsX3oWa1ozfFlo8pOyQGFg 8KHsNNsXC6AxkKPkwLq0kkIuN1xrz3F5pttoE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=cHVArCA0NkObFToWw2KI8ZjIcDBFbLQ6CdfkkiPE81Q=; b=UzMo1y4UGqN/5zJZqT/bVWtxJgB7/VVIYL1eYUOgogeRv93z0aVdk81coHchT0DvL1 xfIAaa/wjNbSwEbiw/QX2WlPy3TBaXnIFlaOkM4NGRpzvZbaxoGSaxDMqd3+fZDwMj93 V3qEhH/YCsmCZrxvvTbhXYoVfVNDMP2omk6ISiBWEsYXEmicmxRHcZigxCvNkGGoFSmE Cur/xY1jrtAzROLoWc2M9/UMewpMffDo+Y4Plb6gn07D/+6MK1UNf2xFjuGpO1sASC/v KTntnMQxngIV5PwIeNCUuIYj+Fk2fjvUVounjZzWjf54a1OE4tr8honFdIohCVFdM7lr GUjw== X-Gm-Message-State: APjAAAXz4XO1W08jbJD5+xysuydDyAJMxZDb06MvDQrryMvZ9JmhW+/G +RPHaI7WCP+hHFfLjm2hljQe6bvKFtCQiw== X-Google-Smtp-Source: APXvYqzLITzGUKwVkpTTZzU1yF022BgipZxUFF6BYrWBoVFzhnOw14rw22j/lRkTRORr3x8FXrIIag== X-Received: by 2002:a5d:4052:: with SMTP id w18mr4250553wrp.112.1580649698793; Sun, 02 Feb 2020 05:21:38 -0800 (PST) Received: from phenom.ffwll.local ([2a02:168:57f4:0:efd0:b9e5:5ae6:c2fa]) by smtp.gmail.com with ESMTPSA id b18sm20994530wru.50.2020.02.02.05.21.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 02 Feb 2020 05:21:38 -0800 (PST) From: Daniel Vetter To: DRI Development Subject: [PATCH] drm/vgem: Close use-after-free race in vgem_gem_create Date: Sun, 2 Feb 2020 14:21:33 +0100 Message-Id: <20200202132133.1891846-1-daniel.vetter@ffwll.ch> X-Mailer: git-send-email 2.24.1 MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Rob Clark , Hillf Danton , Daniel Vetter , Intel Graphics Development , stable@vger.kernel.org, Sean Paul , Daniel Vetter , Sam Ravnborg , Dan Carpenter , Emil Velikov Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" There's two references floating around here (for the object reference, not the handle_count reference, that's a different thing): - The temporary reference held by vgem_gem_create, acquired by creating the object and released by calling drm_gem_object_put_unlocked. - The reference held by the object handle, created by drm_gem_handle_create. This one generally outlives the function, except if a 2nd thread races with a GEM_CLOSE ioctl call. So usually everything is correct, except in that race case, where the access to gem_object->size could be looking at freed data already. Which again isn't a real problem (userspace shot its feet off already with the race, we could return garbage), but maybe someone can exploit this as an information leak. Cc: Dan Carpenter Cc: Hillf Danton Cc: Reported-by: syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Cc: Emil Velikov Cc: Daniel Vetter Cc: Sean Paul Cc: Chris Wilson Cc: Eric Anholt Cc: Sam Ravnborg Cc: Rob Clark Signed-off-by: Daniel Vetter Reviewed-by: Chris Wilson --- drivers/gpu/drm/vgem/vgem_drv.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c index 5bd60ded3d81..909eba43664a 100644 --- a/drivers/gpu/drm/vgem/vgem_drv.c +++ b/drivers/gpu/drm/vgem/vgem_drv.c @@ -196,9 +196,10 @@ static struct drm_gem_object *vgem_gem_create(struct drm_device *dev, return ERR_CAST(obj); ret = drm_gem_handle_create(file, &obj->base, handle); - drm_gem_object_put_unlocked(&obj->base); - if (ret) + if (ret) { + drm_gem_object_put_unlocked(&obj->base); return ERR_PTR(ret); + } return &obj->base; } @@ -221,7 +222,9 @@ static int vgem_gem_dumb_create(struct drm_file *file, struct drm_device *dev, args->size = gem_object->size; args->pitch = pitch; - DRM_DEBUG("Created object of size %lld\n", size); + drm_gem_object_put_unlocked(gem_object); + + DRM_DEBUG("Created object of size %llu\n", args->size); return 0; }