Forwarded: [PATCH] drm/gem: fix use-after-free in drm_gem_release

syzbot
2026-04-14T05:49:59Z

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] drm/gem: fix use-after-free in drm_gem_release
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

drm_gem_release() calls idr_for_each() to iterate over all GEM handles
and release them during file close. However, idr_for_each() does not
hold file_priv->table_lock while reading object pointers from the IDR,
which means it can race with a concurrent drm_gem_handle_delete() from
a GEM_CLOSE ioctl on another thread sharing the same file descriptor.

The race is as follows:

Thread A (close fd) Thread B (GEM_CLOSE ioctl)
drm_gem_release()
idr_for_each()
reads obj ptr from IDR
drm_gem_handle_delete()
idr_replace(NULL)
drm_gem_object_release_handle()
handle_put -> kfree(obj)
drm_gem_object_release_handle()
obj->funcs->close() <- UAF!

Fix this by replacing idr_for_each() with a manual iteration loop that
holds table_lock while reading each pointer and uses idr_replace(NULL)
to claim the handle, mirroring the pattern used by
drm_gem_handle_delete(). This ensures mutual exclusion: whichever path
claims the handle first (sets it to NULL) gets to process it, and the
other path safely skips it.

Reported-by: syzbot+b2e951687503f32f74ce@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
drivers/gpu/drm/drm_gem.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 891c3bff5ae0..b878f82146f1 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -1085,8 +1085,28 @@ drm_gem_open(struct drm_device *dev, struct drm_file *file_private)
void
drm_gem_release(struct drm_device *dev, struct drm_file *file_private)
{
- idr_for_each(&file_private->object_idr,
- &drm_gem_object_release_handle, file_private);
+ struct drm_gem_object *obj;
+ int next_id;
+
+ next_id = 0;
+ while (1) {
+ spin_lock(&file_private->table_lock);
+ obj = idr_get_next(&file_private->object_idr, &next_id);
+ if (!obj) {
+ spin_unlock(&file_private->table_lock);
+ break;
+ }
+ /* Claim the handle — same pattern as drm_gem_handle_delete */
+ idr_replace(&file_private->object_idr, NULL, next_id);
+ spin_unlock(&file_private->table_lock);
+
+ drm_gem_object_release_handle(next_id, obj, file_private);
+
+ spin_lock(&file_private->table_lock);
+ idr_remove(&file_private->object_idr, next_id);
+ spin_unlock(&file_private->table_lock);
+ next_id++;
+ }
idr_destroy(&file_private->object_idr);
}

--
2.43.0