[PATCH v2 3/5] drm/gud: Prevent shadow_buf UAF by flushing work before reallocating

[Hui Peng <benquike@gmail.com>]

In gud_fb_queue_damage(), freeing gdrm->shadow_buf on framebuffer
dimension changes while the asynchronous worker gud_flush_work() is
running causes a race condition where gud_flush_work() dereferences the
freed gdrm->shadow_buf during a USB bulk transfer, triggering a slab
Use-After-Free (UAF).

Flush any pending background work (flush_work(&gdrm->work)) prior to
freeing and reallocating gdrm->shadow_buf when framebuffer dimensions
change.

Tested in QEMU against Linux 7.3.0-rc3 with KASAN enabled by queuing damage
on a resized framebuffer while background USB flush work (gud_flush_work)
was actively reading shadow_buf: on the unfixed kernel KASAN detected
BUG: KASAN: slab-use-after-free in gud_flush_damage(); whereas with this
fix applied (flushing pending work before vfreeing shadow_buf), 0 KASAN
warnings were generated.

Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
 drivers/gpu/drm/gud/gud_pipe.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/gpu/drm/gud/gud_pipe.c b/drivers/gpu/drm/gud/gud_pipe.c
index aa7792966287..f9726e3d849f 100644
--- a/drivers/gpu/drm/gud/gud_pipe.c
+++ b/drivers/gpu/drm/gud/gud_pipe.c
@@ -397,6 +407,16 @@ static int gud_fb_queue_damage(struct gud_device *gdrm, struct drm_framebuffer *
 	struct drm_framebuffer *old_fb = NULL;
 	struct iosys_map shadow_map;

+	if (gdrm->shadow_buf && gdrm->fb &&
+	    (fb->pitches[0] != gdrm->fb->pitches[0] || fb->height != gdrm->fb->height)) {
+		flush_work(&gdrm->work);
+		mutex_lock(&gdrm->damage_lock);
+		vfree(gdrm->shadow_buf);
+		gdrm->shadow_buf = NULL;
+		gud_clear_damage(gdrm);
+		mutex_unlock(&gdrm->damage_lock);
+	}
+
 	mutex_lock(&gdrm->damage_lock);

 	if (!gdrm->shadow_buf) {