linux-kernel - Re: [PATCH] dmabuf: fix NULL pointer dereference in dma_buf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 18 Sep 2020 13:16:16 +0200
From:   Christian König <christian.koenig@....com>
To:     Charan Teja Reddy <charante@...eaurora.org>,
        sumit.semwal@...aro.org, arnd@...db.de
Cc:     linux-media@...r.kernel.org, dri-devel@...ts.freedesktop.org,
        linaro-mm-sig@...ts.linaro.org, linux-kernel@...r.kernel.org,
        vinmenon@...eaurora.org, stable@...r.kernel.org
Subject: Re: [PATCH] dmabuf: fix NULL pointer dereference in dma_buf_release()

Am 18.09.20 um 12:32 schrieb Charan Teja Reddy:
> NULL pointer dereference is observed while exporting the dmabuf but
> failed to allocate the 'struct file' which results into the dropping of
> the allocated dentry corresponding to this file in the dmabuf fs, which
> is ending up in dma_buf_release() and accessing the uninitialzed
> dentry->d_fsdata.
>
> Call stack on 5.4 is below:
>   dma_buf_release+0x2c/0x254 drivers/dma-buf/dma-buf.c:88
>   __dentry_kill+0x294/0x31c fs/dcache.c:584
>   dentry_kill fs/dcache.c:673 [inline]
>   dput+0x250/0x380 fs/dcache.c:859
>   path_put+0x24/0x40 fs/namei.c:485
>   alloc_file_pseudo+0x1a4/0x200 fs/file_table.c:235
>   dma_buf_getfile drivers/dma-buf/dma-buf.c:473 [inline]
>   dma_buf_export+0x25c/0x3ec drivers/dma-buf/dma-buf.c:585
>
> Fix this by checking for the valid pointer in the dentry->d_fsdata.
>
> Fixes: 4ab59c3c638c ("dma-buf: Move dma_buf_release() from fops to dentry_ops")
> Cc: <stable@...r.kernel.org> [5.7+]
> Signed-off-by: Charan Teja Reddy <charante@...eaurora.org>

Reviewed-by: Christian König <christian.koenig@....com>

Going to pick this up for inclusion into drm-misc-next as well.

> ---
>   drivers/dma-buf/dma-buf.c | 2 ++
>   1 file changed, 2 insertions(+)
>
> diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
> index 58564d82..844967f 100644
> --- a/drivers/dma-buf/dma-buf.c
> +++ b/drivers/dma-buf/dma-buf.c
> @@ -59,6 +59,8 @@ static void dma_buf_release(struct dentry *dentry)
>   	struct dma_buf *dmabuf;
>   
>   	dmabuf = dentry->d_fsdata;
> +	if (unlikely(!dmabuf))
> +		return;
>   
>   	BUG_ON(dmabuf->vmapping_counter);
>