[Intel-gfx] [PATCH] drm/i915/gvt: fix double-free bug in split_2MB_gtt_entry.

[Zheng Hacker]

Hello everyone,

I'm Zheng Wang. I found a potential double-free bug
in drivers/gpu/drm/i915/gvt/gtt.c. I haven't been replied for a long time.
So I decided to send it to more relavent supporters and developers to help
to solve the problem.

Best regards,
Zheng Wang.

xmzyshypnc <1002992920 at qq.com> 于2022年9月4日周日 20:32写道：

> There is a double-free security bug in split_2MB_gtt_entry.
>
> Here is a calling chain :
> ppgtt_populate_spt->ppgtt_populate_shadow_entry->split_2MB_gtt_entry. If
> intel_gvt_dma_map_guest_page failed, it will call  ppgtt_invalidate_spt,
> which will finally call ppgtt_free_spt and kfree(spt). But the caller does
> not notice that, and it will call ppgtt_free_spt again in error path.
>
> Fix this by returning the result of ppgtt_invalidate_spt to
> split_2MB_gtt_entry.
>
> Signed-off-by: Zheng Wang <1002992920 at qq.com>
> ---
>  drivers/gpu/drm/i915/gvt/gtt.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/gvt/gtt.c
> b/drivers/gpu/drm/i915/gvt/gtt.c
> index ce0eb03709c3..9f14fded8c0c 100644
> --- a/drivers/gpu/drm/i915/gvt/gtt.c
> +++ b/drivers/gpu/drm/i915/gvt/gtt.c
> @@ -1215,7 +1215,7 @@ static int split_2MB_gtt_entry(struct intel_vgpu
> *vgpu,
>                 ret = intel_gvt_dma_map_guest_page(vgpu, start_gfn +
> sub_index,
>                                                    PAGE_SIZE, &dma_addr);
>                 if (ret) {
> -                       ppgtt_invalidate_spt(spt);
> +                       ret = ppgtt_invalidate_spt(spt);
>                         return ret;
>                 }
>                 sub_se.val64 = se->val64;
> --
> 2.25.1
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/intel-gfx/attachments/20220905/9104f91e/attachment-0001.htm>