All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dan Carpenter <dan.carpenter@oracle.com>
To: syzbot <syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com>
Cc: robdclark@chromium.org, davem@davemloft.net, airlied@linux.ie,
	netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com,
	linux-kernel@vger.kernel.org, amd-gfx@lists.freedesktop.org,
	chris@chris-wilson.co.uk, linaro-mm-sig@lists.linaro.org,
	eric@anholt.net, seanpaul@chromium.org,
	dri-devel@lists.freedesktop.org, daniel@ffwll.ch,
	alexander.deucher@amd.com, linux-media@vger.kernel.org,
	sumit.semwal@linaro.org, christian.koenig@amd.com,
	emil.velikov@collabora.com
Subject: Re: KASAN: use-after-free Read in vgem_gem_dumb_create
Date: Sat, 1 Feb 2020 08:56:12 +0300	[thread overview]
Message-ID: <20200201055612.GF1778@kadam> (raw)
In-Reply-To: <000000000000ae2f81059d7716b8@google.com>

I don't totally understand the stack trace but I do see a double free
bug.

drivers/gpu/drm/vgem/vgem_drv.c
   186  static struct drm_gem_object *vgem_gem_create(struct drm_device *dev,
   187                                                struct drm_file *file,
   188                                                unsigned int *handle,
   189                                                unsigned long size)
   190  {
   191          struct drm_vgem_gem_object *obj;
   192          int ret;
   193  
   194          obj = __vgem_gem_create(dev, size);

obj->base.handle_count is zero.

   195          if (IS_ERR(obj))
   196                  return ERR_CAST(obj);
   197  
   198          ret = drm_gem_handle_create(file, &obj->base, handle);

We bump it +1 and then the error handling calls
drm_gem_object_handle_put_unlocked(obj);
which calls drm_gem_object_put_unlocked(); which frees obj.


   199          drm_gem_object_put_unlocked(&obj->base);

So this is a double free.  Could someone check my thinking and send
a patch?  It's just a one liner.  Otherwise I can send it on Monday.

   200          if (ret)
   201                  return ERR_PTR(ret);
   202  
   203          return &obj->base;
   204  }

regards,
dan carpenter
_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx

WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: syzbot <syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com>
Cc: robdclark@chromium.org, davem@davemloft.net, airlied@linux.ie,
	netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com,
	linux-kernel@vger.kernel.org, amd-gfx@lists.freedesktop.org,
	linaro-mm-sig@lists.linaro.org, seanpaul@chromium.org,
	dri-devel@lists.freedesktop.org, alexander.deucher@amd.com,
	linux-media@vger.kernel.org, christian.koenig@amd.com,
	emil.velikov@collabora.com
Subject: Re: KASAN: use-after-free Read in vgem_gem_dumb_create
Date: Sat, 1 Feb 2020 08:56:12 +0300	[thread overview]
Message-ID: <20200201055612.GF1778@kadam> (raw)
In-Reply-To: <000000000000ae2f81059d7716b8@google.com>

I don't totally understand the stack trace but I do see a double free
bug.

drivers/gpu/drm/vgem/vgem_drv.c
   186  static struct drm_gem_object *vgem_gem_create(struct drm_device *dev,
   187                                                struct drm_file *file,
   188                                                unsigned int *handle,
   189                                                unsigned long size)
   190  {
   191          struct drm_vgem_gem_object *obj;
   192          int ret;
   193  
   194          obj = __vgem_gem_create(dev, size);

obj->base.handle_count is zero.

   195          if (IS_ERR(obj))
   196                  return ERR_CAST(obj);
   197  
   198          ret = drm_gem_handle_create(file, &obj->base, handle);

We bump it +1 and then the error handling calls
drm_gem_object_handle_put_unlocked(obj);
which calls drm_gem_object_put_unlocked(); which frees obj.


   199          drm_gem_object_put_unlocked(&obj->base);

So this is a double free.  Could someone check my thinking and send
a patch?  It's just a one liner.  Otherwise I can send it on Monday.

   200          if (ret)
   201                  return ERR_PTR(ret);
   202  
   203          return &obj->base;
   204  }

regards,
dan carpenter
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: syzbot <syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com>
Cc: airlied@linux.ie, alexander.deucher@amd.com,
	amd-gfx@lists.freedesktop.org, chris@chris-wilson.co.uk,
	christian.koenig@amd.com, daniel@ffwll.ch, davem@davemloft.net,
	dri-devel@lists.freedesktop.org, emil.velikov@collabora.com,
	eric@anholt.net, linaro-mm-sig@lists.linaro.org,
	linux-kernel@vger.kernel.org, linux-media@vger.kernel.org,
	netdev@vger.kernel.org, robdclark@chromium.org,
	seanpaul@chromium.org, sumit.semwal@linaro.org,
	syzkaller-bugs@googlegroups.com
Subject: Re: KASAN: use-after-free Read in vgem_gem_dumb_create
Date: Sat, 1 Feb 2020 08:56:12 +0300	[thread overview]
Message-ID: <20200201055612.GF1778@kadam> (raw)
In-Reply-To: <000000000000ae2f81059d7716b8@google.com>

I don't totally understand the stack trace but I do see a double free
bug.

drivers/gpu/drm/vgem/vgem_drv.c
   186  static struct drm_gem_object *vgem_gem_create(struct drm_device *dev,
   187                                                struct drm_file *file,
   188                                                unsigned int *handle,
   189                                                unsigned long size)
   190  {
   191          struct drm_vgem_gem_object *obj;
   192          int ret;
   193  
   194          obj = __vgem_gem_create(dev, size);

obj->base.handle_count is zero.

   195          if (IS_ERR(obj))
   196                  return ERR_CAST(obj);
   197  
   198          ret = drm_gem_handle_create(file, &obj->base, handle);

We bump it +1 and then the error handling calls
drm_gem_object_handle_put_unlocked(obj);
which calls drm_gem_object_put_unlocked(); which frees obj.


   199          drm_gem_object_put_unlocked(&obj->base);

So this is a double free.  Could someone check my thinking and send
a patch?  It's just a one liner.  Otherwise I can send it on Monday.

   200          if (ret)
   201                  return ERR_PTR(ret);
   202  
   203          return &obj->base;
   204  }

regards,
dan carpenter

  reply	other threads:[~2020-02-01  5:57 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-01-31 22:28 KASAN: use-after-free Read in vgem_gem_dumb_create syzbot
2020-01-31 22:28 ` syzbot
2020-01-31 22:28 ` syzbot
2020-02-01  5:56 ` Dan Carpenter [this message]
2020-02-01  5:56   ` Dan Carpenter
2020-02-01  5:56   ` Dan Carpenter
2020-02-02  4:38 ` syzbot
2020-02-02  4:38   ` syzbot
2020-02-02  4:38   ` syzbot
2020-02-02 13:19 ` Daniel Vetter
2020-02-02 13:19   ` Daniel Vetter
2020-02-02 13:19   ` Daniel Vetter
2020-02-03  9:06   ` Dan Carpenter
2020-02-03  9:06     ` Dan Carpenter
2020-02-03  9:06     ` Dan Carpenter
2020-02-03 15:08     ` Christian König
2020-02-03 15:08       ` Christian König
2020-02-03 15:08       ` Christian König
  -- strict thread matches above, loose matches on Subject: below --
2020-02-01  4:32 Hillf Danton
2020-02-01  4:32 ` Hillf Danton
2020-02-01  6:17 ` Dan Carpenter
2020-02-01  6:17   ` Dan Carpenter
2020-02-01  6:17   ` Dan Carpenter
2020-02-01  9:02 ` Hillf Danton
2020-02-01  9:02   ` Hillf Danton
2020-02-01 16:25   ` Dan Carpenter
2020-02-01 16:25     ` Dan Carpenter
2020-02-01 16:25     ` Dan Carpenter
2020-02-02 13:17     ` Daniel Vetter
2020-02-02 13:17       ` Daniel Vetter
2020-02-02 13:17       ` Daniel Vetter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200201055612.GF1778@kadam \
    --to=dan.carpenter@oracle.com \
    --cc=airlied@linux.ie \
    --cc=alexander.deucher@amd.com \
    --cc=amd-gfx@lists.freedesktop.org \
    --cc=chris@chris-wilson.co.uk \
    --cc=christian.koenig@amd.com \
    --cc=daniel@ffwll.ch \
    --cc=davem@davemloft.net \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=emil.velikov@collabora.com \
    --cc=eric@anholt.net \
    --cc=linaro-mm-sig@lists.linaro.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-media@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=robdclark@chromium.org \
    --cc=seanpaul@chromium.org \
    --cc=sumit.semwal@linaro.org \
    --cc=syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.