lkml.org 
[lkml]   [2019]   [Apr]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.0 107/146] drm/vkms: fix use-after-free when drm_gem_handle_create() fails
    Date
    5.0-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Biggers <ebiggers@google.com>

    commit 36b6c9ed45afe89045973e8dee1b004dd5372d40 upstream.

    If drm_gem_handle_create() fails in vkms_gem_create(), then the
    vkms_gem_object is freed twice: once when the reference is dropped by
    drm_gem_object_put_unlocked(), and again by the extra calls to
    drm_gem_object_release() and kfree().

    Fix it by skipping the second release and free.

    This bug was originally found in the vgem driver by syzkaller using
    fault injection, but I noticed it's also present in the vkms driver.

    Fixes: 559e50fd34d1 ("drm/vkms: Add dumb operations")
    Cc: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
    Cc: Haneen Mohammed <hamohammed.sa@gmail.com>
    Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
    Cc: Chris Wilson <chris@chris-wilson.co.uk>
    Cc: stable@vger.kernel.org
    Signed-off-by: Eric Biggers <ebiggers@google.com>
    Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
    Reviewed-by: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
    Signed-off-by: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
    Link: https://patchwork.freedesktop.org/patch/msgid/20190226220858.214438-1-ebiggers@kernel.org
    Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/gpu/drm/vkms/vkms_gem.c | 5 +----
    1 file changed, 1 insertion(+), 4 deletions(-)

    --- a/drivers/gpu/drm/vkms/vkms_gem.c
    +++ b/drivers/gpu/drm/vkms/vkms_gem.c
    @@ -111,11 +111,8 @@ struct drm_gem_object *vkms_gem_create(s

    ret = drm_gem_handle_create(file, &obj->gem, handle);
    drm_gem_object_put_unlocked(&obj->gem);
    - if (ret) {
    - drm_gem_object_release(&obj->gem);
    - kfree(obj);
    + if (ret)
    return ERR_PTR(ret);
    - }

    return &obj->gem;
    }

    \
     
     \ /
      Last update: 2019-04-01 19:10    [W:4.042 / U:0.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site