From: Dan Carpenter <dan.carpenter@oracle.com>
To: Hillf Danton <hdanton@sina.com>
Cc: robdclark@chromium.org, daniel@ffwll.ch, davem@davemloft.net,
airlied@linux.ie, netdev@vger.kernel.org,
syzkaller-bugs@googlegroups.com, linux-kernel@vger.kernel.org,
amd-gfx@lists.freedesktop.org, chris@chris-wilson.co.uk,
linaro-mm-sig@lists.linaro.org, eric@anholt.net,
seanpaul@chromium.org, dri-devel@lists.freedesktop.org,
syzbot <syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com>,
alexander.deucher@amd.com, linux-media@vger.kernel.org,
sumit.semwal@linaro.org, christian.koenig@amd.com,
emil.velikov@collabora.com
Subject: Re: KASAN: use-after-free Read in vgem_gem_dumb_create
Date: Sat, 1 Feb 2020 19:25:37 +0300 [thread overview]
Message-ID: <20200201162537.GK1778@kadam> (raw)
In-Reply-To: <20200201090247.10928-1-hdanton@sina.com>
On Sat, Feb 01, 2020 at 05:02:47PM +0800, Hillf Danton wrote:
>
> On Sat, 1 Feb 2020 09:17:57 +0300 Dan Carpenter wrote:
> > On Sat, Feb 01, 2020 at 12:32:09PM +0800, Hillf Danton wrote:
> > >
> > > Release obj in error path.
> > >
> > > --- a/drivers/gpu/drm/vgem/vgem_drv.c
> > > +++ b/drivers/gpu/drm/vgem/vgem_drv.c
> > > @@ -196,10 +196,10 @@ static struct drm_gem_object *vgem_gem_c
> > > return ERR_CAST(obj);
> > >
> > > ret = drm_gem_handle_create(file, &obj->base, handle);
> > > - drm_gem_object_put_unlocked(&obj->base);
> > > - if (ret)
> > > + if (ret) {
> > > + drm_gem_object_put_unlocked(&obj->base);
> > > return ERR_PTR(ret);
> > > -
> > > + }
> > > return &obj->base;
> >
> > Oh yeah. It's weird that we never noticed the success path was broken.
> > It's been that way for three years and no one noticed at all. Very
> > strange.
> >
> > Anyway, it already gets freed on error in drm_gem_handle_create() so
> > we should just delete the drm_gem_object_put_unlocked() here it looks
> > like.
>
> Good catch, Dan :P
> Would you please post a patch sometime convenient next week?
Sure. Will do.
regards,
dan carpenter
_______________________________________________
amd-gfx mailing list
amd-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/amd-gfx
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Hillf Danton <hdanton@sina.com>
Cc: robdclark@chromium.org, davem@davemloft.net, airlied@linux.ie,
netdev@vger.kernel.org, syzkaller-bugs@googlegroups.com,
linux-kernel@vger.kernel.org, amd-gfx@lists.freedesktop.org,
linaro-mm-sig@lists.linaro.org, seanpaul@chromium.org,
dri-devel@lists.freedesktop.org,
syzbot <syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com>,
alexander.deucher@amd.com, linux-media@vger.kernel.org,
christian.koenig@amd.com, emil.velikov@collabora.com
Subject: Re: KASAN: use-after-free Read in vgem_gem_dumb_create
Date: Sat, 1 Feb 2020 19:25:37 +0300 [thread overview]
Message-ID: <20200201162537.GK1778@kadam> (raw)
In-Reply-To: <20200201090247.10928-1-hdanton@sina.com>
On Sat, Feb 01, 2020 at 05:02:47PM +0800, Hillf Danton wrote:
>
> On Sat, 1 Feb 2020 09:17:57 +0300 Dan Carpenter wrote:
> > On Sat, Feb 01, 2020 at 12:32:09PM +0800, Hillf Danton wrote:
> > >
> > > Release obj in error path.
> > >
> > > --- a/drivers/gpu/drm/vgem/vgem_drv.c
> > > +++ b/drivers/gpu/drm/vgem/vgem_drv.c
> > > @@ -196,10 +196,10 @@ static struct drm_gem_object *vgem_gem_c
> > > return ERR_CAST(obj);
> > >
> > > ret = drm_gem_handle_create(file, &obj->base, handle);
> > > - drm_gem_object_put_unlocked(&obj->base);
> > > - if (ret)
> > > + if (ret) {
> > > + drm_gem_object_put_unlocked(&obj->base);
> > > return ERR_PTR(ret);
> > > -
> > > + }
> > > return &obj->base;
> >
> > Oh yeah. It's weird that we never noticed the success path was broken.
> > It's been that way for three years and no one noticed at all. Very
> > strange.
> >
> > Anyway, it already gets freed on error in drm_gem_handle_create() so
> > we should just delete the drm_gem_object_put_unlocked() here it looks
> > like.
>
> Good catch, Dan :P
> Would you please post a patch sometime convenient next week?
Sure. Will do.
regards,
dan carpenter
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Hillf Danton <hdanton@sina.com>
Cc: syzbot <syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com>,
airlied@linux.ie, alexander.deucher@amd.com,
amd-gfx@lists.freedesktop.org, chris@chris-wilson.co.uk,
christian.koenig@amd.com, daniel@ffwll.ch, davem@davemloft.net,
dri-devel@lists.freedesktop.org, emil.velikov@collabora.com,
eric@anholt.net, linaro-mm-sig@lists.linaro.org,
linux-kernel@vger.kernel.org, linux-media@vger.kernel.org,
netdev@vger.kernel.org, robdclark@chromium.org,
seanpaul@chromium.org, sumit.semwal@linaro.org,
syzkaller-bugs@googlegroups.com
Subject: Re: KASAN: use-after-free Read in vgem_gem_dumb_create
Date: Sat, 1 Feb 2020 19:25:37 +0300 [thread overview]
Message-ID: <20200201162537.GK1778@kadam> (raw)
In-Reply-To: <20200201090247.10928-1-hdanton@sina.com>
On Sat, Feb 01, 2020 at 05:02:47PM +0800, Hillf Danton wrote:
>
> On Sat, 1 Feb 2020 09:17:57 +0300 Dan Carpenter wrote:
> > On Sat, Feb 01, 2020 at 12:32:09PM +0800, Hillf Danton wrote:
> > >
> > > Release obj in error path.
> > >
> > > --- a/drivers/gpu/drm/vgem/vgem_drv.c
> > > +++ b/drivers/gpu/drm/vgem/vgem_drv.c
> > > @@ -196,10 +196,10 @@ static struct drm_gem_object *vgem_gem_c
> > > return ERR_CAST(obj);
> > >
> > > ret = drm_gem_handle_create(file, &obj->base, handle);
> > > - drm_gem_object_put_unlocked(&obj->base);
> > > - if (ret)
> > > + if (ret) {
> > > + drm_gem_object_put_unlocked(&obj->base);
> > > return ERR_PTR(ret);
> > > -
> > > + }
> > > return &obj->base;
> >
> > Oh yeah. It's weird that we never noticed the success path was broken.
> > It's been that way for three years and no one noticed at all. Very
> > strange.
> >
> > Anyway, it already gets freed on error in drm_gem_handle_create() so
> > we should just delete the drm_gem_object_put_unlocked() here it looks
> > like.
>
> Good catch, Dan :P
> Would you please post a patch sometime convenient next week?
Sure. Will do.
regards,
dan carpenter
next prev parent reply other threads:[~2020-02-01 16:26 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-01 4:32 KASAN: use-after-free Read in vgem_gem_dumb_create Hillf Danton
2020-02-01 4:32 ` Hillf Danton
2020-02-01 6:17 ` Dan Carpenter
2020-02-01 6:17 ` Dan Carpenter
2020-02-01 6:17 ` Dan Carpenter
2020-02-01 9:02 ` Hillf Danton
2020-02-01 9:02 ` Hillf Danton
2020-02-01 16:25 ` Dan Carpenter [this message]
2020-02-01 16:25 ` Dan Carpenter
2020-02-01 16:25 ` Dan Carpenter
2020-02-02 13:17 ` Daniel Vetter
2020-02-02 13:17 ` Daniel Vetter
2020-02-02 13:17 ` Daniel Vetter
-- strict thread matches above, loose matches on Subject: below --
2020-01-31 22:28 syzbot
2020-01-31 22:28 ` syzbot
2020-01-31 22:28 ` syzbot
2020-02-01 5:56 ` Dan Carpenter
2020-02-01 5:56 ` Dan Carpenter
2020-02-01 5:56 ` Dan Carpenter
2020-02-02 4:38 ` syzbot
2020-02-02 4:38 ` syzbot
2020-02-02 4:38 ` syzbot
2020-02-02 13:19 ` Daniel Vetter
2020-02-02 13:19 ` Daniel Vetter
2020-02-02 13:19 ` Daniel Vetter
2020-02-03 9:06 ` Dan Carpenter
2020-02-03 9:06 ` Dan Carpenter
2020-02-03 9:06 ` Dan Carpenter
2020-02-03 15:08 ` Christian König
2020-02-03 15:08 ` Christian König
2020-02-03 15:08 ` Christian König
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200201162537.GK1778@kadam \
--to=dan.carpenter@oracle.com \
--cc=airlied@linux.ie \
--cc=alexander.deucher@amd.com \
--cc=amd-gfx@lists.freedesktop.org \
--cc=chris@chris-wilson.co.uk \
--cc=christian.koenig@amd.com \
--cc=daniel@ffwll.ch \
--cc=davem@davemloft.net \
--cc=dri-devel@lists.freedesktop.org \
--cc=emil.velikov@collabora.com \
--cc=eric@anholt.net \
--cc=hdanton@sina.com \
--cc=linaro-mm-sig@lists.linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=robdclark@chromium.org \
--cc=seanpaul@chromium.org \
--cc=sumit.semwal@linaro.org \
--cc=syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.