From: Steve Cohen <cohens@codeaurora.org> To: dri-devel@lists.freedesktop.org, freedreno@lists.freedesktop.org, linux-arm-msm@vger.kernel.org Cc: Steve Cohen <cohens@codeaurora.org>, seanpaul@chromium.org, pdhaval@codeaurora.org, jsanka@codeaurora.org, adelva@google.com Subject: [PATCH] drm: hold gem reference until object is no longer accessed Date: Fri, 10 Jul 2020 18:40:26 -0400 [thread overview] Message-ID: <1594420826-4897-1-git-send-email-cohens@codeaurora.org> (raw) BUG: KASAN: use-after-free in drm_gem_open_ioctl There is potential for use-after-free here if the GEM object handle is closed between the idr lookup and retrieving the size from the object since a local reference is not being held at that point. Hold the local reference while the object can still be accessed to resolve this. Signed-off-by: Steve Cohen <cohens@codeaurora.org> --- drivers/gpu/drm/drm_gem.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 7bf628e..4b2891c 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -898,14 +898,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data, /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ ret = drm_gem_handle_create_tail(file_priv, obj, &handle); - drm_gem_object_put_unlocked(obj); if (ret) - return ret; + goto out; args->handle = handle; args->size = obj->size; - return 0; +out: + drm_gem_object_put_unlocked(obj); + return ret; } /** -- The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project
WARNING: multiple messages have this Message-ID (diff)
From: Steve Cohen <cohens@codeaurora.org> To: dri-devel@lists.freedesktop.org, freedreno@lists.freedesktop.org, linux-arm-msm@vger.kernel.org Cc: adelva@google.com, seanpaul@chromium.org, pdhaval@codeaurora.org, Steve Cohen <cohens@codeaurora.org> Subject: [PATCH] drm: hold gem reference until object is no longer accessed Date: Fri, 10 Jul 2020 18:40:26 -0400 [thread overview] Message-ID: <1594420826-4897-1-git-send-email-cohens@codeaurora.org> (raw) BUG: KASAN: use-after-free in drm_gem_open_ioctl There is potential for use-after-free here if the GEM object handle is closed between the idr lookup and retrieving the size from the object since a local reference is not being held at that point. Hold the local reference while the object can still be accessed to resolve this. Signed-off-by: Steve Cohen <cohens@codeaurora.org> --- drivers/gpu/drm/drm_gem.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 7bf628e..4b2891c 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -898,14 +898,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data, /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ ret = drm_gem_handle_create_tail(file_priv, obj, &handle); - drm_gem_object_put_unlocked(obj); if (ret) - return ret; + goto out; args->handle = handle; args->size = obj->size; - return 0; +out: + drm_gem_object_put_unlocked(obj); + return ret; } /** -- The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel
next reply other threads:[~2020-07-10 22:40 UTC|newest] Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-07-10 22:40 Steve Cohen [this message] 2020-07-10 22:40 ` [PATCH] drm: hold gem reference until object is no longer accessed Steve Cohen 2020-07-16 20:29 ` Sam Ravnborg 2020-07-16 20:29 ` Sam Ravnborg 2020-07-19 13:39 ` Sam Ravnborg 2020-07-19 13:39 ` Sam Ravnborg
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1594420826-4897-1-git-send-email-cohens@codeaurora.org \ --to=cohens@codeaurora.org \ --cc=adelva@google.com \ --cc=dri-devel@lists.freedesktop.org \ --cc=freedreno@lists.freedesktop.org \ --cc=jsanka@codeaurora.org \ --cc=linux-arm-msm@vger.kernel.org \ --cc=pdhaval@codeaurora.org \ --cc=seanpaul@chromium.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.