From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id DC335C46467 for ; Tue, 10 Jan 2023 09:38:46 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 277E910E57A; Tue, 10 Jan 2023 09:38:46 +0000 (UTC) Received: from madras.collabora.co.uk (madras.collabora.co.uk [46.235.227.172]) by gabe.freedesktop.org (Postfix) with ESMTPS id AF19810E57A for ; Tue, 10 Jan 2023 09:38:44 +0000 (UTC) Received: from [192.168.2.154] (unknown [109.252.117.89]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: dmitry.osipenko) by madras.collabora.co.uk (Postfix) with ESMTPSA id D10C96602D6F; Tue, 10 Jan 2023 09:38:42 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1673343523; bh=y621n6SK+X9Nfr6zTaXGBH56ErBaS4V28NM92YYWqYY=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=BZgAAaz75Le5OkwMuhF1zfEasbE1EvqMpyM+kkIhWn0GEzctXKCICHmiL2Mav/6kO YogJJ5YSFCnrSiKiWmQP65FHgKacrPwUDyVyyu8AJtwN13TBzE34S8zmpClQSTL4L+ ytl41dkfZKa9zOnp6c/L5+kJYogq7Cv3vZFVXwJF7t0gZbiq8Xf4lbvHPkYPJRd0oq 1Dpe63Q7q8EeTURYHqV9Q6auxbxxWhooRpWPPldSriYoxgOe5azGmDpadfWJ88kvL1 E5GIvgqzRlSh67dZboEF0119M19z/CawR3YYwewbAZbqyVw8kuSQlz/zCilIV1jdUp aTrrZanoexwVg== Message-ID: <36bbc210-9f8c-ac18-9322-110949b746cb@collabora.com> Date: Tue, 10 Jan 2023 12:38:39 +0300 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.6.0 Subject: Re: [PATCH] drm/virtio: Fix GEM handle creation UAF Content-Language: en-US To: Rob Clark References: <20221216233355.542197-1-robdclark@gmail.com> <20221216233355.542197-2-robdclark@gmail.com> <3ae74f28-580b-3b53-3d7b-e8bde97dabe3@collabora.com> From: Dmitry Osipenko In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Rob Clark , open list , dri-devel@lists.freedesktop.org, Gurchetan Singh , Gerd Hoffmann , David Airlie , "open list:VIRTIO GPU DRIVER" Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" On 1/10/23 04:47, Rob Clark wrote: > On Mon, Jan 9, 2023 at 3:28 PM Dmitry Osipenko > wrote: >> >> On 12/17/22 02:33, Rob Clark wrote: >>> From: Rob Clark >>> >>> Userspace can guess the handle value and try to race GEM object creation >>> with handle close, resulting in a use-after-free if we dereference the >>> object after dropping the handle's reference. For that reason, dropping >>> the handle's reference must be done *after* we are done dereferencing >>> the object. >>> >>> Signed-off-by: Rob Clark >>> --- >>> drivers/gpu/drm/virtio/virtgpu_ioctl.c | 19 +++++++++++++++++-- >>> 1 file changed, 17 insertions(+), 2 deletions(-) >> >> Added fixes/stable tags and applied this virtio-gpu patch to misc-fixes. >> The Panfrost patch is untouched. > > Thanks.. the panfrost patch was not intended to be part of the same > series (but apparently that is what happens when I send them at the > same time), and was superceded by a patch from Steven Price (commit > 4217c6ac8174 ("drm/panfrost: Fix GEM handle creation ref-counting") > already applied to misc-fixes Okay, I wanted to make clear what has been applied. -- Best regards, Dmitry