* [PATCH] drm/gem: Avoid use-after-free on drm_gem_mmap_obj() failure
@ 2022-09-20 7:24 Shigeru Yoshida
2022-10-09 18:35 ` Shigeru Yoshida
0 siblings, 1 reply; 2+ messages in thread
From: Shigeru Yoshida @ 2022-09-20 7:24 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel
Cc: dri-devel, linux-kernel, Shigeru Yoshida, syzbot+c512687fff9d22327436
syzbot reported use-after-free for drm_gem_object [1]. This causes
the call trace like below:
[ 75.327400][ T5723] Call Trace:
[ 75.327611][ T5723] <TASK>
[ 75.327803][ T5723] drm_gem_object_handle_put_unlocked+0x11e/0x1a0
[ 75.328209][ T5723] drm_gem_object_release_handle+0x5d/0x70
[ 75.328568][ T5723] ? drm_gem_object_handle_put_unlocked+0x1a0/0x1a0
[ 75.328965][ T5723] idr_for_each+0x99/0x160
[ 75.329253][ T5723] drm_gem_release+0x20/0x30
[ 75.329544][ T5723] drm_file_free.part.0+0x269/0x310
[ 75.329867][ T5723] drm_close_helper.isra.0+0x88/0xa0
[ 75.330305][ T5723] drm_release+0x8e/0x1a0
[ 75.330674][ T5723] ? drm_release_noglobal+0xc0/0xc0
[ 75.331138][ T5723] __fput+0x10e/0x440
[ 75.331503][ T5723] task_work_run+0x73/0xd0
[ 75.331895][ T5723] do_exit+0x535/0x1200
[ 75.332280][ T5723] ? ktime_get_coarse_real_ts64+0x13b/0x170
[ 75.332810][ T5723] do_group_exit+0x51/0x100
[ 75.333215][ T5723] __x64_sys_exit_group+0x18/0x20
[ 75.333654][ T5723] do_syscall_64+0x37/0x90
[ 75.334058][ T5723] entry_SYSCALL_64_after_hwframe+0x63/0xcd
If drm_gem_mmap_obj() failed, it drops the reference count by calling
drm_gem_object_put(). However, drm_gem_mmap() drops the reference
count after calling drm_gem_mmap_obj() even if it failed, so it breaks
the balance of the reference count.
This patch fixes this issue by calling drm_gem_object_put() only if
drm_gem_mmap_obj() succeeds, and returns immediately if
drm_gem_mmap_obj() failed without calling drm_gem_object_put().
Link: https://syzkaller.appspot.com/bug?id=c42a72b0b3bcedd95e5f132a4ccd7cd550334160 [1]
Reported-by: syzbot+c512687fff9d22327436@syzkaller.appspotmail.com
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
---
drivers/gpu/drm/drm_gem.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index ad068865ba20..f345d38df50a 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -1115,10 +1115,12 @@ int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
ret = drm_gem_mmap_obj(obj, drm_vma_node_size(node) << PAGE_SHIFT,
vma);
+ if (ret)
+ return ret;
drm_gem_object_put(obj);
- return ret;
+ return 0;
}
EXPORT_SYMBOL(drm_gem_mmap);
--
2.37.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] drm/gem: Avoid use-after-free on drm_gem_mmap_obj() failure
2022-09-20 7:24 [PATCH] drm/gem: Avoid use-after-free on drm_gem_mmap_obj() failure Shigeru Yoshida
@ 2022-10-09 18:35 ` Shigeru Yoshida
0 siblings, 0 replies; 2+ messages in thread
From: Shigeru Yoshida @ 2022-10-09 18:35 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel
Cc: dri-devel, linux-kernel, syoshida, syzbot+c512687fff9d22327436
ping?
On Tue, 20 Sep 2022 16:24:08 +0900, Shigeru Yoshida wrote:
> syzbot reported use-after-free for drm_gem_object [1]. This causes
> the call trace like below:
>
> [ 75.327400][ T5723] Call Trace:
> [ 75.327611][ T5723] <TASK>
> [ 75.327803][ T5723] drm_gem_object_handle_put_unlocked+0x11e/0x1a0
> [ 75.328209][ T5723] drm_gem_object_release_handle+0x5d/0x70
> [ 75.328568][ T5723] ? drm_gem_object_handle_put_unlocked+0x1a0/0x1a0
> [ 75.328965][ T5723] idr_for_each+0x99/0x160
> [ 75.329253][ T5723] drm_gem_release+0x20/0x30
> [ 75.329544][ T5723] drm_file_free.part.0+0x269/0x310
> [ 75.329867][ T5723] drm_close_helper.isra.0+0x88/0xa0
> [ 75.330305][ T5723] drm_release+0x8e/0x1a0
> [ 75.330674][ T5723] ? drm_release_noglobal+0xc0/0xc0
> [ 75.331138][ T5723] __fput+0x10e/0x440
> [ 75.331503][ T5723] task_work_run+0x73/0xd0
> [ 75.331895][ T5723] do_exit+0x535/0x1200
> [ 75.332280][ T5723] ? ktime_get_coarse_real_ts64+0x13b/0x170
> [ 75.332810][ T5723] do_group_exit+0x51/0x100
> [ 75.333215][ T5723] __x64_sys_exit_group+0x18/0x20
> [ 75.333654][ T5723] do_syscall_64+0x37/0x90
> [ 75.334058][ T5723] entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> If drm_gem_mmap_obj() failed, it drops the reference count by calling
> drm_gem_object_put(). However, drm_gem_mmap() drops the reference
> count after calling drm_gem_mmap_obj() even if it failed, so it breaks
> the balance of the reference count.
>
> This patch fixes this issue by calling drm_gem_object_put() only if
> drm_gem_mmap_obj() succeeds, and returns immediately if
> drm_gem_mmap_obj() failed without calling drm_gem_object_put().
>
> Link: https://syzkaller.appspot.com/bug?id=c42a72b0b3bcedd95e5f132a4ccd7cd550334160 [1]
> Reported-by: syzbot+c512687fff9d22327436@syzkaller.appspotmail.com
> Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
> ---
> drivers/gpu/drm/drm_gem.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
> index ad068865ba20..f345d38df50a 100644
> --- a/drivers/gpu/drm/drm_gem.c
> +++ b/drivers/gpu/drm/drm_gem.c
> @@ -1115,10 +1115,12 @@ int drm_gem_mmap(struct file *filp, struct vm_area_struct *vma)
>
> ret = drm_gem_mmap_obj(obj, drm_vma_node_size(node) << PAGE_SHIFT,
> vma);
> + if (ret)
> + return ret;
>
> drm_gem_object_put(obj);
>
> - return ret;
> + return 0;
> }
> EXPORT_SYMBOL(drm_gem_mmap);
>
> --
> 2.37.3
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-10-09 18:35 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-09-20 7:24 [PATCH] drm/gem: Avoid use-after-free on drm_gem_mmap_obj() failure Shigeru Yoshida
2022-10-09 18:35 ` Shigeru Yoshida
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).