1. 14 Sep, 2020 2 commits
    • Jia Yang's avatar
      drm: fix double free for gbo in drm_gem_vram_init and drm_gem_vram_create · da62cb72
      Jia Yang authored
      I got a use-after-free report when doing some fuzz test:
      
      If ttm_bo_init() fails, the "gbo" and "gbo->bo.base" will be
      freed by ttm_buffer_object_destroy() in ttm_bo_init(). But
      then drm_gem_vram_create() and drm_gem_vram_init() will free
      "gbo" and "gbo->bo.base" again.
      
      BUG: KMSAN: use-after-free in drm_vma_offset_remove+0xb3/0x150
      CPU: 0 PID: 24282 Comm: syz-executor.1 Tainted: G    B   W         5.7.0-rc4-msan #2
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
      Call Trace:
       __dump_stack
       dump_stack+0x1c9/0x220
       kmsan_report+0xf7/0x1e0
       __msan_warning+0x58/0xa0
       drm_vma_offset_remove+0xb3/0x150
       drm_gem_free_mmap_offset
       drm_gem_object_release+0x159/0x180
       drm_gem_vram_init
       drm_gem_vram_create+0x7c5/0x990
       drm_gem_vram_fill_create_dumb
       drm_gem_vram_driver_dumb_create+0x238/0x590
       drm_mode_create_dumb
       drm_mode_create_dumb_ioctl+0x41d/0x450
       drm_ioctl_kernel+0x5a4/0x710
       drm_ioctl+0xc6f/0x1240
       vfs_ioctl
       ksys_ioctl
       __do_sys_ioctl
       __se_sys_ioctl+0x2e9/0x410
       __x64_sys_ioctl+0x4a/0x70
       do_syscall_64+0xb8/0x160
       entry_SYSCALL_64_after_hwframe+0x44/0xa9
      RIP: 0033:0x4689b9
      Code: fd e0 fa ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb e0 fa ff c3 66 2e 0f 1f 84 00 00 00 00
      RSP: 002b:00007f368fa4dc98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
      RAX: ffffffffffffffda RBX: 000000000076bf00 RCX: 00000000004689b9
      RDX: 0000000020000240 RSI: 00000000c02064b2 RDI: 0000000000000003
      RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
      R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
      R13: 00000000004d17e0 R14: 00007f368fa4e6d4 R15: 000000000076bf0c
      
      Uninit was created at:
       kmsan_save_stack_with_flags
       kmsan_internal_poison_shadow+0x66/0xd0
       kmsan_slab_free+0x6e/0xb0
       slab_free_freelist_hook
       slab_free
       kfree+0x571/0x30a0
       drm_gem_vram_destroy
       ttm_buffer_object_destroy+0xc8/0x130
       ttm_bo_release
       kref_put
       ttm_bo_put+0x117d/0x23e0
       ttm_bo_init_reserved+0x11c0/0x11d0
       ttm_bo_init+0x289/0x3f0
       drm_gem_vram_init
       drm_gem_vram_create+0x775/0x990
       drm_gem_vram_fill_create_dumb
       drm_gem_vram_driver_dumb_create+0x238/0x590
       drm_mode_create_dumb
       drm_mode_create_dumb_ioctl+0x41d/0x450
       drm_ioctl_kernel+0x5a4/0x710
       drm_ioctl+0xc6f/0x1240
       vfs_ioctl
       ksys_ioctl
       __do_sys_ioctl
       __se_sys_ioctl+0x2e9/0x410
       __x64_sys_ioctl+0x4a/0x70
       do_syscall_64+0xb8/0x160
       entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      If ttm_bo_init() fails, the "gbo" will be freed by
      ttm_buffer_object_destroy() in ttm_bo_init(). But then
      drm_gem_vram_create() and drm_gem_vram_init() will free
      "gbo" again.
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Reported-by: default avatarbutt3rflyh4ck <butterflyhuangxx@gmail.com>
      Signed-off-by: default avatarJia Yang <jiayang5@huawei.com>
      Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      Reviewed-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200714083238.28479-2-tzimmermann@suse.de
      da62cb72
    • Thomas Zimmermann's avatar
      drm/vboxvideo: Use drm_gem_vram_vmap() interfaces · d88656f4
      Thomas Zimmermann authored
      VRAM helpers support ref counting for pin and vmap operations, no need
      to avoid these operations by employing the internal kmap interface. Just
      use drm_gem_vram_vmap() and let it handle the details.
      
      Also unexport the kmap interfaces from VRAM helpers. Vboxvideo was the
      last user of these internal functions.
      
      v2:
      	* fixed a comma in commit description
      Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      Reviewed-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Tested-by: default avatarHans de Goede <hdegoede@redhat.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200911075922.19317-1-tzimmermann@suse.de
      d88656f4
  2. 12 Sep, 2020 1 commit
  3. 11 Sep, 2020 15 commits
  4. 10 Sep, 2020 7 commits
  5. 09 Sep, 2020 10 commits
  6. 08 Sep, 2020 5 commits