Forwarded: [PATCH] drm/gem: fix use-after-free in drm_gem_release

[syzbot <syzbot+b2e951687503f32f74ce@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] drm/gem: fix use-after-free in drm_gem_release
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


drm_gem_release() calls idr_for_each() to iterate over all GEM handles
and release them during file close. However, idr_for_each() does not
hold file_priv->table_lock while reading object pointers from the IDR,
which means it can race with a concurrent drm_gem_handle_delete() from
a GEM_CLOSE ioctl on another thread sharing the same file descriptor.

The race is as follows:

  Thread A (close fd)                Thread B (GEM_CLOSE ioctl)
  drm_gem_release()
    idr_for_each()
      reads obj ptr from IDR
                                     drm_gem_handle_delete()
                                       idr_replace(NULL)
                                       drm_gem_object_release_handle()
                                         handle_put -> kfree(obj)
      drm_gem_object_release_handle()
        obj->funcs->close()  <- UAF!

Fix this by replacing idr_for_each() with a manual iteration loop that
holds table_lock while reading each pointer and uses idr_replace(NULL)
to claim the handle, mirroring the pattern used by
drm_gem_handle_delete(). This ensures mutual exclusion: whichever path
claims the handle first (sets it to NULL) gets to process it, and the
other path safely skips it.

Reported-by: syzbot+b2e951687503f32f74ce@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/gpu/drm/drm_gem.c | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 891c3bff5ae0..b878f82146f1 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -1085,8 +1085,28 @@ drm_gem_open(struct drm_device *dev, struct drm_file *file_private)
 void
 drm_gem_release(struct drm_device *dev, struct drm_file *file_private)
 {
-	idr_for_each(&file_private->object_idr,
-		     &drm_gem_object_release_handle, file_private);
+	struct drm_gem_object *obj;
+	int next_id;
+
+	next_id = 0;
+	while (1) {
+		spin_lock(&file_private->table_lock);
+		obj = idr_get_next(&file_private->object_idr, &next_id);
+		if (!obj) {
+			spin_unlock(&file_private->table_lock);
+			break;
+		}
+		/* Claim the handle — same pattern as drm_gem_handle_delete */
+		idr_replace(&file_private->object_idr, NULL, next_id);
+		spin_unlock(&file_private->table_lock);
+
+		drm_gem_object_release_handle(next_id, obj, file_private);
+
+		spin_lock(&file_private->table_lock);
+		idr_remove(&file_private->object_idr, next_id);
+		spin_unlock(&file_private->table_lock);
+		next_id++;
+	}
 	idr_destroy(&file_private->object_idr);
 }
 
-- 
2.43.0