linux-kernel - Re: [PATCH] drm/amdgpu: fix potential double drop fence reference

Open Source and information security mailing list archives

Message-ID: <CADnq5_NogpdgxHhm-QnJmLBiVFOrjVRSAzfAr1U1YVuSz5CyOA@mail.gmail.com>
Date:   Wed, 6 Nov 2019 12:19:43 -0500
From:   Alex Deucher <alexdeucher@...il.com>
To:     "Koenig, Christian" <Christian.Koenig@....com>
Cc:     Pan Bian <bianpan2016@....com>,
        "Deucher, Alexander" <Alexander.Deucher@....com>,
        "Zhou, David(ChunMing)" <David1.Zhou@....com>,
        David Airlie <airlied@...ux.ie>,
        Daniel Vetter <daniel@...ll.ch>,
        Sam Ravnborg <sam@...nborg.org>,
        "dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>,
        "amd-gfx@...ts.freedesktop.org" <amd-gfx@...ts.freedesktop.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] drm/amdgpu: fix potential double drop fence reference

On Wed, Nov 6, 2019 at 4:39 AM Koenig, Christian
<Christian.Koenig@....com> wrote:
>
> Am 06.11.19 um 10:14 schrieb Pan Bian:
> > The object fence is not set to NULL after its reference is dropped. As a
> > result, its reference may be dropped again if error occurs after that,
> > which may lead to a use after free bug. To avoid the issue, fence is
> > explicitly set to NULL after dropping its reference.
> >
> > Signed-off-by: Pan Bian <bianpan2016@....com>
>
> Acked-by: Christian König <christian.koenig@....com>

Applied.  thanks!

Alex

>
> > ---
> >   drivers/gpu/drm/amd/amdgpu/amdgpu_test.c | 2 ++
> >   1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c
> > index b66d29d5ffa2..b158230af8db 100644
> > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c
> > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_test.c
> > @@ -138,6 +138,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev)
> >               }
> >
> >               dma_fence_put(fence);
> > +             fence = NULL;
> >
> >               r = amdgpu_bo_kmap(vram_obj, &vram_map);
> >               if (r) {
> > @@ -183,6 +184,7 @@ static void amdgpu_do_test_moves(struct amdgpu_device *adev)
> >               }
> >
> >               dma_fence_put(fence);
> > +             fence = NULL;
> >
> >               r = amdgpu_bo_kmap(gtt_obj[i], &gtt_map);
> >               if (r) {
>
> _______________________________________________
> amd-gfx mailing list
> amd-gfx@...ts.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/amd-gfx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives