From: Dipanjan Das <mail.dipanjan.das@gmail.com>
To: maarten.lankhorst@linux.intel.com, mripard@kernel.org,
sean@poorly.run, airlied@linux.ie, daniel@ffwll.ch,
dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Cc: fleischermarius@googlemail.com, syzkaller@googlegroups.com,
its.priyanka.bose@gmail.com
Subject: Re: KASAN: use-after-free Read in drm_gem_object_release
Date: Tue, 2 Aug 2022 12:02:51 -0700 [thread overview]
Message-ID: <CANX2M5Z2LzD_Z6qgq9Avv3hygQ7LJNX+KyZOK6_5d-KZRNwfCg@mail.gmail.com> (raw)
In-Reply-To: <CANX2M5Ysmgv1b4toRxeTDiKtpJyv_-dTqsRediqd8NbT=RKObQ@mail.gmail.com>
On Fri, Jul 22, 2022 at 9:23 AM Dipanjan Das
<mail.dipanjan.das@gmail.com> wrote:
> ======================================================
> description: KASAN: use-after-free Read in drm_gem_object_release
> affected file: drivers/gpu/drm/drm_gem.c
> kernel version: 5.4.206
> kernel commit: 981f87403bb9841f1e0b7953e12a51f09a47a4f0
> git tree: upstream
> kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=1aab6d4187ddf667
> crash reproducer: attached
> ======================================================
> Crash log:
> ======================================================
> BUG: KASAN: use-after-free in drm_gem_object_release+0xf7/0x120
> drivers/gpu/drm/drm_gem.c:952
> ==================================================================
> BUG: KASAN: double-free or invalid-free in
> drm_gem_vram_create+0x1b7/0x1f0
> drivers/gpu/drm/drm_gem_vram_helper.c:142
We did an initial analysis for this bug and figured out the following:
If ttm_bo_init_reserved() fails, the `gbo` and `gbo->bo.base` will be
freed by ttm_buffer_object_destroy(). But then drm_gem_vram_create()
and drm_gem_vram_init() will attempt to free `gbo` and `gbo->bo.base`
again. This will result in UAF and Double Free. A similar bug (the
stack traces were a bit different) has been patched by this upstream
commit: https://github.com/torvalds/linux/commit/da62cb7230f0871c30dc9789071f63229158d261.
We applied this patch and can confirm that the repro does not trigger
the issue anymore.
--
Thanks and Regards,
Dipanjan
next prev parent reply other threads:[~2022-08-03 7:21 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-07-22 16:23 KASAN: use-after-free Read in drm_gem_object_release Dipanjan Das
2022-08-02 19:02 ` Dipanjan Das [this message]
-- strict thread matches above, loose matches on Subject: below --
2021-05-14 6:42 Dan Bautista
2020-07-10 8:24 butt3rflyh4ck
2020-07-10 10:39 ` Greg KH
2020-07-10 11:52 ` Dan Carpenter
2020-07-10 14:01 ` butt3rflyh4ck
2020-07-10 14:03 ` butt3rflyh4ck
2020-07-13 16:12 ` Daniel Vetter
2020-07-13 16:47 ` butt3rflyh4ck
2020-07-14 7:41 ` Thomas Zimmermann
2020-07-14 8:46 ` Thomas Zimmermann
[not found] <00000000000053fea105791276d8@google.com>
2018-10-29 11:51 ` Dmitry Vyukov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CANX2M5Z2LzD_Z6qgq9Avv3hygQ7LJNX+KyZOK6_5d-KZRNwfCg@mail.gmail.com \
--to=mail.dipanjan.das@gmail.com \
--cc=airlied@linux.ie \
--cc=daniel@ffwll.ch \
--cc=dri-devel@lists.freedesktop.org \
--cc=fleischermarius@googlemail.com \
--cc=its.priyanka.bose@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=maarten.lankhorst@linux.intel.com \
--cc=mripard@kernel.org \
--cc=sean@poorly.run \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).