[PATCH V2] drm: hold gem reference until object is no longer accessed

[Greg KH]

On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote:
> A use-after-free in drm_gem_open_ioctl can happen if the
> GEM object handle is closed between the idr lookup and
> retrieving the size from said object since a local reference
> is not being held at that point. Hold the local reference
> while the object can still be accessed to fix this and
> plug the potential security hole.
> 
> Signed-off-by: Steve Cohen <cohens at codeaurora.org>
> ---
>  drivers/gpu/drm/drm_gem.c | 10 ++++------
>  1 file changed, 4 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
> index 7bf628e..ee2058a 100644
> --- a/drivers/gpu/drm/drm_gem.c
> +++ b/drivers/gpu/drm/drm_gem.c
> @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
>   * @file_priv: drm file-private structure
>   *
>   * Open an object using the global name, returning a handle and the size.
> - *
> - * This handle (of course) holds a reference to the object, so the object
> - * will not go away until the handle is deleted.
>   */
>  int
>  drm_gem_open_ioctl(struct drm_device *dev, void *data,
> @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
>  
>  	/* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
>  	ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
> -	drm_gem_object_put_unlocked(obj);
>  	if (ret)
> -		return ret;
> +		goto err;
>  
>  	args->handle = handle;
>  	args->size = obj->size;
>  
> -	return 0;
> +err:
> +	drm_gem_object_put_unlocked(obj);
> +	return ret;
>  }
>  
>  /**

As this seems to fix an important issue, any reason it wasn't cc: stable
on it so that it gets backported properly?

How about a "Fixes:" tag so that we know what commit id it fixes so we
know how far back to backport things?

And a hint to the maintainers that "this is an issue that needs to get
into 5.8-final, it shouldn't wait around longer please" would have also
been nice to see :)

And what chagned from v1, aren't you supposed to list that somewhere in
the changelog or below the --- line (never remember what DRM drivers
want here...)

Care to send a v3?

thanks,

greg k-h