[PATCH] drm/i915/gvt: Fix orphan vgpu dmabuf_objs' lifetime

[Zhenyu Wang]

On 2/25/2020 1:35 PM, Tina Zhang wrote:
> Deleting dmabuf item's list head after releasing its container can lead
> to KASAN-reported issue:
>
>    BUG: KASAN: use-after-free in __list_del_entry_valid+0x15/0xf0
>    Read of size 8 at addr ffff88818a4598a8 by task kworker/u8:3/13119
>
> So fix this issue by puting deleting dmabuf_objs ahead of releasing its
> container.
>
> Fixes: dfb6ae4e14bd6 ("drm/i915/gvt: Handle orphan dmabuf_objs")
> Signed-off-by: Tina Zhang <tina.zhang at intel.com>
> ---
>   drivers/gpu/drm/i915/gvt/dmabuf.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/gvt/dmabuf.c b/drivers/gpu/drm/i915/gvt/dmabuf.c
> index b854bd243e11..526ae0a0b66e 100644
> --- a/drivers/gpu/drm/i915/gvt/dmabuf.c
> +++ b/drivers/gpu/drm/i915/gvt/dmabuf.c
> @@ -151,12 +151,12 @@ static void dmabuf_gem_object_free(struct kref *kref)
>   			dmabuf_obj = container_of(pos,
>   					struct intel_vgpu_dmabuf_obj, list);
>   			if (dmabuf_obj == obj) {
> +				list_del(pos);
>   				intel_gvt_hypervisor_put_vfio_device(vgpu);
>   				idr_remove(&vgpu->object_idr,
>   					   dmabuf_obj->dmabuf_id);
>   				kfree(dmabuf_obj->info);
>   				kfree(dmabuf_obj);
> -				list_del(pos);
>   				break;
>   			}
>   		}

Reviewed-by: Zhenyu Wang <zhenyuw at linux.intel.com>

thanks