This is a note to let you know that I've just added the patch titled

drm/syncobj: Fix use-after-free

to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summ...

The filename of the patch is: drm-syncobj-fix-use-after-free.patch and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let stable@vger.kernel.org know about it.

From a37eef63bc9e16e06361b539e528058146af80ab Mon Sep 17 00:00:00 2001

From: Daniel Vetter daniel.vetter@ffwll.ch Date: Tue, 19 Jan 2021 14:03:18 +0100 Subject: drm/syncobj: Fix use-after-free MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit

From: Daniel Vetter daniel.vetter@ffwll.ch

commit a37eef63bc9e16e06361b539e528058146af80ab upstream.

While reviewing Christian's annotation patch I noticed that we have a user-after-free for the WAIT_FOR_SUBMIT case: We drop the syncobj reference before we've completed the waiting.

Of course usually there's nothing bad happening here since userspace keeps the reference, but we can't rely on userspace to play nice here!

Signed-off-by: Daniel Vetter daniel.vetter@intel.com Fixes: bc9c80fe01a2 ("drm/syncobj: use the timeline point in drm_syncobj_find_fence v4") Reviewed-by: Christian König christian.koenig@amd.com Cc: Christian König christian.koenig@amd.com Cc: Lionel Landwerlin lionel.g.landwerlin@intel.com Cc: Maarten Lankhorst maarten.lankhorst@linux.intel.com Cc: Maxime Ripard mripard@kernel.org Cc: Thomas Zimmermann tzimmermann@suse.de Cc: David Airlie airlied@linux.ie Cc: Daniel Vetter daniel@ffwll.ch Cc: dri-devel@lists.freedesktop.org Cc: stable@vger.kernel.org # v5.2+ Link: https://patchwork.freedesktop.org/patch/msgid/20210119130318.615145-1-daniel... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org

--- drivers/gpu/drm/drm_syncobj.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)

--- a/drivers/gpu/drm/drm_syncobj.c +++ b/drivers/gpu/drm/drm_syncobj.c @@ -388,19 +388,18 @@ int drm_syncobj_find_fence(struct drm_fi return -ENOENT;

*fence = drm_syncobj_fence_get(syncobj); - drm_syncobj_put(syncobj);

if (*fence) { ret = dma_fence_chain_find_seqno(fence, point); if (!ret) - return 0; + goto out; dma_fence_put(*fence); } else { ret = -EINVAL; }

if (!(flags & DRM_SYNCOBJ_WAIT_FLAGS_WAIT_FOR_SUBMIT)) - return ret; + goto out;

memset(&wait, 0, sizeof(wait)); wait.task = current; @@ -432,6 +431,9 @@ int drm_syncobj_find_fence(struct drm_fi if (wait.node.next) drm_syncobj_remove_wait(syncobj, &wait);

+out: + drm_syncobj_put(syncobj); + return ret; } EXPORT_SYMBOL(drm_syncobj_find_fence);

Patches currently in stable-queue which might be from daniel.vetter@ffwll.ch are

queue-5.10/drm-syncobj-fix-use-after-free.patch queue-5.10/drm-atomic-put-state-on-error-path.patch