linux-kernel - Re: [PATCH v2 6/8] media: platform: amd: isp4 video node and buffers handling added

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6cbf96ec-67a2-44c1-84ec-57ca0582a0de@amd.com>
Date: Fri, 25 Jul 2025 17:05:06 +0800
From: "Du, Bin" <bin.du@....com>
To: Sultan Alsawaf <sultan@...neltoast.com>
Cc: mchehab@...nel.org, hverkuil@...all.nl,
 laurent.pinchart+renesas@...asonboard.com, bryan.odonoghue@...aro.org,
 sakari.ailus@...ux.intel.com, prabhakar.mahadev-lad.rj@...renesas.com,
 linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
 pratap.nirujogi@....com, benjamin.chan@....com, king.li@....com,
 gjorgji.rosikopulos@....com, Phil.Jawich@....com, Dominic.Antony@....com,
 Svetoslav.Stoilov@....com
Subject: Re: [PATCH v2 6/8] media: platform: amd: isp4 video node and buffers
 handling added

Thanks Sultan, never mind.

Regards,
Bin

On 7/24/2025 1:14 PM, Sultan Alsawaf wrote:
> On Wed, Jul 23, 2025 at 10:55:48AM -0700, Sultan Alsawaf wrote:
>> On Wed, Jun 18, 2025 at 05:19:57PM +0800, Bin Du wrote:
>>> +
>>> +	buf->bo = (void *)bo;
>>> +	buf->gpu_addr = gpu_addr;
>>> +
>>> +	refcount_set(&buf->refcount, 1);
>>
>> This discards the refcount inc triggered from amdgpu_bo_create_isp_user() when
>> it calls get_dma_buf(), leading to a use-after-free. Move this refcount_set()
>> up, preferably right after vmalloc_user() or right after `buf` is allocated so
>> there's no risk of this issue occurring again in the future.
> 
> Following up to correct myself: please disregard this one comment from my
> previous email since it's incorrect. Sorry for any confusion.
> 
> Sultan