From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rodrigo Siqueira Subject: Re: [PATCH] drm/vkms: fix use-after-free when drm_gem_handle_create() fails Date: Mon, 4 Mar 2019 20:23:12 -0300 Message-ID: <20190304232312.qy6x2xmtueq22m3j@smtp.gmail.com> References: <20190226213053.GC218103@gmail.com> <20190226220858.214438-1-ebiggers@kernel.org> <20190227231202.tycdbcqtk5ylwp4k@smtp.gmail.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="n3twmywmxq4dmydp" Return-path: Content-Disposition: inline In-Reply-To: Sender: linux-kernel-owner@vger.kernel.org To: Dmitry Vyukov Cc: Eric Biggers , DRI , syzkaller-bugs , LKML , Haneen Mohammed , Daniel Vetter , Chris Wilson , stable List-Id: dri-devel@lists.freedesktop.org --n3twmywmxq4dmydp Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On 02/28, Dmitry Vyukov wrote: > On Thu, Feb 28, 2019 at 12:12 AM Rodrigo Siqueira > wrote: > > > > On 02/26, Eric Biggers wrote: > > > From: Eric Biggers > > > > > > If drm_gem_handle_create() fails in vkms_gem_create(), then the > > > vkms_gem_object is freed twice: once when the reference is dropped by > > > drm_gem_object_put_unlocked(), and again by the extra calls to > > > drm_gem_object_release() and kfree(). > > > > > > Fix it by skipping the second release and free. > > > > > > This bug was originally found in the vgem driver by syzkaller using > > > fault injection, but I noticed it's also present in the vkms driver. > > > > > > Fixes: 559e50fd34d1 ("drm/vkms: Add dumb operations") > > > Cc: Rodrigo Siqueira > > > Cc: Haneen Mohammed > > > Cc: Daniel Vetter > > > Cc: Chris Wilson > > > Cc: stable@vger.kernel.org > > > Signed-off-by: Eric Biggers > > > --- > > > drivers/gpu/drm/vkms/vkms_gem.c | 5 +---- > > > 1 file changed, 1 insertion(+), 4 deletions(-) > > > > > > diff --git a/drivers/gpu/drm/vkms/vkms_gem.c b/drivers/gpu/drm/vkms/v= kms_gem.c > > > index 138b0bb325cf9..69048e73377dc 100644 > > > --- a/drivers/gpu/drm/vkms/vkms_gem.c > > > +++ b/drivers/gpu/drm/vkms/vkms_gem.c > > > @@ -111,11 +111,8 @@ struct drm_gem_object *vkms_gem_create(struct dr= m_device *dev, > > > > > > ret =3D drm_gem_handle_create(file, &obj->gem, handle); > > > drm_gem_object_put_unlocked(&obj->gem); > > > - if (ret) { > > > - drm_gem_object_release(&obj->gem); > > > - kfree(obj); > > > + if (ret) > > > return ERR_PTR(ret); > > > - } > > > > > > return &obj->gem; > > > } > > > -- > > > 2.21.0.rc2.261.ga7da99ff1b-goog > > > > > > > Hi, > > > > Thanks for your patch! :) > > > > The patch looks good for me. I also tested it under the IGT tests on my > > local VM and everything was fine. Hi, Patch applied to drm-misc-fixes. =20 > Hi Rodrigo, >=20 > What are IGT tests? How can I run them? Hi Dmitry, IGT is a test suite focused on DRM drivers. You can clone the project using the link below: https://gitlab.freedesktop.org/drm/igt-gpu-tools.git In the README, you will find the software dependencies. After you install all the required package, just use: mkdir build && meson build && cd build && ninja Finally, if you want to test VKMS, I recommend you to do it inside a VM. Best Regards Rodrigo Siqueira > > > > Reviewed-by: Rodrigo Siqueira > > > > -- > > Rodrigo Siqueira > > https://siqueira.tech > > Graduate Student > > Department of Computer Science > > University of S=E3o Paulo > > > > -- > > You received this message because you are subscribed to the Google Grou= ps "syzkaller-bugs" group. > > To unsubscribe from this group and stop receiving emails from it, send = an email to syzkaller-bugs+unsubscribe@googlegroups.com. > > To view this discussion on the web visit https://groups.google.com/d/ms= gid/syzkaller-bugs/20190227231202.tycdbcqtk5ylwp4k%40smtp.gmail.com. > > For more options, visit https://groups.google.com/d/optout. --=20 Rodrigo Siqueira https://siqueira.tech Graduate Student Department of Computer Science University of S=E3o Paulo --n3twmywmxq4dmydp Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE4tZ+ii1mjMCMQbfkWJzP/comvP8FAlx9s18ACgkQWJzP/com vP8vJg/5ATmYH8IjAS2gklfG1oaEZjYiHpEtIIM1dABXAAQVKqCf1UXUdfCoM1Sf 8sid1fGOWXBXAI9oAHiPQvii3gIShMOwxKnPA7Ul3TynYNSkm4PY/vc+Qn9KoZ7T sN4vpYQrpVjweuAcncJVDmj9eWxsyfbvu8WrbPoz0QvPcAxYi3slMsX0zYnq1TbL 2ZUiReZdHdE9V/K08xVsdsQn5jsrU2NLZTT/BDTQlo+VfV1evSNjioc1wHW/P33m kwdKOVh4kCxmI6k1Oc2IzxHnjtOvL65uuOMqgGPxDjFe4z3SuRXJ1OIutj6wSe9a fc5Emzl2eGq80uibB1d0SpQZ82bUtl73b04SOUN7EcLyywPf3aryOmfexrCkUdB1 j1zA48DyRsiSjMDO3ytj/PbPa9PM9oVnKXJLfbQh5FKaUXSnfeo6a++y9aJpe/0C klNy++3dynKqk/bATWac31TbUsVUkxIcnTnOVc+VF8PGGNMGg8R2W1hiwyp9QtFc 9Q6SJCqgmznZdLu13byMKEhpLki9xB91f/chNkK710NWRJOYki2Cwb7udyJh2UJo YZc8X7hm6SPFwzH7KxhLVpQEGZgPi5jdJO6h4QZSobLUUVH5hZvb2wnDglWSJLsI oRR+x+rSTzWaRlplE5t5Cmkjoon6TNM25I3PSp5tJYCKrJPBPqQ= =efmC -----END PGP SIGNATURE----- --n3twmywmxq4dmydp--