From: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
To: Chris Wilson <chris@chris-wilson.co.uk>, intel-gfx@lists.freedesktop.org
Subject: Re: [PATCH] drm/i915: Avoid use-after-free in reporting create.size
Date: Wed, 17 Apr 2019 14:50:03 +0100 [thread overview]
Message-ID: <8576d90d-5824-ba64-ea90-a2d39c390682@linux.intel.com> (raw)
In-Reply-To: <20190417132507.27133-1-chris@chris-wilson.co.uk>
On 17/04/2019 14:25, Chris Wilson wrote:
> We have to avoid chasing after a userspace race!
>
> <3>[ 473.114328] BUG: KASAN: use-after-free in i915_gem_create+0x1d2/0x1f0 [i915]
> <3>[ 473.114389] Read of size 8 at addr ffff88815bf1d840 by task gem_flink_race/1541
>
> <4>[ 473.114464] CPU: 1 PID: 1541 Comm: gem_flink_race Tainted: G U 5.1.0-rc4-g7d07e025e786-kasan_88+ #1
> <4>[ 473.114469] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./J4205-ITX, BIOS P1.10 09/29/2016
> <4>[ 473.114474] Call Trace:
> <4>[ 473.114488] dump_stack+0x7c/0xbb
> <4>[ 473.114612] ? i915_gem_create+0x1d2/0x1f0 [i915]
> <4>[ 473.114621] print_address_description+0x65/0x270
> <4>[ 473.114728] ? i915_gem_create+0x1d2/0x1f0 [i915]
> <4>[ 473.114839] ? i915_gem_create+0x1d2/0x1f0 [i915]
> <4>[ 473.114848] kasan_report+0x149/0x18d
> <4>[ 473.114962] ? i915_gem_create+0x1d2/0x1f0 [i915]
> <4>[ 473.115069] i915_gem_create+0x1d2/0x1f0 [i915]
> <4>[ 473.115176] ? i915_gem_object_create.part.28+0x4b0/0x4b0 [i915]
> <4>[ 473.115289] ? i915_gem_dumb_create+0x1a0/0x1a0 [i915]
> <4>[ 473.115297] drm_ioctl_kernel+0x192/0x260
> <4>[ 473.115306] ? drm_ioctl_permit+0x280/0x280
> <4>[ 473.115326] drm_ioctl+0x67c/0x960
> <4>[ 473.115438] ? i915_gem_dumb_create+0x1a0/0x1a0 [i915]
> <4>[ 473.115448] ? drm_getstats+0x20/0x20
> <4>[ 473.115459] ? __lock_acquire+0xa66/0x3fe0
> <4>[ 473.115474] ? _raw_spin_unlock_irqrestore+0x39/0x60
> <4>[ 473.115485] ? debug_object_active_state+0x2ea/0x4e0
> <4>[ 473.115496] ? debug_show_all_locks+0x2d0/0x2d0
> <4>[ 473.115513] do_vfs_ioctl+0x18d/0xfa0
> <4>[ 473.115522] ? check_flags.part.27+0x440/0x440
> <4>[ 473.115532] ? ioctl_preallocate+0x1a0/0x1a0
> <4>[ 473.115547] ? __fget+0x2ac/0x410
> <4>[ 473.115561] ? __ia32_sys_dup3+0xb0/0xb0
> <4>[ 473.115569] ? rwlock_bug.part.0+0x90/0x90
> <4>[ 473.115590] ksys_ioctl+0x35/0x70
> <4>[ 473.115597] ? lockdep_hardirqs_off+0x1cb/0x2b0
> <4>[ 473.115608] __x64_sys_ioctl+0x6a/0xb0
> <4>[ 473.115614] ? lockdep_hardirqs_on+0x342/0x590
> <4>[ 473.115623] do_syscall_64+0x97/0x400
> <4>[ 473.115633] entry_SYSCALL_64_after_hwframe+0x49/0xbe
> <4>[ 473.115641] RIP: 0033:0x7fce590d55d7
> <4>[ 473.115649] Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 f7 d8 64 89 01 48
> <4>[ 473.115655] RSP: 002b:00007fce4d525ba8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> <4>[ 473.115662] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fce590d55d7
> <4>[ 473.115667] RDX: 00007fce4d525c10 RSI: 00000000c010645b RDI: 0000000000000007
> <4>[ 473.115672] RBP: 00007fce4d525c10 R08: 00007fce4d526700 R09: 00007fce4d526700
> <4>[ 473.115677] R10: 0000000000000054 R11: 0000000000000246 R12: 00000000c010645b
> <4>[ 473.115682] R13: 0000000000000007 R14: 0000000000000000 R15: 00007ffe0e4a7450
>
> <3>[ 473.115731] Allocated by task 1541:
> <4>[ 473.115766] kmem_cache_alloc+0xce/0x290
> <4>[ 473.115895] i915_gem_object_create.part.28+0x1c/0x4b0 [i915]
> <4>[ 473.116000] i915_gem_create+0xe3/0x1f0 [i915]
> <4>[ 473.116008] drm_ioctl_kernel+0x192/0x260
> <4>[ 473.116013] drm_ioctl+0x67c/0x960
> <4>[ 473.116020] do_vfs_ioctl+0x18d/0xfa0
> <4>[ 473.116026] ksys_ioctl+0x35/0x70
> <4>[ 473.116032] __x64_sys_ioctl+0x6a/0xb0
> <4>[ 473.116038] do_syscall_64+0x97/0x400
> <4>[ 473.116044] entry_SYSCALL_64_after_hwframe+0x49/0xbe
>
> <3>[ 473.116071] Freed by task 1542:
> <4>[ 473.116101] kmem_cache_free+0xb7/0x2f0
> <4>[ 473.116205] __i915_gem_free_objects+0x7d4/0xe10 [i915]
> <4>[ 473.116311] i915_gem_create_ioctl+0xaa/0xd0 [i915]
> <4>[ 473.116318] drm_ioctl_kernel+0x192/0x260
> <4>[ 473.116323] drm_ioctl+0x67c/0x960
> <4>[ 473.116330] do_vfs_ioctl+0x18d/0xfa0
> <4>[ 473.116335] ksys_ioctl+0x35/0x70
> <4>[ 473.116341] __x64_sys_ioctl+0x6a/0xb0
> <4>[ 473.116347] do_syscall_64+0x97/0x400
> <4>[ 473.116354] entry_SYSCALL_64_after_hwframe+0x49/0xbe
>
> Testcase: igt/gem_flink_race/flink_close
> Fixes: e163484afa8d ("drm/i915: Update size upon return from GEM_CREATE")
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: Michał Winiarski <michal.winiarski@intel.com>
> ---
> drivers/gpu/drm/i915/i915_gem.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
> index a5412323fee1..e5462639de0b 100644
> --- a/drivers/gpu/drm/i915/i915_gem.c
> +++ b/drivers/gpu/drm/i915/i915_gem.c
> @@ -647,7 +647,7 @@ i915_gem_create(struct drm_file *file,
> return ret;
>
> *handle_p = handle;
> - *size_p = obj->base.size;
> + *size_p = size;
> return 0;
> }
>
>
More fun with userspace handle registration not being the last step!
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Regards,
Tvrtko
_______________________________________________
Intel-gfx mailing list
Intel-gfx@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/intel-gfx
next prev parent reply other threads:[~2019-04-17 13:50 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-17 13:25 [PATCH] drm/i915: Avoid use-after-free in reporting create.size Chris Wilson
2019-04-17 13:36 ` ✗ Fi.CI.CHECKPATCH: warning for " Patchwork
2019-04-17 13:50 ` Tvrtko Ursulin [this message]
2019-04-17 14:19 ` ✓ Fi.CI.BAT: success " Patchwork
2019-04-17 21:52 ` ✓ Fi.CI.IGT: " Patchwork
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=8576d90d-5824-ba64-ea90-a2d39c390682@linux.intel.com \
--to=tvrtko.ursulin@linux.intel.com \
--cc=chris@chris-wilson.co.uk \
--cc=intel-gfx@lists.freedesktop.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox