linux-kernel - Re: [PATCH] drm/i915: Fix reporting of size of created GEM object

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 09 Jul 2019 08:04:05 +0100
From:   Chris Wilson <chris@...is-wilson.co.uk>
To:     Michał Winiarski <michal.winiarski@...el.com>,
        Janusz Krzysztofik <janusz.krzysztofik@...ux.intel.com>
Cc:     Jani Nikula <jani.nikula@...ux.intel.com>,
        Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>,
        Rodrigo Vivi <rodrigo.vivi@...el.com>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        Michał Wajdeczko <michal.wajdeczko@...el.com>,
        intel-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
        linux-kernel@...r.kernel.org,
        Janusz Krzysztofik <janusz.krzysztofik@...ux.intel.com>
Subject: Re: [PATCH] drm/i915: Fix reporting of size of created GEM object

Quoting Janusz Krzysztofik (2019-07-09 07:58:00)
> Commit e163484afa8d ("drm/i915: Update size upon return from
> GEM_CREATE") (re)introduced reporting of actual size of created GEM
> objects, possibly rounded up on object alignment.  Unfortunately, its
> implementation resulted in a possible use-after-free bug.  The bug has
> been fixed by commit 929eec99f5fd ("drm/i915: Avoid use-after-free in
> reporting create.size") at the cost of possibly incorrect value being
> reported as actual object size.
> 
> Safely restore correct reporting by capturing actual size of created
> GEM object before a reference to the object is put.
> 
> Fixes: 929eec99f5fd ("drm/i915: Avoid use-after-free in reporting create.size")

This doesn't do anything.
-Chris