* [PATCH] drm: Fix possible memleak and UAF in drm_addmap_core()
@ 2022-11-24 1:02 Gaosheng Cui
2022-11-25 14:24 ` Stanislaw Gruszka
0 siblings, 1 reply; 2+ messages in thread
From: Gaosheng Cui @ 2022-11-24 1:02 UTC (permalink / raw)
To: maarten.lankhorst, mripard, tzimmermann, airlied, daniel, chris,
alexander.deucher, airlied, cuigaosheng1
Cc: dri-devel
The dma_free_coherent() should be called when memory fails to
be allocated for list, or drm_map_handle() fails, otherwise there
will be a memory leak, so add dma_free_coherent to fix it.
In addition, if drm_map_handle() fails in drm_addmap_core(), list
will be freed, but list->head will not be removed from dev->map_list,
then list traversal may cause UAF, fix it by removeing it from
dev->map_list before kfree().
Fixes: 8e4ff9b56957 ("drm: Remove the dma_alloc_coherent wrapper for internal usage")
Fixes: 8d153f7107ff ("drm: update user token hashing and map handles")
Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
---
drivers/gpu/drm/drm_bufs.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/drm_bufs.c b/drivers/gpu/drm/drm_bufs.c
index fcca21e8efac..3b9563194715 100644
--- a/drivers/gpu/drm/drm_bufs.c
+++ b/drivers/gpu/drm/drm_bufs.c
@@ -344,6 +344,8 @@ static int drm_addmap_core(struct drm_device *dev, resource_size_t offset,
if (!list) {
if (map->type == _DRM_REGISTERS)
iounmap(map->handle);
+ if (map->type == _DRM_CONSISTENT)
+ dma_free_coherent(dev->dev, map->size, map->handle, map->offset);
kfree(map);
return -EINVAL;
}
@@ -361,7 +363,10 @@ static int drm_addmap_core(struct drm_device *dev, resource_size_t offset,
if (ret) {
if (map->type == _DRM_REGISTERS)
iounmap(map->handle);
+ if (map->type == _DRM_CONSISTENT)
+ dma_free_coherent(dev->dev, map->size, map->handle, map->offset);
kfree(map);
+ list_del(&list->head);
kfree(list);
mutex_unlock(&dev->struct_mutex);
return ret;
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] drm: Fix possible memleak and UAF in drm_addmap_core()
2022-11-24 1:02 [PATCH] drm: Fix possible memleak and UAF in drm_addmap_core() Gaosheng Cui
@ 2022-11-25 14:24 ` Stanislaw Gruszka
0 siblings, 0 replies; 2+ messages in thread
From: Stanislaw Gruszka @ 2022-11-25 14:24 UTC (permalink / raw)
To: Gaosheng Cui; +Cc: tzimmermann, airlied, chris, dri-devel, alexander.deucher
On Thu, Nov 24, 2022 at 09:02:19AM +0800, Gaosheng Cui wrote:
> The dma_free_coherent() should be called when memory fails to
> be allocated for list, or drm_map_handle() fails, otherwise there
> will be a memory leak, so add dma_free_coherent to fix it.
>
> In addition, if drm_map_handle() fails in drm_addmap_core(), list
> will be freed, but list->head will not be removed from dev->map_list,
> then list traversal may cause UAF, fix it by removeing it from
> dev->map_list before kfree().
>
> Fixes: 8e4ff9b56957 ("drm: Remove the dma_alloc_coherent wrapper for internal usage")
> Fixes: 8d153f7107ff ("drm: update user token hashing and map handles")
> Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
Reviewed-by: Stanislaw Gruszka <stanislaw.gruszka@linux.intel.com>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2022-11-25 14:24 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-11-24 1:02 [PATCH] drm: Fix possible memleak and UAF in drm_addmap_core() Gaosheng Cui
2022-11-25 14:24 ` Stanislaw Gruszka
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.