Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Sat, 1 Feb 2020 08:56:12 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     syzbot <syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com>
Cc:     airlied@linux.ie, alexander.deucher@amd.com,
        amd-gfx@lists.freedesktop.org, chris@chris-wilson.co.uk,
        christian.koenig@amd.com, daniel@ffwll.ch, davem@davemloft.net,
        dri-devel@lists.freedesktop.org, emil.velikov@collabora.com,
        eric@anholt.net, linaro-mm-sig@lists.linaro.org,
        linux-kernel@vger.kernel.org, linux-media@vger.kernel.org,
        netdev@vger.kernel.org, robdclark@chromium.org,
        seanpaul@chromium.org, sumit.semwal@linaro.org,
        syzkaller-bugs@googlegroups.com
Subject: Re: KASAN: use-after-free Read in vgem_gem_dumb_create
Message-ID: <20200201055612.GF1778@kadam>
References: <000000000000ae2f81059d7716b8@google.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <000000000000ae2f81059d7716b8@google.com>
User-Agent: Mutt/1.9.4 (2018-02-28)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

I don't totally understand the stack trace but I do see a double free
bug.

drivers/gpu/drm/vgem/vgem_drv.c
   186  static struct drm_gem_object *vgem_gem_create(struct drm_device *dev,
   187                                                struct drm_file *file,
   188                                                unsigned int *handle,
   189                                                unsigned long size)
   190  {
   191          struct drm_vgem_gem_object *obj;
   192          int ret;
   193  
   194          obj = __vgem_gem_create(dev, size);

obj->base.handle_count is zero.

   195          if (IS_ERR(obj))
   196                  return ERR_CAST(obj);
   197  
   198          ret = drm_gem_handle_create(file, &obj->base, handle);

We bump it +1 and then the error handling calls
drm_gem_object_handle_put_unlocked(obj);
which calls drm_gem_object_put_unlocked(); which frees obj.


   199          drm_gem_object_put_unlocked(&obj->base);

So this is a double free.  Could someone check my thinking and send
a patch?  It's just a one liner.  Otherwise I can send it on Monday.

   200          if (ret)
   201                  return ERR_PTR(ret);
   202  
   203          return &obj->base;
   204  }

regards,
dan carpenter