From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7A1FFC77B7C for ; Sat, 27 May 2023 08:18:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc :To:From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References: List-Owner; bh=8ZP9mY4TzfzDJRO8j4POWCXlPIKgqAfGhazxHYq6vU0=; b=V9P1TD48OOt6pU iGHQZ3nzdp8zfw7Ka8PoPkLJBPCwH5t5w7LxPFjr95aEP4xY8qK2cdQN6f7uJyrSfUyRnWCDjEmay RM63uH5vRGT8Mrwjlv73JVd0g0iSDxH7zAFTpE7pZab4QZAJsnKZtbgLg9JGH0bDExaspijjHMSh7 gaSpGKPc7qZCFt7pZcck5iDBetCCV9NwhKxvoWeA95fEnM7n2A8o77P9EFyvyb2tZMMDE6Fq0ag3n QcxlUTZwIKLNzRfeGk61xwtCch1xd1ZPJtcIERvcGSVGc4TzRCI1ihggYXxhCeuTt2Hip1npXIvoh lEEVUgmfupAnt+yDP+aQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1q2p84-005DS8-1H; Sat, 27 May 2023 08:18:24 +0000 Received: from mail-pl1-x62d.google.com ([2607:f8b0:4864:20::62d]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1q2p81-005DRY-2K for linux-arm-kernel@lists.infradead.org; Sat, 27 May 2023 08:18:22 +0000 Received: by mail-pl1-x62d.google.com with SMTP id d9443c01a7336-1b00ed75e34so2595925ad.1 for ; Sat, 27 May 2023 01:18:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1685175499; x=1687767499; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=GgkyIFrBxuAzRVAXPfklB2pDA1O52uIPOrfTaBhFKGs=; b=qm+e8b0zkHNbENDDxLnIF6iBScBalvdL1g9zQnlk0PvyTH800CgFL/iRVnhFVqPOs6 oBaQdJOsEvfYm5pY7XuXn7P1wonU6aeCERZDFy94mQYYGqFp61yFoWHgoAg22uKCN1DV MeMl6WBLU8cUacWqUeDBLq9WRYdR6drlC89VW2PXskhq2PZbFtnAn+5nvUpStUF+hzpJ DVjlWLnYZaJTMWs6q7vX1L8qinpHo/H/xhsI4HsUbENWAuIs4KiOL9zQ+lBYDvrmi8KD CYCk5dlWGxE2McweClOUal1k2r0jHEODWDgeP6sjWiR09GFNNiwuka8F0Gtdj4WT6Vzr iOxQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1685175499; x=1687767499; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=GgkyIFrBxuAzRVAXPfklB2pDA1O52uIPOrfTaBhFKGs=; b=CD1o0/avAqZdojHqt8XSxMc2Rw17diWxRWsY4f4GjR5gKxQ8cvInuiakvBnul1KEV8 4d3k5hnS7bVxG7HTU2i2/lqq4oX+MKScAop5gtE4W6ivj1GeB8xRvSguZGT+CPIcjHch oSoz5CxRKSqirxWvTgRM7idNt6CKOQk4fgAumYTkK5mpO9QABYbK3LHeZOamV9n6Q+n0 pbl248Nj4/30ltUhEEwf9oWMGk9MTNiKMO0PmjrCGINDX41mpX2CrHF84gHCgQaB1uEq vzNzzIergtR4MFgH687nWCLCwOKFiRINM50F8DZCnOrs+jD8dBG1wKk8cIRdtIoedxZA sigQ== X-Gm-Message-State: AC+VfDyC8iVpH2XsAOso+HQsAjps83DiurhN615iryGTc8d9EDZ8rFT5 G20BgctfYVpn4OLx3b0dXQM= X-Google-Smtp-Source: ACHHUZ6Qrp4DcfEEkrmjiuOnMT+CTIIsQl6FsMr5hpxiqSImvCBsDbCfQCxS1x82Mq3I3BFFmbia1Q== X-Received: by 2002:a17:902:e752:b0:1ae:8595:14b with SMTP id p18-20020a170902e75200b001ae8595014bmr5638597plf.6.1685175499229; Sat, 27 May 2023 01:18:19 -0700 (PDT) Received: from ubuntu.localdomain ([103.114.158.1]) by smtp.gmail.com with ESMTPSA id b4-20020a170902d50400b001ae6e270d8bsm4395490plg.131.2023.05.27.01.18.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 27 May 2023 01:18:18 -0700 (PDT) From: Min Li To: inki.dae@samsung.com Cc: sw0312.kim@samsung.com, kyungmin.park@samsung.com, airlied@gmail.com, daniel@ffwll.ch, krzysztof.kozlowski@linaro.org, alim.akhtar@samsung.com, dri-devel@lists.freedesktop.org, linux-arm-kernel@lists.infradead.org, linux-samsung-soc@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] drm/exynos: fix race condition UAF in exynos_g2d_exec_ioctl Date: Fri, 26 May 2023 21:01:31 +0800 Message-Id: <20230526130131.16521-1-lm0963hack@gmail.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230527_011821_780259_F7A185C2 X-CRM114-Status: GOOD ( 11.76 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org If it is async, runqueue_node is freed in g2d_runqueue_worker on another worker thread. So in extreme cases, if g2d_runqueue_worker runs first, and then executes the following if statement, there will be use-after-free. Signed-off-by: Min Li --- drivers/gpu/drm/exynos/exynos_drm_g2d.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c index ec784e58da5c..414e585ec7dd 100644 --- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c +++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c @@ -1335,7 +1335,7 @@ int exynos_g2d_exec_ioctl(struct drm_device *drm_dev, void *data, /* Let the runqueue know that there is work to do. */ queue_work(g2d->g2d_workq, &g2d->runqueue_work); - if (runqueue_node->async) + if (req->async) goto out; wait_for_completion(&runqueue_node->complete); -- 2.34.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel