drm: hold gem reference until object is no longer accessed (8490d6a7) · Commits · 戴 / test

A use-after-free in drm_gem_open_ioctl can happen if the GEM object handle is closed between the idr lookup and retrieving the size from said object since a local reference is not being held at that point. Hold the local reference while the object can still be accessed to fix this and plug the potential security hole. Signed-off-by:

Steve Cohen <cohens@codeaurora.org> Cc: stable@vger.kernel.org Signed-off-by:

Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org

drivers/gpu/drm/drm_gem.c

+4 −6

Original line number	Diff line number	Diff line
		@@ -871,9 +871,6 @@ err:
		* @file_priv: drm file-private structure
		*
		* Open an object using the global name, returning a handle and the size.
		*
		* This handle (of course) holds a reference to the object, so the object
		* will not go away until the handle is deleted.
		*/
		int
		drm_gem_open_ioctl(struct drm_device dev, void data,
		@@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device dev, void data,

		/* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
		ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
		drm_gem_object_put_unlocked(obj);
		if (ret)
		return ret;
		goto err;

		args->handle = handle;
		args->size = obj->size;

		return 0;
		err:
		drm_gem_object_put_unlocked(obj);
		return ret;
		}

		/**

Admin message