<div dir="ltr">Hello,<br><br>We would like to report a use-after-free bug in the AMDGPU DRM driver in the linux kernel 6.2 that we found with our customized Syzkaller.<br>The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver, with invalid addr and size. <br>We have tested that this bug can still be triggered in the latest RC kernel, v6.8-rc4.<br><br>Steps to reproduce are as below.<br><br>struct drm_amdgpu_gem_userptr *arg;<br>arg = malloc(sizeof(struct drm_amdgpu_gem_userptr));<br>arg->addr = 0xffffffffffff0000;<br>arg->size = 0x80000000;<br>arg->flags = 0x7;<br>ioctl(AMDGPU_renderD128_DEVICE_FILE, 0xc1186451, arg);<br><br>The KASAN report is as follows:<br>==================================================================<br>BUG: KASAN: use-after-free in switch_mm_irqs_off+0x89d/0xb70<br>Read of size 8 at addr ffff88801f17bc00 by task syz-executor/386<br>Call Trace:<br><TASK><br>switch_mm_irqs_off+0x89d/0xb70<br>__schedule+0xa62/0x2630<br>preempt_schedule_common+0x45/0xd0<br>vfree+0x4d/0x60<br>ttm_tt_fini+0xdf/0x1c0<br>amdgpu_ttm_backend_destroy+0x9f/0xe0<br>ttm_bo_cleanup_memtype_use+0x142/0x1f0<br>ttm_bo_release+0x67d/0xc00<br>ttm_bo_put+0x7c/0xa0<br>amdgpu_bo_unref+0x3b/0x80<br>amdgpu_gem_object_free+0x7f/0xc0<br>drm_gem_object_free+0x5d/0x90<br>amdgpu_gem_userptr_ioctl+0x452/0x7e0<br>drm_ioctl_kernel+0x284/0x500<br>drm_ioctl+0x55e/0xa50<br>amdgpu_drm_ioctl+0xe3/0x1d0<br></TASK><br><br>Allocated by task 385:<br>kmem_cache_alloc+0x174/0x300<br>copy_process+0x32d1/0x6640<br>kernel_clone+0xcd/0x690<br><br>Freed by task 386:<br>kmem_cache_free+0x13b/0x550<br>mmu_interval_notifier_remove+0x4c8/0x610<br>amdgpu_hmm_unregister+0x47/0x90<br>amdgpu_gem_object_free+0x75/0xc0<br>drm_gem_object_free+0x5d/0x90<br>amdgpu_gem_userptr_ioctl+0x452/0x7e0<br>drm_ioctl_kernel+0x284/0x500<br>drm_ioctl+0x55e/0xa50<br>amdgpu_drm_ioctl+0xe3/0x1d0<br><br>The buggy address belongs to the object at ffff88801f17bb80<br>which belongs to the cache mm_struct of size 2016<br>The buggy address is located 128 bytes inside of<br>2016-byte region [ffff88801f17bb80, ffff88801f17c360)<br><br>The buggy address belongs to the physical page:<br>page:000000002c2a61bd refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1f178<br>head:000000002c2a61bd order:3 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0<br>memcg:ffff8880141aa301<br>flags: 0x100000000010200(slab|head|node=0|zone=1)<br>raw: 0100000000010200 ffff88800a44fc80 ffffea00006ca400 dead000000000004<br>raw: 0000000000000000 00000000800f000f 00000001ffffffff ffff8880141aa301<br>page dumped because: kasan: bad access detected<br><br>Memory state around the buggy address:<br>ffff88801f17bb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc<br>ffff88801f17bb80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb<br>>ffff88801f17bc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb<br>^<br>ffff88801f17bc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb<br>ffff88801f17bd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb<br>==================================================================</div>