| Message ID | 20230108211311.3950107-1-dmitry.osipenko@collabora.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v1] drm/shmem-helper: Remove another errant put in error path | expand |
On 1/9/23 00:13, Dmitry Osipenko wrote: > drm_gem_shmem_mmap() doesn't own reference in error code path, resulting > in the dma-buf shmem GEM object getting prematurely freed leading to a > later use-after-free. > > Fixes: f49a51bfdc8e ("drm/shme-helpers: Fix dma_buf_mmap forwarding bug") > Cc: stable@vger.kernel.org > Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> > --- > drivers/gpu/drm/drm_gem_shmem_helper.c | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c > index f21f47737817..8b20b41497e8 100644 > --- a/drivers/gpu/drm/drm_gem_shmem_helper.c > +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c > @@ -624,11 +624,14 @@ int drm_gem_shmem_mmap(struct drm_gem_shmem_object *shmem, struct vm_area_struct > int ret; > > if (obj->import_attach) { > - /* Drop the reference drm_gem_mmap_obj() acquired.*/ > - drm_gem_object_put(obj); > vma->vm_private_data = NULL; > + ret = dma_buf_mmap(obj->dma_buf, vma, 0); > + > + /* Drop the reference drm_gem_mmap_obj() acquired.*/ > + if (!ret) > + drm_gem_object_put(obj); > > - return dma_buf_mmap(obj->dma_buf, vma, 0); > + return ret; > } > > ret = drm_gem_shmem_get_pages(shmem); Rob, is this change still looking good to you? r-b? Thanks!
On Sun, Jan 8, 2023 at 1:13 PM Dmitry Osipenko <dmitry.osipenko@collabora.com> wrote: > > drm_gem_shmem_mmap() doesn't own reference in error code path, resulting > in the dma-buf shmem GEM object getting prematurely freed leading to a > later use-after-free. > > Fixes: f49a51bfdc8e ("drm/shme-helpers: Fix dma_buf_mmap forwarding bug") > Cc: stable@vger.kernel.org > Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> Reviewed-by: Rob Clark <robdclark@gmail.com> > --- > drivers/gpu/drm/drm_gem_shmem_helper.c | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c > index f21f47737817..8b20b41497e8 100644 > --- a/drivers/gpu/drm/drm_gem_shmem_helper.c > +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c > @@ -624,11 +624,14 @@ int drm_gem_shmem_mmap(struct drm_gem_shmem_object *shmem, struct vm_area_struct > int ret; > > if (obj->import_attach) { > - /* Drop the reference drm_gem_mmap_obj() acquired.*/ > - drm_gem_object_put(obj); > vma->vm_private_data = NULL; > + ret = dma_buf_mmap(obj->dma_buf, vma, 0); > + > + /* Drop the reference drm_gem_mmap_obj() acquired.*/ > + if (!ret) > + drm_gem_object_put(obj); > > - return dma_buf_mmap(obj->dma_buf, vma, 0); > + return ret; > } > > ret = drm_gem_shmem_get_pages(shmem); > -- > 2.38.1 >
On 2/16/23 18:35, Rob Clark wrote: > On Sun, Jan 8, 2023 at 1:13 PM Dmitry Osipenko > <dmitry.osipenko@collabora.com> wrote: >> >> drm_gem_shmem_mmap() doesn't own reference in error code path, resulting >> in the dma-buf shmem GEM object getting prematurely freed leading to a >> later use-after-free. >> >> Fixes: f49a51bfdc8e ("drm/shme-helpers: Fix dma_buf_mmap forwarding bug") >> Cc: stable@vger.kernel.org >> Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> > > Reviewed-by: Rob Clark <robdclark@gmail.com> Applied to misc-fixes
diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c index f21f47737817..8b20b41497e8 100644 --- a/drivers/gpu/drm/drm_gem_shmem_helper.c +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c @@ -624,11 +624,14 @@ int drm_gem_shmem_mmap(struct drm_gem_shmem_object *shmem, struct vm_area_struct int ret; if (obj->import_attach) { - /* Drop the reference drm_gem_mmap_obj() acquired.*/ - drm_gem_object_put(obj); vma->vm_private_data = NULL; + ret = dma_buf_mmap(obj->dma_buf, vma, 0); + + /* Drop the reference drm_gem_mmap_obj() acquired.*/ + if (!ret) + drm_gem_object_put(obj); - return dma_buf_mmap(obj->dma_buf, vma, 0); + return ret; } ret = drm_gem_shmem_get_pages(shmem);
drm_gem_shmem_mmap() doesn't own reference in error code path, resulting in the dma-buf shmem GEM object getting prematurely freed leading to a later use-after-free. Fixes: f49a51bfdc8e ("drm/shme-helpers: Fix dma_buf_mmap forwarding bug") Cc: stable@vger.kernel.org Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com> --- drivers/gpu/drm/drm_gem_shmem_helper.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)