Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Mon, 4 Mar 2019 20:24:40 -0300
From:   Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
To:     Eric Biggers <ebiggers@kernel.org>
Cc:     dri-devel@lists.freedesktop.org,
        Daniel Vetter <daniel.vetter@ffwll.ch>,
        syzkaller-bugs <syzkaller-bugs@googlegroups.com>,
        linux-kernel@vger.kernel.org, stable@vger.kernel.org,
        syzbot+e73f2fb5ed5a5df36d33@syzkaller.appspotmail.com
Subject: Re: [PATCH v2] drm/vgem: fix use-after-free when
 drm_gem_handle_create() fails
Message-ID: <20190304232440.epotc72sa5svclc2@smtp.gmail.com>
References: <20190226213053.GC218103@gmail.com>
 <20190226214451.195123-1-ebiggers@kernel.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
        protocol="application/pgp-signature"; boundary="il7sctba46rhcpoy"
Content-Disposition: inline
In-Reply-To: <20190226214451.195123-1-ebiggers@kernel.org>
User-Agent: NeoMutt/20180716
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk


--il7sctba46rhcpoy
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On 02/26, Eric Biggers wrote:
> From: Eric Biggers <ebiggers@google.com>
>=20
> If drm_gem_handle_create() fails in vgem_gem_create(), then the
> drm_vgem_gem_object is freed twice: once when the reference is dropped
> by drm_gem_object_put_unlocked(), and again by __vgem_gem_destroy().
>=20
> This was hit by syzkaller using fault injection.
>=20
> Fix it by skipping the second free.
>=20
> Reported-by: syzbot+e73f2fb5ed5a5df36d33@syzkaller.appspotmail.com
> Fixes: af33a9190d02 ("drm/vgem: Enable dmabuf import interfaces")
> Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Laura Abbott <labbott@redhat.com>
> Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
> Cc: stable@vger.kernel.org
> Signed-off-by: Eric Biggers <ebiggers@google.com>
> ---
>  drivers/gpu/drm/vgem/vgem_drv.c | 6 +-----
>  1 file changed, 1 insertion(+), 5 deletions(-)
>=20
> diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_=
drv.c
> index 5930facd6d2d8..11a8f99ba18c5 100644
> --- a/drivers/gpu/drm/vgem/vgem_drv.c
> +++ b/drivers/gpu/drm/vgem/vgem_drv.c
> @@ -191,13 +191,9 @@ static struct drm_gem_object *vgem_gem_create(struct=
 drm_device *dev,
>  	ret =3D drm_gem_handle_create(file, &obj->base, handle);
>  	drm_gem_object_put_unlocked(&obj->base);
>  	if (ret)
> -		goto err;
> +		return ERR_PTR(ret);
> =20
>  	return &obj->base;
> -
> -err:
> -	__vgem_gem_destroy(obj);
> -	return ERR_PTR(ret);
>  }
> =20
>  static int vgem_gem_dumb_create(struct drm_file *file, struct drm_device=
 *dev,
> --=20
> 2.21.0.rc2.261.ga7da99ff1b-goog
>=20
> _______________________________________________
> dri-devel mailing list
> dri-devel@lists.freedesktop.org
> https://lists.freedesktop.org/mailman/listinfo/dri-devel

Applied to drm-misc-fixes.

Thanks

--=20
Rodrigo Siqueira
https://siqueira.tech
Graduate Student
Department of Computer Science
University of S=E3o Paulo

--il7sctba46rhcpoy
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE4tZ+ii1mjMCMQbfkWJzP/comvP8FAlx9s7gACgkQWJzP/com
vP9+dA/+KaWJNQbLg0uAECcJbJqJQPDnLHqi6HbKeZee2w2kYKWz3qMZQn+7oZZV
mXgFvWeP3Wh6klIwqJltyDyWezjpK4OKp7YaXSzWPHUyVDOH5tj3bhul2ilknZAj
NhdhcRlBCY4Cxk9kPtJyTHRSUpZ/m5Mw5AYXPiuljY/Jlus7q6bgHlw+EBJtn/l/
Ov/KJbThDKC1H+B/234Ndmmqc00cR1aul+trmmzfZYelYoVz/JzQAYA7cD7jDOzk
+lEhUn2mptYHhvx+uuZZNXW0hAfTvBf62KNx+i1ELfb8GVwB9mgVBi5Q7lO/G9+X
yIUYrsfAl6BH16adRxPSCeCnqfFxZDppVylsMfvqbIGd37SFuS7ArGAELoXzrxRk
M0eCABM/o+6J2gtn7RzUg5E5yLXMb4MStc6J10N1WzPhSELhyPaxcvqTrVzTKWAX
d60jmTUSGQEQYPrRFRb7/EnuNAoghHs5KKq0clJ6hkGAdyc7mWIdqLqNGBuHXMea
NVU0EY6V2L6iYuz/Uf+vorTJfrEli2OstnN2YxahALRxIwTLxqyeJWPLGbPHiFJ+
uaqgSngT06gLeMl287z5iFAG9aEK64fWT/avUzRHoqdDHs8ErhmCAjA6lTfgOkqb
4yT0cyTFCJYk28UL5BIIv2/P3g43/IkGeIuVrEdIQrbZyBVT8tM=
=C2Dr
-----END PGP SIGNATURE-----

--il7sctba46rhcpoy--