linux-kernel - Re: KASAN: use-after-free Read in vgem_gem_dumb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200201162537.GK1778@kadam>
Date:   Sat, 1 Feb 2020 19:25:37 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Hillf Danton <hdanton@...a.com>
Cc:     syzbot <syzbot+0dc4444774d419e916c8@...kaller.appspotmail.com>,
        airlied@...ux.ie, alexander.deucher@....com,
        amd-gfx@...ts.freedesktop.org, chris@...is-wilson.co.uk,
        christian.koenig@....com, daniel@...ll.ch, davem@...emloft.net,
        dri-devel@...ts.freedesktop.org, emil.velikov@...labora.com,
        eric@...olt.net, linaro-mm-sig@...ts.linaro.org,
        linux-kernel@...r.kernel.org, linux-media@...r.kernel.org,
        netdev@...r.kernel.org, robdclark@...omium.org,
        seanpaul@...omium.org, sumit.semwal@...aro.org,
        syzkaller-bugs@...glegroups.com
Subject: Re: KASAN: use-after-free Read in vgem_gem_dumb_create

On Sat, Feb 01, 2020 at 05:02:47PM +0800, Hillf Danton wrote:
> 
> On Sat, 1 Feb 2020 09:17:57 +0300 Dan Carpenter wrote:
> > On Sat, Feb 01, 2020 at 12:32:09PM +0800, Hillf Danton wrote:
> > >
> > > Release obj in error path.
> > > 
> > > --- a/drivers/gpu/drm/vgem/vgem_drv.c
> > > +++ b/drivers/gpu/drm/vgem/vgem_drv.c
> > > @@ -196,10 +196,10 @@ static struct drm_gem_object *vgem_gem_c
> > >  		return ERR_CAST(obj);
> > >  
> > >  	ret = drm_gem_handle_create(file, &obj->base, handle);
> > > -	drm_gem_object_put_unlocked(&obj->base);
> > > -	if (ret)
> > > +	if (ret) {
> > > +		drm_gem_object_put_unlocked(&obj->base);
> > >  		return ERR_PTR(ret);
> > > -
> > > +	}
> > >  	return &obj->base;
> > 
> > Oh yeah.  It's weird that we never noticed the success path was broken.
> > It's been that way for three years and no one noticed at all.  Very
> > strange.
> > 
> > Anyway, it already gets freed on error in drm_gem_handle_create() so
> > we should just delete the drm_gem_object_put_unlocked() here it looks
> > like.
> 
> Good catch, Dan :P
> Would you please post a patch sometime convenient next week?

Sure.  Will do.

regards,
dan carpenter