Chris Wilson
929eec99f5
drm/i915: Avoid use-after-free in reporting create.size
We have to avoid chasing after a userspace race!
<3>[ 473.114328] BUG: KASAN: use-after-free in i915_gem_create+0x1d2/0x1f0 [i915]
<3>[ 473.114389] Read of size 8 at addr ffff88815bf1d840 by task gem_flink_race/1541
<4>[ 473.114464] CPU: 1 PID: 1541 Comm: gem_flink_race Tainted: G U 5.1.0-rc4-g7d07e025e786-kasan_88+ #1
<4>[ 473.114469] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./J4205-ITX, BIOS P1.10 09/29/2016
<4>[ 473.114474] Call Trace:
<4>[ 473.114488] dump_stack+0x7c/0xbb
<4>[ 473.114612] ? i915_gem_create+0x1d2/0x1f0 [i915]
<4>[ 473.114621] print_address_description+0x65/0x270
<4>[ 473.114728] ? i915_gem_create+0x1d2/0x1f0 [i915]
<4>[ 473.114839] ? i915_gem_create+0x1d2/0x1f0 [i915]
<4>[ 473.114848] kasan_report+0x149/0x18d
<4>[ 473.114962] ? i915_gem_create+0x1d2/0x1f0 [i915]
<4>[ 473.115069] i915_gem_create+0x1d2/0x1f0 [i915]
<4>[ 473.115176] ? i915_gem_object_create.part.28+0x4b0/0x4b0 [i915]
<4>[ 473.115289] ? i915_gem_dumb_create+0x1a0/0x1a0 [i915]
<4>[ 473.115297] drm_ioctl_kernel+0x192/0x260
<4>[ 473.115306] ? drm_ioctl_permit+0x280/0x280
<4>[ 473.115326] drm_ioctl+0x67c/0x960
<4>[ 473.115438] ? i915_gem_dumb_create+0x1a0/0x1a0 [i915]
<4>[ 473.115448] ? drm_getstats+0x20/0x20
<4>[ 473.115459] ? __lock_acquire+0xa66/0x3fe0
<4>[ 473.115474] ? _raw_spin_unlock_irqrestore+0x39/0x60
<4>[ 473.115485] ? debug_object_active_state+0x2ea/0x4e0
<4>[ 473.115496] ? debug_show_all_locks+0x2d0/0x2d0
<4>[ 473.115513] do_vfs_ioctl+0x18d/0xfa0
<4>[ 473.115522] ? check_flags.part.27+0x440/0x440
<4>[ 473.115532] ? ioctl_preallocate+0x1a0/0x1a0
<4>[ 473.115547] ? __fget+0x2ac/0x410
<4>[ 473.115561] ? __ia32_sys_dup3+0xb0/0xb0
<4>[ 473.115569] ? rwlock_bug.part.0+0x90/0x90
<4>[ 473.115590] ksys_ioctl+0x35/0x70
<4>[ 473.115597] ? lockdep_hardirqs_off+0x1cb/0x2b0
<4>[ 473.115608] __x64_sys_ioctl+0x6a/0xb0
<4>[ 473.115614] ? lockdep_hardirqs_on+0x342/0x590
<4>[ 473.115623] do_syscall_64+0x97/0x400
<4>[ 473.115633] entry_SYSCALL_64_after_hwframe+0x49/0xbe
<4>[ 473.115641] RIP: 0033:0x7fce590d55d7
<4>[ 473.115649] Code: b3 66 90 48 8b 05 b1 48 2d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 81 48 2d 00 f7 d8 64 89 01 48
<4>[ 473.115655] RSP: 002b:00007fce4d525ba8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
<4>[ 473.115662] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fce590d55d7
<4>[ 473.115667] RDX: 00007fce4d525c10 RSI: 00000000c010645b RDI: 0000000000000007
<4>[ 473.115672] RBP: 00007fce4d525c10 R08: 00007fce4d526700 R09: 00007fce4d526700
<4>[ 473.115677] R10: 0000000000000054 R11: 0000000000000246 R12: 00000000c010645b
<4>[ 473.115682] R13: 0000000000000007 R14: 0000000000000000 R15: 00007ffe0e4a7450
<3>[ 473.115731] Allocated by task 1541:
<4>[ 473.115766] kmem_cache_alloc+0xce/0x290
<4>[ 473.115895] i915_gem_object_create.part.28+0x1c/0x4b0 [i915]
<4>[ 473.116000] i915_gem_create+0xe3/0x1f0 [i915]
<4>[ 473.116008] drm_ioctl_kernel+0x192/0x260
<4>[ 473.116013] drm_ioctl+0x67c/0x960
<4>[ 473.116020] do_vfs_ioctl+0x18d/0xfa0
<4>[ 473.116026] ksys_ioctl+0x35/0x70
<4>[ 473.116032] __x64_sys_ioctl+0x6a/0xb0
<4>[ 473.116038] do_syscall_64+0x97/0x400
<4>[ 473.116044] entry_SYSCALL_64_after_hwframe+0x49/0xbe
<3>[ 473.116071] Freed by task 1542:
<4>[ 473.116101] kmem_cache_free+0xb7/0x2f0
<4>[ 473.116205] __i915_gem_free_objects+0x7d4/0xe10 [i915]
<4>[ 473.116311] i915_gem_create_ioctl+0xaa/0xd0 [i915]
<4>[ 473.116318] drm_ioctl_kernel+0x192/0x260
<4>[ 473.116323] drm_ioctl+0x67c/0x960
<4>[ 473.116330] do_vfs_ioctl+0x18d/0xfa0
<4>[ 473.116335] ksys_ioctl+0x35/0x70
<4>[ 473.116341] __x64_sys_ioctl+0x6a/0xb0
<4>[ 473.116347] do_syscall_64+0x97/0x400
<4>[ 473.116354] entry_SYSCALL_64_after_hwframe+0x49/0xbe
Testcase: igt/gem_flink_race/flink_close
Fixes: e163484afa
("drm/i915: Update size upon return from GEM_CREATE")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Michał Winiarski <michal.winiarski@intel.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190417132507.27133-1-chris@chris-wilson.co.uk
(cherry picked from commit 9953402349
)
Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
2019-04-24 09:39:07 +03:00
..
2019-04-24 10:02:20 +10:00
2019-04-15 11:58:19 +01:00
2019-04-04 19:49:42 +03:00
2018-06-18 14:45:58 +03:00
2018-06-18 14:45:58 +03:00
2018-06-18 14:45:58 +03:00
2018-06-18 14:45:58 +03:00
2018-06-18 14:45:58 +03:00
2018-06-18 14:45:58 +03:00
2019-01-09 10:26:36 +02:00
2019-02-05 17:20:11 +00:00
2019-03-08 09:52:29 -08:00
2019-03-08 10:57:12 +00:00
2019-03-05 18:19:50 +00:00
2019-04-24 10:02:20 +10:00
2019-04-08 09:53:35 +03:00
2019-04-17 12:07:47 +03:00
2018-11-20 12:49:24 +02:00
2018-03-09 22:21:41 +00:00
2018-03-09 22:21:41 +00:00
2018-08-17 11:22:15 +02:00
2019-03-22 13:12:38 +00:00
2019-04-17 07:25:42 +01:00
2019-04-02 15:09:08 +01:00
2019-03-21 17:28:12 +00:00
2019-03-08 10:57:12 +00:00
2019-03-21 17:28:12 +00:00
2019-03-20 17:50:35 +00:00
2019-01-25 14:27:22 +00:00
2019-04-11 20:48:51 +01:00
2019-04-02 15:09:08 +01:00
2019-02-28 11:08:02 +00:00
2019-03-06 10:00:50 +00:00
2019-03-31 12:46:52 +01:00
2019-03-21 17:28:12 +00:00
2018-02-21 20:57:22 +00:00
2019-01-28 16:24:13 +00:00
2019-02-28 11:08:02 +00:00
2019-03-20 17:50:35 +00:00
2019-03-31 12:46:52 +01:00
2019-04-24 09:39:07 +03:00
2019-04-02 15:09:08 +01:00
2017-11-30 10:11:49 +02:00
2017-10-07 10:11:41 +01:00
2019-04-08 17:04:01 +01:00
2019-03-08 13:59:52 +00:00
2019-04-16 14:18:58 -07:00
2019-04-02 15:09:08 +01:00
2019-01-24 13:20:42 +01:00
2019-04-16 14:24:39 -07:00
2017-12-22 11:12:15 +00:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2018-10-23 15:09:16 +01:00
2019-01-29 10:41:58 +01:00
2019-01-29 10:41:58 +01:00
2019-04-08 09:52:49 +03:00
2019-03-26 20:20:24 +00:00
2019-03-27 18:23:53 +02:00
2019-02-24 21:20:27 +01:00
2019-04-02 15:52:09 +01:00
2019-03-15 09:04:54 +00:00
2019-02-26 10:32:57 +00:00
2018-03-08 10:07:18 +00:00
2019-04-16 14:18:58 -07:00
2019-04-11 20:48:51 +01:00
2019-04-11 07:14:27 +01:00
2019-04-16 14:18:58 -07:00
2019-04-08 09:51:56 +03:00
2019-04-02 15:52:09 +01:00
2019-04-11 07:14:27 +01:00
2019-04-02 15:09:08 +01:00
2019-01-29 19:59:57 +00:00
2019-04-08 09:51:56 +03:00
2019-03-22 13:12:38 +00:00
2019-03-22 13:12:38 +00:00
2018-09-26 13:32:03 +01:00
2019-01-14 16:18:25 +00:00
2019-04-08 17:04:12 +01:00
2019-04-08 17:04:12 +01:00
2019-04-08 17:04:12 +01:00
2017-11-02 11:10:55 +01:00
2019-02-26 09:55:37 +00:00
2019-03-22 13:12:30 +00:00
2019-03-22 13:12:30 +00:00
2019-03-27 18:23:53 +02:00
2019-03-26 19:15:15 +00:00
2019-03-15 09:04:54 +00:00
2019-03-06 10:00:50 +00:00
2019-03-06 10:00:50 +00:00
2019-04-15 15:51:49 +10:00
2019-01-09 10:26:36 +02:00
2019-04-08 09:53:30 +03:00
2019-04-08 09:53:07 +03:00
2019-04-08 09:53:30 +03:00
2019-04-08 09:51:22 +03:00
2019-04-08 09:51:22 +03:00
2019-03-25 15:16:33 +02:00
2019-04-16 11:06:00 +01:00
2019-04-17 11:50:23 +03:00
2019-04-08 09:53:40 +03:00
2019-04-08 09:52:14 +03:00
2019-04-08 09:52:14 +03:00
2019-04-12 16:35:50 +03:00
2019-04-08 09:52:36 +03:00
2019-04-08 09:51:41 +03:00
2019-04-10 21:18:11 +01:00
2019-03-19 08:21:13 +00:00
2019-03-19 08:21:13 +00:00
2019-04-08 09:51:41 +03:00
2019-04-08 09:51:29 +03:00
2019-04-08 09:51:49 +03:00
2019-04-08 09:51:49 +03:00
2019-04-15 15:51:49 +10:00
2019-04-08 09:51:36 +03:00
2019-04-03 10:55:43 +01:00
2019-04-02 15:09:08 +01:00
2019-04-15 12:54:24 -07:00
2019-03-08 08:23:15 -08:00
2018-06-18 14:46:04 +03:00
2019-04-08 09:52:54 +03:00
2019-04-11 21:22:40 +03:00
2019-04-15 15:51:49 +10:00
2019-04-11 21:22:40 +03:00
2019-04-08 09:52:54 +03:00
2019-03-26 20:20:24 +00:00
2019-03-19 12:57:55 +02:00
2019-04-15 15:51:49 +10:00
2019-03-22 18:41:39 +02:00
2018-11-13 17:20:32 +02:00
2019-03-22 18:41:39 +02:00
2019-04-08 09:53:25 +03:00
2019-04-08 09:53:25 +03:00
2019-04-11 09:20:04 +01:00
2019-04-11 09:20:04 +01:00
2019-04-08 09:52:03 +03:00
2019-04-08 09:51:56 +03:00
2019-04-24 10:12:50 +10:00
2019-04-08 09:52:49 +03:00
2019-04-08 09:51:56 +03:00
2019-04-08 09:52:54 +03:00
2019-04-08 09:51:18 +03:00
2019-03-01 17:45:07 +00:00
2019-03-08 14:00:02 +00:00
2018-01-03 14:02:10 +00:00
2019-03-24 11:31:47 +00:00
2019-02-20 23:53:04 +00:00
2019-03-20 21:12:31 +00:00
2017-12-06 14:41:47 +00:00
2018-10-23 09:42:25 +01:00
2019-02-22 11:25:32 +00:00
2018-06-12 15:44:47 +01:00
2018-10-23 09:42:25 +01:00
2019-04-11 20:48:51 +01:00
2019-04-02 15:09:08 +01:00
2019-03-26 20:20:24 +00:00
2019-03-24 11:31:47 +00:00
2019-01-10 11:38:34 +08:00
2019-04-02 15:09:08 +01:00
2019-04-08 09:52:30 +03:00
2019-04-08 09:52:30 +03:00
2019-04-08 09:53:01 +03:00
2019-04-08 09:53:01 +03:00
2019-02-05 09:43:23 -08:00
2019-03-26 20:16:45 +00:00
2018-03-02 09:04:45 +00:00
2019-03-26 20:20:24 +00:00
2018-06-28 22:51:33 +01:00
2019-03-26 20:16:45 +00:00
2019-01-24 13:20:42 +01:00
2018-08-01 17:03:31 +01:00
2019-04-12 14:32:11 +01:00
2019-04-11 20:48:51 +01:00
2019-04-08 09:52:54 +03:00
2019-04-08 09:52:21 +03:00
2019-04-08 09:53:21 +03:00
2019-04-08 09:53:21 +03:00
2019-03-13 13:00:24 -07:00
2019-01-09 10:26:36 +02:00
2019-04-08 09:52:36 +03:00
2018-11-30 09:46:31 +00:00
2019-04-16 14:18:58 -07:00
2019-04-08 09:52:36 +03:00
2019-04-08 09:52:36 +03:00
2019-04-08 09:53:12 +03:00
2019-04-08 09:53:12 +03:00
2019-04-16 13:42:27 +01:00
2019-04-08 09:52:43 +03:00
2019-04-08 10:39:11 -07:00
2019-04-08 09:52:03 +03:00
2018-10-18 13:40:13 +03:00
2019-04-16 14:18:58 -07:00
2019-04-16 11:06:00 +01:00
2019-04-12 15:15:01 -07:00
2019-04-08 09:53:01 +03:00
2019-04-08 09:52:26 +03:00
2019-03-26 20:20:24 +00:00
2019-04-08 09:53:30 +03:00
2019-04-08 09:53:30 +03:00
2019-04-08 09:53:16 +03:00
2019-04-08 09:53:16 +03:00
2019-01-08 22:41:09 +00:00
2018-10-04 07:29:47 +01:00
2019-03-30 08:02:07 +00:00
2019-02-20 23:53:21 +00:00
2019-04-08 09:52:43 +03:00
2019-04-05 22:03:24 +01:00
2019-03-13 14:20:19 -07:00
2019-03-05 13:24:34 -05:00
2018-12-31 15:27:23 +02:00
2018-03-14 15:35:37 +02:00
2019-03-08 13:59:44 +00:00
2019-04-13 07:46:43 +01:00
2019-04-13 07:46:43 +01:00
2018-12-22 00:25:54 +09:00
2019-01-14 16:17:50 +00:00
2019-04-04 19:49:42 +03:00
2019-04-08 09:53:35 +03:00
2019-03-26 20:20:24 +00:00
2019-04-15 15:51:49 +10:00