[Freedreno] [PATCH V2] drm: hold gem reference until object is no longer accessed

[daniel at ffwll.ch]

On Mon, Jul 27, 2020 at 05:54:59PM -0400, cohens at codeaurora.org wrote:
> On 2020-07-27 16:11, daniel at ffwll.ch wrote:
> > On Mon, Jul 27, 2020 at 09:55:07PM +0200, Greg KH wrote:
> > > On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote:
> > > > A use-after-free in drm_gem_open_ioctl can happen if the
> > > > GEM object handle is closed between the idr lookup and
> > > > retrieving the size from said object since a local reference
> > > > is not being held at that point. Hold the local reference
> > > > while the object can still be accessed to fix this and
> > > > plug the potential security hole.
> > > >
> > > > Signed-off-by: Steve Cohen <cohens at codeaurora.org>
> > > > ---
> > > >  drivers/gpu/drm/drm_gem.c | 10 ++++------
> > > >  1 file changed, 4 insertions(+), 6 deletions(-)
> > > >
> > > > diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
> > > > index 7bf628e..ee2058a 100644
> > > > --- a/drivers/gpu/drm/drm_gem.c
> > > > +++ b/drivers/gpu/drm/drm_gem.c
> > > > @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
> > > >   * @file_priv: drm file-private structure
> > > >   *
> > > >   * Open an object using the global name, returning a handle and the size.
> > > > - *
> > > > - * This handle (of course) holds a reference to the object, so the object
> > > > - * will not go away until the handle is deleted.
> > > >   */
> > > >  int
> > > >  drm_gem_open_ioctl(struct drm_device *dev, void *data,
> > > > @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
> > > >
> > > >  	/* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
> > > >  	ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
> > > > -	drm_gem_object_put_unlocked(obj);
> > > >  	if (ret)
> > > > -		return ret;
> > > > +		goto err;
> > > >
> > > >  	args->handle = handle;
> > > >  	args->size = obj->size;
> > > >
> > > > -	return 0;
> > > > +err:
> > > > +	drm_gem_object_put_unlocked(obj);
> > > > +	return ret;
> > > >  }
> > > >
> > > >  /**
> > > 
> > > As this seems to fix an important issue, any reason it wasn't cc:
> > > stable
> > > on it so that it gets backported properly?
> > > 
> > > How about a "Fixes:" tag so that we know what commit id it fixes so we
> > > know how far back to backport things?
> > > 
> > > And a hint to the maintainers that "this is an issue that needs to get
> > > into 5.8-final, it shouldn't wait around longer please" would have
> > > also
> > > been nice to see :)
> > > 
> > > And what chagned from v1, aren't you supposed to list that somewhere
> > > in
> > > the changelog or below the --- line (never remember what DRM drivers
> > > want here...)
> > > 
> > > Care to send a v3?
> > 
> > Don't worry, I'm pushing this to drm-misc-fixes now, should still make
> > it
> > to 5.8. Plus cc: stable. I didn't bother with Fixes: since I think the
> > bug
> > is rather old. Also, worst case you leak 32bit of some kernel memory
> > that
> > got reused already (but yeah I know that's often enough to get the foot
> > in
> > somewhere nasty and crack the door open).
> > 
> > I think it fell through cracks because Sam said he'll apply, guess that
> > didn't happen.
> 
> Sam added his Reviewed-By on V1 with a comment to rename the goto label,
> but in V2 I also updated the API documentation and the commit text for
> a more complete change and thought he would re-add the tag.
> 
> > Also yes a changelog, somewhere, for next time around.
> 
> Apologies, it won't happen again. Should I still submit a V3?
> It looks like you've got Greg's concerns covered.

Uh no, but we need another patch to re-add the kerneldoc you deleted. I
missed that when merging your patch. Also that's kinda what patch
changelogs are for, for blind reviewers like me :-)
-Daniel

> 
> -Steve
> 
> > -Daniel
> > 
> > 
> > > 
> > > thanks,
> > > 
> > > greg k-h

-- 
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch