[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <a587b4db-c3a8-654b-a043-b698f1d98bf6@collabora.com>
Date: Sat, 2 Sep 2023 21:15:39 +0300
From: Dmitry Osipenko <dmitry.osipenko@...labora.com>
To: Boris Brezillon <boris.brezillon@...labora.com>
Cc: David Airlie <airlied@...il.com>,
Gerd Hoffmann <kraxel@...hat.com>,
Gurchetan Singh <gurchetansingh@...omium.org>,
Chia-I Wu <olvaffe@...il.com>, Daniel Vetter <daniel@...ll.ch>,
Maarten Lankhorst <maarten.lankhorst@...ux.intel.com>,
Maxime Ripard <mripard@...nel.org>,
Thomas Zimmermann <tzimmermann@...e.de>,
Christian König <christian.koenig@....com>,
Qiang Yu <yuq825@...il.com>,
Steven Price <steven.price@....com>,
Emma Anholt <emma@...olt.net>, Melissa Wen <mwen@...lia.com>,
Will Deacon <will@...nel.org>,
Peter Zijlstra <peterz@...radead.org>,
Boqun Feng <boqun.feng@...il.com>,
Mark Rutland <mark.rutland@....com>,
dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
kernel@...labora.com, virtualization@...ts.linux-foundation.org,
intel-gfx@...ts.freedesktop.org
Subject: Re: [PATCH v15 01/23] drm/shmem-helper: Fix UAF in error path when
freeing SGT of imported GEM
On 8/28/23 14:16, Boris Brezillon wrote:
> On Sun, 27 Aug 2023 20:54:27 +0300
> Dmitry Osipenko <dmitry.osipenko@...labora.com> wrote:
>
>> Freeing drm-shmem GEM right after creating it using
>> drm_gem_shmem_prime_import_sg_table() frees SGT of the imported dma-buf
>> and then dma-buf frees this SGT second time.
>>
>> The v3d_prime_import_sg_table() is example of a error code path where
>> dma-buf's SGT is freed by drm-shmem and then it's freed second time by
>> dma_buf_unmap_attachment() in drm_gem_prime_import_dev().
>>
>> Add drm-shmem GEM flag telling that this is imported SGT shall not be
>> treated as own SGT, fixing the use-after-free bug.
>>
>> Cc: stable@...r.kernel.org
>> Fixes: 2194a63a818d ("drm: Add library for shmem backed GEM objects")
>> Signed-off-by: Dmitry Osipenko <dmitry.osipenko@...labora.com>
>> ---
>> drivers/gpu/drm/drm_gem_shmem_helper.c | 3 ++-
>> include/drm/drm_gem_shmem_helper.h | 7 +++++++
>> 2 files changed, 9 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c
>> index a783d2245599..78d9cf2355a5 100644
>> --- a/drivers/gpu/drm/drm_gem_shmem_helper.c
>> +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c
>> @@ -141,7 +141,7 @@ void drm_gem_shmem_free(struct drm_gem_shmem_object *shmem)
>>
>> if (obj->import_attach) {
>> drm_prime_gem_destroy(obj, shmem->sgt);
>> - } else {
>> + } else if (!shmem->imported_sgt) {
>> dma_resv_lock(shmem->base.resv, NULL);
>>
>> drm_WARN_ON(obj->dev, shmem->vmap_use_count);
>> @@ -758,6 +758,7 @@ drm_gem_shmem_prime_import_sg_table(struct drm_device *dev,
>> return ERR_CAST(shmem);
>>
>> shmem->sgt = sgt;
>> + shmem->imported_sgt = true;
>
>
> I feel like adding more fields that can be used to do the is_imported()
> check is going to be even more confusing. Can we instead have
>
> /* drm_gem_shmem_prime_import_sg_table() can be called from a
> * driver specific ->import_sg_table() implementations that
> * have extra failable initialization steps. Assign
> * drm_gem_object::import_attach here (even though it's
> * assigned in drm_gem_prime_import_dev()), so we don't end up
> * with driver error paths calling drm_gem_shmem_free() with an
> * imported sg_table assigned to drm_gem_shmem_object::sgt and
> * drm_gem_object::import_attach left uninitialized.
> */
> shmem->base.import_attach = attach;
>
> here?
AFAICT, this is not going to work because obj->import_attach will be
released by drm_prime core by the time drm_gem_shmem_free() is invoked
and drm_gem_shmem_free() uses obj->import_attach as well. I'll keep this
patch around unless there will be other suggestions. To me the flag is
good enough, I'll add a clarifying comment to the code in v16.
--
Best regards,
Dmitry
Powered by blists - more mailing lists