| Message ID | 20230603074345.17907-1-lm0963hack@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl | expand |
Am 03.06.23 um 09:43 schrieb Min Li: > Userspace can race to free the gobj(robj converted from), robj should not > be accessed again after drm_gem_object_put, otherwith it will result in > use-after-free. > > Signed-off-by: Min Li <lm0963hack@gmail.com> Reviewed-by: Christian König <christian.koenig@amd.com> > --- > Changes in v2: > - Remove unused robj, avoid compile complain > > drivers/gpu/drm/radeon/radeon_gem.c | 4 +--- > 1 file changed, 1 insertion(+), 3 deletions(-) > > diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c > index bdc5af23f005..d3f5ddbc1704 100644 > --- a/drivers/gpu/drm/radeon/radeon_gem.c > +++ b/drivers/gpu/drm/radeon/radeon_gem.c > @@ -459,7 +459,6 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data, > struct radeon_device *rdev = dev->dev_private; > struct drm_radeon_gem_set_domain *args = data; > struct drm_gem_object *gobj; > - struct radeon_bo *robj; > int r; > > /* for now if someone requests domain CPU - > @@ -472,13 +471,12 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data, > up_read(&rdev->exclusive_lock); > return -ENOENT; > } > - robj = gem_to_radeon_bo(gobj); > > r = radeon_gem_set_domain(gobj, args->read_domains, args->write_domain); > > drm_gem_object_put(gobj); > up_read(&rdev->exclusive_lock); > - r = radeon_gem_handle_lockup(robj->rdev, r); > + r = radeon_gem_handle_lockup(rdev, r); > return r; > } >
Applied. Thanks! On Mon, Jun 5, 2023 at 4:13 AM Christian König <christian.koenig@amd.com> wrote: > > Am 03.06.23 um 09:43 schrieb Min Li: > > Userspace can race to free the gobj(robj converted from), robj should not > > be accessed again after drm_gem_object_put, otherwith it will result in > > use-after-free. > > > > Signed-off-by: Min Li <lm0963hack@gmail.com> > > Reviewed-by: Christian König <christian.koenig@amd.com> > > > --- > > Changes in v2: > > - Remove unused robj, avoid compile complain > > > > drivers/gpu/drm/radeon/radeon_gem.c | 4 +--- > > 1 file changed, 1 insertion(+), 3 deletions(-) > > > > diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c > > index bdc5af23f005..d3f5ddbc1704 100644 > > --- a/drivers/gpu/drm/radeon/radeon_gem.c > > +++ b/drivers/gpu/drm/radeon/radeon_gem.c > > @@ -459,7 +459,6 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data, > > struct radeon_device *rdev = dev->dev_private; > > struct drm_radeon_gem_set_domain *args = data; > > struct drm_gem_object *gobj; > > - struct radeon_bo *robj; > > int r; > > > > /* for now if someone requests domain CPU - > > @@ -472,13 +471,12 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data, > > up_read(&rdev->exclusive_lock); > > return -ENOENT; > > } > > - robj = gem_to_radeon_bo(gobj); > > > > r = radeon_gem_set_domain(gobj, args->read_domains, args->write_domain); > > > > drm_gem_object_put(gobj); > > up_read(&rdev->exclusive_lock); > > - r = radeon_gem_handle_lockup(robj->rdev, r); > > + r = radeon_gem_handle_lockup(rdev, r); > > return r; > > } > > >
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c index bdc5af23f005..d3f5ddbc1704 100644 --- a/drivers/gpu/drm/radeon/radeon_gem.c +++ b/drivers/gpu/drm/radeon/radeon_gem.c @@ -459,7 +459,6 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data, struct radeon_device *rdev = dev->dev_private; struct drm_radeon_gem_set_domain *args = data; struct drm_gem_object *gobj; - struct radeon_bo *robj; int r; /* for now if someone requests domain CPU - @@ -472,13 +471,12 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data, up_read(&rdev->exclusive_lock); return -ENOENT; } - robj = gem_to_radeon_bo(gobj); r = radeon_gem_set_domain(gobj, args->read_domains, args->write_domain); drm_gem_object_put(gobj); up_read(&rdev->exclusive_lock); - r = radeon_gem_handle_lockup(robj->rdev, r); + r = radeon_gem_handle_lockup(rdev, r); return r; }
Userspace can race to free the gobj(robj converted from), robj should not be accessed again after drm_gem_object_put, otherwith it will result in use-after-free. Signed-off-by: Min Li <lm0963hack@gmail.com> --- Changes in v2: - Remove unused robj, avoid compile complain drivers/gpu/drm/radeon/radeon_gem.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)