A use-after-free in drm_gem_open_ioctl can happen if the GEM object handle is closed between the idr lookup and retrieving the size from said object since a local reference is not being held at that point. Hold the local reference while the object can still be accessed to fix this and plug the potential security hole.
Signed-off-by: Steve Cohen cohens@codeaurora.org --- drivers/gpu/drm/drm_gem.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 7bf628e..ee2058a 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data, * @file_priv: drm file-private structure * * Open an object using the global name, returning a handle and the size. - * - * This handle (of course) holds a reference to the object, so the object - * will not go away until the handle is deleted. */ int drm_gem_open_ioctl(struct drm_device *dev, void *data, @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
/* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ ret = drm_gem_handle_create_tail(file_priv, obj, &handle); - drm_gem_object_put_unlocked(obj); if (ret) - return ret; + goto err;
args->handle = handle; args->size = obj->size;
- return 0; +err: + drm_gem_object_put_unlocked(obj); + return ret; }
/**
On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote:
A use-after-free in drm_gem_open_ioctl can happen if the GEM object handle is closed between the idr lookup and retrieving the size from said object since a local reference is not being held at that point. Hold the local reference while the object can still be accessed to fix this and plug the potential security hole.
Signed-off-by: Steve Cohen cohens@codeaurora.org
drivers/gpu/drm/drm_gem.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 7bf628e..ee2058a 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
- @file_priv: drm file-private structure
- Open an object using the global name, returning a handle and the size.
- This handle (of course) holds a reference to the object, so the object
*/
- will not go away until the handle is deleted.
int drm_gem_open_ioctl(struct drm_device *dev, void *data, @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
/* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
- drm_gem_object_put_unlocked(obj); if (ret)
return ret;
goto err;args->handle = handle; args->size = obj->size;
- return 0;
+err:
- drm_gem_object_put_unlocked(obj);
- return ret;
}
/**
As this seems to fix an important issue, any reason it wasn't cc: stable on it so that it gets backported properly?
How about a "Fixes:" tag so that we know what commit id it fixes so we know how far back to backport things?
And a hint to the maintainers that "this is an issue that needs to get into 5.8-final, it shouldn't wait around longer please" would have also been nice to see :)
And what chagned from v1, aren't you supposed to list that somewhere in the changelog or below the --- line (never remember what DRM drivers want here...)
Care to send a v3?
thanks,
greg k-h
On Mon, Jul 27, 2020 at 09:55:07PM +0200, Greg KH wrote:
On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote:
A use-after-free in drm_gem_open_ioctl can happen if the GEM object handle is closed between the idr lookup and retrieving the size from said object since a local reference is not being held at that point. Hold the local reference while the object can still be accessed to fix this and plug the potential security hole.
Signed-off-by: Steve Cohen cohens@codeaurora.org
drivers/gpu/drm/drm_gem.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 7bf628e..ee2058a 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
- @file_priv: drm file-private structure
- Open an object using the global name, returning a handle and the size.
- This handle (of course) holds a reference to the object, so the object
*/
- will not go away until the handle is deleted.
int drm_gem_open_ioctl(struct drm_device *dev, void *data, @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
/* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
- drm_gem_object_put_unlocked(obj); if (ret)
return ret;
goto err;args->handle = handle; args->size = obj->size;
- return 0;
+err:
- drm_gem_object_put_unlocked(obj);
- return ret;
}
/**
As this seems to fix an important issue, any reason it wasn't cc: stable on it so that it gets backported properly?
How about a "Fixes:" tag so that we know what commit id it fixes so we know how far back to backport things?
And a hint to the maintainers that "this is an issue that needs to get into 5.8-final, it shouldn't wait around longer please" would have also been nice to see :)
And what chagned from v1, aren't you supposed to list that somewhere in the changelog or below the --- line (never remember what DRM drivers want here...)
Care to send a v3?
Don't worry, I'm pushing this to drm-misc-fixes now, should still make it to 5.8. Plus cc: stable. I didn't bother with Fixes: since I think the bug is rather old. Also, worst case you leak 32bit of some kernel memory that got reused already (but yeah I know that's often enough to get the foot in somewhere nasty and crack the door open).
I think it fell through cracks because Sam said he'll apply, guess that didn't happen.
Also yes a changelog, somewhere, for next time around. -Daniel
thanks,
greg k-h
On 2020-07-27 16:11, daniel@ffwll.ch wrote:
On Mon, Jul 27, 2020 at 09:55:07PM +0200, Greg KH wrote:
On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote:
A use-after-free in drm_gem_open_ioctl can happen if the GEM object handle is closed between the idr lookup and retrieving the size from said object since a local reference is not being held at that point. Hold the local reference while the object can still be accessed to fix this and plug the potential security hole.
Signed-off-by: Steve Cohen cohens@codeaurora.org
drivers/gpu/drm/drm_gem.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 7bf628e..ee2058a 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
- @file_priv: drm file-private structure
- Open an object using the global name, returning a handle and the size.
- This handle (of course) holds a reference to the object, so the object
*/
- will not go away until the handle is deleted.
int drm_gem_open_ioctl(struct drm_device *dev, void *data, @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
/* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
- drm_gem_object_put_unlocked(obj); if (ret)
return ret;
goto err;args->handle = handle; args->size = obj->size;
- return 0;
+err:
- drm_gem_object_put_unlocked(obj);
- return ret;
}
/**
As this seems to fix an important issue, any reason it wasn't cc: stable on it so that it gets backported properly?
How about a "Fixes:" tag so that we know what commit id it fixes so we know how far back to backport things?
And a hint to the maintainers that "this is an issue that needs to get into 5.8-final, it shouldn't wait around longer please" would have also been nice to see :)
And what chagned from v1, aren't you supposed to list that somewhere in the changelog or below the --- line (never remember what DRM drivers want here...)
Care to send a v3?
Don't worry, I'm pushing this to drm-misc-fixes now, should still make it to 5.8. Plus cc: stable. I didn't bother with Fixes: since I think the bug is rather old. Also, worst case you leak 32bit of some kernel memory that got reused already (but yeah I know that's often enough to get the foot in somewhere nasty and crack the door open).
I think it fell through cracks because Sam said he'll apply, guess that didn't happen.
Sam added his Reviewed-By on V1 with a comment to rename the goto label, but in V2 I also updated the API documentation and the commit text for a more complete change and thought he would re-add the tag.
Also yes a changelog, somewhere, for next time around.
Apologies, it won't happen again. Should I still submit a V3? It looks like you've got Greg's concerns covered.
-Steve
-Daniel
thanks,
greg k-h
On Mon, Jul 27, 2020 at 05:54:59PM -0400, cohens@codeaurora.org wrote:
On 2020-07-27 16:11, daniel@ffwll.ch wrote:
On Mon, Jul 27, 2020 at 09:55:07PM +0200, Greg KH wrote:
On Mon, Jul 20, 2020 at 06:30:50PM -0400, Steve Cohen wrote:
A use-after-free in drm_gem_open_ioctl can happen if the GEM object handle is closed between the idr lookup and retrieving the size from said object since a local reference is not being held at that point. Hold the local reference while the object can still be accessed to fix this and plug the potential security hole.
Signed-off-by: Steve Cohen cohens@codeaurora.org
drivers/gpu/drm/drm_gem.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 7bf628e..ee2058a 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
- @file_priv: drm file-private structure
- Open an object using the global name, returning a handle and the size.
- This handle (of course) holds a reference to the object, so the object
*/
- will not go away until the handle is deleted.
int drm_gem_open_ioctl(struct drm_device *dev, void *data, @@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
/* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
- drm_gem_object_put_unlocked(obj); if (ret)
return ret;
goto err;args->handle = handle; args->size = obj->size;
- return 0;
+err:
- drm_gem_object_put_unlocked(obj);
- return ret;
}
/**
As this seems to fix an important issue, any reason it wasn't cc: stable on it so that it gets backported properly?
How about a "Fixes:" tag so that we know what commit id it fixes so we know how far back to backport things?
And a hint to the maintainers that "this is an issue that needs to get into 5.8-final, it shouldn't wait around longer please" would have also been nice to see :)
And what chagned from v1, aren't you supposed to list that somewhere in the changelog or below the --- line (never remember what DRM drivers want here...)
Care to send a v3?
Don't worry, I'm pushing this to drm-misc-fixes now, should still make it to 5.8. Plus cc: stable. I didn't bother with Fixes: since I think the bug is rather old. Also, worst case you leak 32bit of some kernel memory that got reused already (but yeah I know that's often enough to get the foot in somewhere nasty and crack the door open).
I think it fell through cracks because Sam said he'll apply, guess that didn't happen.
Sam added his Reviewed-By on V1 with a comment to rename the goto label, but in V2 I also updated the API documentation and the commit text for a more complete change and thought he would re-add the tag.
Also yes a changelog, somewhere, for next time around.
Apologies, it won't happen again. Should I still submit a V3? It looks like you've got Greg's concerns covered.
Uh no, but we need another patch to re-add the kerneldoc you deleted. I missed that when merging your patch. Also that's kinda what patch changelogs are for, for blind reviewers like me :-) -Daniel
-Steve
-Daniel
thanks,
greg k-h
dri-devel@lists.freedesktop.org
-
cohens＠codeaurora.org -
daniel＠ffwll.ch -
Greg KH -
Steve Cohen