queue-5.0/drm-vkms-fix-use-after-free-when-drm_gem_handle_create-fails.patch

   1 From 36b6c9ed45afe89045973e8dee1b004dd5372d40 Mon Sep 17 00:00:00 2001
   2 From: Eric Biggers <ebiggers@google.com>
   3 Date: Tue, 26 Feb 2019 14:08:58 -0800
   4 Subject: drm/vkms: fix use-after-free when drm_gem_handle_create() fails
   5
   6 From: Eric Biggers <ebiggers@google.com>
   7
   8 commit 36b6c9ed45afe89045973e8dee1b004dd5372d40 upstream.
   9
  10 If drm_gem_handle_create() fails in vkms_gem_create(), then the
  11 vkms_gem_object is freed twice: once when the reference is dropped by
  12 drm_gem_object_put_unlocked(), and again by the extra calls to
  13 drm_gem_object_release() and kfree().
  14
  15 Fix it by skipping the second release and free.
  16
  17 This bug was originally found in the vgem driver by syzkaller using
  18 fault injection, but I noticed it's also present in the vkms driver.
  19
  20 Fixes: 559e50fd34d1 ("drm/vkms: Add dumb operations")
  21 Cc: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
  22 Cc: Haneen Mohammed <hamohammed.sa@gmail.com>
  23 Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
  24 Cc: Chris Wilson <chris@chris-wilson.co.uk>
  25 Cc: stable@vger.kernel.org
  26 Signed-off-by: Eric Biggers <ebiggers@google.com>
  27 Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
  28 Reviewed-by: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
  29 Signed-off-by: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
  30 Link: https://patchwork.freedesktop.org/patch/msgid/20190226220858.214438-1-ebiggers@kernel.org
  31 Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
  32 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  33
  34 ---
  35  drivers/gpu/drm/vkms/vkms_gem.c |    5 +----
  36  1 file changed, 1 insertion(+), 4 deletions(-)
  37
  38 --- a/drivers/gpu/drm/vkms/vkms_gem.c
  39 +++ b/drivers/gpu/drm/vkms/vkms_gem.c
  40 @@ -111,11 +111,8 @@ struct drm_gem_object *vkms_gem_create(s
  41
  42         ret = drm_gem_handle_create(file, &obj->gem, handle);
  43         drm_gem_object_put_unlocked(&obj->gem);
  44 -       if (ret) {
  45 -               drm_gem_object_release(&obj->gem);
  46 -               kfree(obj);
  47 +       if (ret)
  48                 return ERR_PTR(ret);
  49 -       }
  50
  51         return &obj->gem;
  52  }