[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CANX2M5Z2LzD_Z6qgq9Avv3hygQ7LJNX+KyZOK6_5d-KZRNwfCg@mail.gmail.com>
Date: Tue, 2 Aug 2022 12:02:51 -0700
From: Dipanjan Das <mail.dipanjan.das@...il.com>
To: maarten.lankhorst@...ux.intel.com, mripard@...nel.org,
sean@...rly.run, airlied@...ux.ie, daniel@...ll.ch,
dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org
Cc: syzkaller@...glegroups.com, fleischermarius@...glemail.com,
its.priyanka.bose@...il.com
Subject: Re: KASAN: use-after-free Read in drm_gem_object_release
On Fri, Jul 22, 2022 at 9:23 AM Dipanjan Das
<mail.dipanjan.das@...il.com> wrote:
> ======================================================
> description: KASAN: use-after-free Read in drm_gem_object_release
> affected file: drivers/gpu/drm/drm_gem.c
> kernel version: 5.4.206
> kernel commit: 981f87403bb9841f1e0b7953e12a51f09a47a4f0
> git tree: upstream
> kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=1aab6d4187ddf667
> crash reproducer: attached
> ======================================================
> Crash log:
> ======================================================
> BUG: KASAN: use-after-free in drm_gem_object_release+0xf7/0x120
> drivers/gpu/drm/drm_gem.c:952
> ==================================================================
> BUG: KASAN: double-free or invalid-free in
> drm_gem_vram_create+0x1b7/0x1f0
> drivers/gpu/drm/drm_gem_vram_helper.c:142
We did an initial analysis for this bug and figured out the following:
If ttm_bo_init_reserved() fails, the `gbo` and `gbo->bo.base` will be
freed by ttm_buffer_object_destroy(). But then drm_gem_vram_create()
and drm_gem_vram_init() will attempt to free `gbo` and `gbo->bo.base`
again. This will result in UAF and Double Free. A similar bug (the
stack traces were a bit different) has been patched by this upstream
commit: https://github.com/torvalds/linux/commit/da62cb7230f0871c30dc9789071f63229158d261.
We applied this patch and can confirm that the repro does not trigger
the issue anymore.
--
Thanks and Regards,
Dipanjan
Powered by blists - more mailing lists