linux-kernel - Bug report: mdp5_crtc.c: use-after-free bug in mdp5_crtc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 15 Apr 2024 16:52:41 +0800 (CST)
From: sicong <congei42@....com>
To: robdclark@...il.com, quic_abhinavk@...cinc.com, dmitry.baryshkov@...aro.org, 
	sean@...rly.run, airlied@...il.com, daniel@...ll.ch
Cc: linux-arm-msm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Bug report: mdp5_crtc.c: use-after-free bug in mdp5_crtc_destroy
 due to race condition

mdp5_crtc.c: use-after-free bug in mdp5_crtc_destroy due to race condition

In mdp5_crtc_init, &mdp5_crtc->unref_cursor_work is bound with 
unref_cursor_worker. This work will be commited by drm_flip_work_commit 
located in mdp5_crtc_vblank_irq.

If we call mdp5_crtc_destroy to make cleanup, there may be a unfinished work. 
This function will call drm_flip_work_cleanup to destroy resources allocated 
for the flip-work. However, drm_flip_work_cleanup works as following:
WARN_ON(!list_empty(&work->queued) || !list_empty(&work->commited));

After mdp5_crtc_destroy call kfree to release the object "mdp5_crtc", 
&mdp5_crtc->unref_cursor_work will get use-after-free error.

CPU 0                          	        CPU 1
                                           |	unref_cursor_worker
mdp5_crtc_destroy            |
kfree(mdp5_crtc)  (free)    |
                                           |	get_kms(&mdp5_crtc->base) (use)

This bug may be fixed by adding the following instructions in drm_flip_work_cleanup.
flush_work(&mdp5_crtc->unref_cursor_work)

Best regards,
Sicong Huang