[PATCH] accel/rocket: Fix use-after-free in rocket_ioctl_create_bo()

[PATCH] accel/rocket: Fix use-after-free in rocket_ioctl_create_bo()

[Wentao Liang]

If drm_gem_handle_create() fails, it takes and then releases its handle
reference internally, leaving the creator's reference as the only one
held.  The drm_gem_object_put() then drops that last reference, freeing
the object via rocket_gem_bo_free(), and the subsequent goto err makes
drm_gem_shmem_object_free() run on the already freed object.

Return directly on the error instead: the put has already released
everything the function acquired at this point, so there is nothing
left to clean up on the err path.

Fixes: 658ebeac3351 ("accel/rocket: Add IOCTL for BO creation")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/accel/rocket/rocket_gem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/accel/rocket/rocket_gem.c b/drivers/accel/rocket/rocket_gem.c
index 91095d1b3066..521819041475 100644
--- a/drivers/accel/rocket/rocket_gem.c
+++ b/drivers/accel/rocket/rocket_gem.c
@@ -82,7 +82,7 @@ int rocket_ioctl_create_bo(struct drm_device *dev, void *data, struct drm_file *
 	ret = drm_gem_handle_create(file, gem_obj, &args->handle);
 	drm_gem_object_put(gem_obj);
 	if (ret)
-		goto err;
+		return ret;
 
 	sgt = drm_gem_shmem_get_pages_sgt(shmem_obj);
 	if (IS_ERR(sgt)) {
-- 
2.34.1

Re: [PATCH] accel/rocket: Fix use-after-free in rocket_ioctl_create_bo()

[Jeff Hugo]

On 9/17/2026 12:00 PM, Wentao Liang wrote:
> If drm_gem_handle_create() fails, it takes and then releases its handle
> reference internally, leaving the creator's reference as the only one
> held.  The drm_gem_object_put() then drops that last reference, freeing
> the object via rocket_gem_bo_free(), and the subsequent goto err makes
> drm_gem_shmem_object_free() run on the already freed object.
> 
> Return directly on the error instead: the put has already released
> everything the function acquired at this point, so there is nothing
> left to clean up on the err path.
> 
> Fixes: 658ebeac3351 ("accel/rocket: Add IOCTL for BO creation")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>   drivers/accel/rocket/rocket_gem.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/accel/rocket/rocket_gem.c b/drivers/accel/rocket/rocket_gem.c
> index 91095d1b3066..521819041475 100644
> --- a/drivers/accel/rocket/rocket_gem.c
> +++ b/drivers/accel/rocket/rocket_gem.c
> @@ -82,7 +82,7 @@ int rocket_ioctl_create_bo(struct drm_device *dev, void *data, struct drm_file *
>   	ret = drm_gem_handle_create(file, gem_obj, &args->handle);
>   	drm_gem_object_put(gem_obj);
>   	if (ret)
> -		goto err;
> +		return ret;
>   
>   	sgt = drm_gem_shmem_get_pages_sgt(shmem_obj);
>   	if (IS_ERR(sgt)) {


Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>

Re: [PATCH] accel/rocket: Fix use-after-free in rocket_ioctl_create_bo()

[Heiko Stübner]

Hi,

Am Donnerstag, 17. September 2026, 20:00:13 Mitteleuropäische Sommerzeit schrieb Wentao Liang:
> If drm_gem_handle_create() fails, it takes and then releases its handle
> reference internally, leaving the creator's reference as the only one
> held.  The drm_gem_object_put() then drops that last reference, freeing
> the object via rocket_gem_bo_free(), and the subsequent goto err makes
> drm_gem_shmem_object_free() run on the already freed object.
> 
> Return directly on the error instead: the put has already released
> everything the function acquired at this point, so there is nothing
> left to clean up on the err path.
> 
> Fixes: 658ebeac3351 ("accel/rocket: Add IOCTL for BO creation")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/accel/rocket/rocket_gem.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/accel/rocket/rocket_gem.c b/drivers/accel/rocket/rocket_gem.c
> index 91095d1b3066..521819041475 100644
> --- a/drivers/accel/rocket/rocket_gem.c
> +++ b/drivers/accel/rocket/rocket_gem.c
> @@ -82,7 +82,7 @@ int rocket_ioctl_create_bo(struct drm_device *dev, void *data, struct drm_file *
>  	ret = drm_gem_handle_create(file, gem_obj, &args->handle);
>  	drm_gem_object_put(gem_obj);
>  	if (ret)
> -		goto err;
> +		return ret;

I'm not sure, which kernel-version you're on, but it seems this code in
question has been changed back in may in 
commit f706e6a4ce75 ("accel/rocket: fix UAF via dangling GEM handle in
create_bo")  [0] .

Thanks
Heiko


[0] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f706e6a4ce75585af979aec3dcbdce68bc76306b