lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <f24be4ca-edde-819a-5bcc-070e0d2e23d1@linux.intel.com>
Date:   Mon, 23 Jan 2023 16:56:47 +0000
From:   Tvrtko Ursulin <tvrtko.ursulin@...ux.intel.com>
To:     Rob Clark <robdclark@...il.com>, dri-devel@...ts.freedesktop.org
Cc:     Rob Clark <robdclark@...omium.org>,
        Jani Nikula <jani.nikula@...ux.intel.com>,
        Joonas Lahtinen <joonas.lahtinen@...ux.intel.com>,
        Rodrigo Vivi <rodrigo.vivi@...el.com>,
        David Airlie <airlied@...il.com>,
        Daniel Vetter <daniel@...ll.ch>,
        Chris Wilson <chris@...is-wilson.co.uk>,
        Andi Shyti <andi.shyti@...ux.intel.com>,
        John Harrison <John.C.Harrison@...el.com>,
        Matthew Brost <matthew.brost@...el.com>,
        katrinzhou <katrinzhou@...cent.com>,
        Thomas Hellström 
        <thomas.hellstrom@...ux.intel.com>,
        intel-gfx@...ts.freedesktop.org,
        open list <linux-kernel@...r.kernel.org>,
        Niranjana Vishwanathapura <niranjana.vishwanathapura@...el.com>,
        Matthew Auld <matthew.auld@...el.com>
Subject: Re: [PATCH] drm/i915: Avoid potential vm use-after-free


+ some more people based on e1a7ab4fca0c

On 19/01/2023 17:32, Rob Clark wrote:
> From: Rob Clark <robdclark@...omium.org>
> 
> Adding the vm to the vm_xa table makes it visible to userspace, which
> could try to race with us to close the vm.  So we need to take our extra
> reference before putting it in the table.
> 
> Signed-off-by: Rob Clark <robdclark@...omium.org>
> ---
> Note, you could list commit e1a7ab4fca0c ("drm/i915: Remove the vm open
> count") as the "fixed" commit, but really the issue seems to go back
> much further (with the fix needing some backporting in the process).

It would probably be rather essential to identify the correct Fixes: tag.

Since Thomas, Matt and Niranjana you were directly involved in the patch 
which changed significantly how this works, perhaps there is something 
still somewhat easily retrievable from your memory lanes to help with this?

Regards,

Tvrtko

> 
>   drivers/gpu/drm/i915/gem/i915_gem_context.c | 14 +++++++++++---
>   1 file changed, 11 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/i915/gem/i915_gem_context.c b/drivers/gpu/drm/i915/gem/i915_gem_context.c
> index 6250de9b9196..e4b78ab4773b 100644
> --- a/drivers/gpu/drm/i915/gem/i915_gem_context.c
> +++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c
> @@ -1861,11 +1861,19 @@ static int get_ppgtt(struct drm_i915_file_private *file_priv,
>   	vm = ctx->vm;
>   	GEM_BUG_ON(!vm);
>   
> +	/*
> +	 * Get a reference for the allocated handle.  Once the handle is
> +	 * visible in the vm_xa table, userspace could try to close it
> +	 * from under our feet, so we need to hold the extra reference
> +	 * first.
> +	 */
> +	i915_vm_get(vm);
> +
>   	err = xa_alloc(&file_priv->vm_xa, &id, vm, xa_limit_32b, GFP_KERNEL);
> -	if (err)
> +	if (err) {
> +		i915_vm_put(vm);
>   		return err;
> -
> -	i915_vm_get(vm);
> +	}
>   
>   	GEM_BUG_ON(id == 0); /* reserved for invalid/unassigned ppgtt */
>   	args->value = id;

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ