Re: [PATCH v2] drm/vkms: Fix UAF between connector configfs rmdir and .detect

[Ibrahim Hashimov <security@auditcode.ai>]

> Thanks for this report and patch. I am currently working on a series
> adding even more stuff in vkms_config, so I am trying to solve it for
> the whole vkms_config structure.

Makes sense -- a structural fix for the whole vkms_config is better than
my one-off rcu anyway, so please drop mine.

The refcount-the-connector direction sounds like the right one: the UAF
is really just .detect depending on the config object's lifetime, so once
it holds a ref it stops mattering who wins the configfs-vs-drm race. Cc me
on the series and I'll run the original reproducer against it, so we know
the exact race is actually closed.

> do you have the script that you used to do the hammering?

Yeah. A thread hammers .detect (which walks the whole connector list)
while another rmdir's configfs connectors out from under it; on the
unpatched module KASAN reliably reports slab-use-after-free in
vkms_connector_detect. I'll send it over.

> can you contribute this test to IGT?

Happy to. Point me at a close-enough kms/configfs test to base it on and
I'll send it as an MR.

Ibrahim