Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <CANX2M5Ysmgv1b4toRxeTDiKtpJyv_-dTqsRediqd8NbT=RKObQ@mail.gmail.com>
In-Reply-To: <CANX2M5Ysmgv1b4toRxeTDiKtpJyv_-dTqsRediqd8NbT=RKObQ@mail.gmail.com>
From:   Dipanjan Das <mail.dipanjan.das@gmail.com>
Date:   Tue, 2 Aug 2022 12:02:51 -0700
Message-ID: <CANX2M5Z2LzD_Z6qgq9Avv3hygQ7LJNX+KyZOK6_5d-KZRNwfCg@mail.gmail.com>
Subject: Re: KASAN: use-after-free Read in drm_gem_object_release
To:     maarten.lankhorst@linux.intel.com, mripard@kernel.org,
        sean@poorly.run, airlied@linux.ie, daniel@ffwll.ch,
        dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Cc:     syzkaller@googlegroups.com, fleischermarius@googlemail.com,
        its.priyanka.bose@gmail.com
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Fri, Jul 22, 2022 at 9:23 AM Dipanjan Das
<mail.dipanjan.das@gmail.com> wrote:
> ======================================================
> description: KASAN: use-after-free Read in drm_gem_object_release
> affected file: drivers/gpu/drm/drm_gem.c
> kernel version: 5.4.206
> kernel commit: 981f87403bb9841f1e0b7953e12a51f09a47a4f0
> git tree: upstream
> kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=1aab6d4187ddf667
> crash reproducer: attached
> ======================================================
> Crash log:
> ======================================================
> BUG: KASAN: use-after-free in drm_gem_object_release+0xf7/0x120
> drivers/gpu/drm/drm_gem.c:952
> ==================================================================
> BUG: KASAN: double-free or invalid-free in
> drm_gem_vram_create+0x1b7/0x1f0
> drivers/gpu/drm/drm_gem_vram_helper.c:142

We did an initial analysis for this bug and figured out the following:

If ttm_bo_init_reserved() fails, the `gbo` and `gbo->bo.base` will be
freed by ttm_buffer_object_destroy(). But then drm_gem_vram_create()
and drm_gem_vram_init() will attempt to free `gbo` and `gbo->bo.base`
again. This will result in UAF and Double Free. A similar bug (the
stack traces were a bit different) has been patched by this upstream
commit: https://github.com/torvalds/linux/commit/da62cb7230f0871c30dc9789071f63229158d261.
We applied this patch and can confirm that the repro does not trigger
the issue anymore.

-- 
Thanks and Regards,

Dipanjan