From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E50BEC46467 for ; Tue, 10 Jan 2023 09:38:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238232AbjAJJiy (ORCPT ); Tue, 10 Jan 2023 04:38:54 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49488 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238312AbjAJJip (ORCPT ); Tue, 10 Jan 2023 04:38:45 -0500 Received: from madras.collabora.co.uk (madras.collabora.co.uk [IPv6:2a00:1098:0:82:1000:25:2eeb:e5ab]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B8906496F3 for ; Tue, 10 Jan 2023 01:38:44 -0800 (PST) Received: from [192.168.2.154] (unknown [109.252.117.89]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: dmitry.osipenko) by madras.collabora.co.uk (Postfix) with ESMTPSA id D10C96602D6F; Tue, 10 Jan 2023 09:38:42 +0000 (GMT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=collabora.com; s=mail; t=1673343523; bh=y621n6SK+X9Nfr6zTaXGBH56ErBaS4V28NM92YYWqYY=; h=Date:Subject:To:Cc:References:From:In-Reply-To:From; b=BZgAAaz75Le5OkwMuhF1zfEasbE1EvqMpyM+kkIhWn0GEzctXKCICHmiL2Mav/6kO YogJJ5YSFCnrSiKiWmQP65FHgKacrPwUDyVyyu8AJtwN13TBzE34S8zmpClQSTL4L+ ytl41dkfZKa9zOnp6c/L5+kJYogq7Cv3vZFVXwJF7t0gZbiq8Xf4lbvHPkYPJRd0oq 1Dpe63Q7q8EeTURYHqV9Q6auxbxxWhooRpWPPldSriYoxgOe5azGmDpadfWJ88kvL1 E5GIvgqzRlSh67dZboEF0119M19z/CawR3YYwewbAZbqyVw8kuSQlz/zCilIV1jdUp aTrrZanoexwVg== Message-ID: <36bbc210-9f8c-ac18-9322-110949b746cb@collabora.com> Date: Tue, 10 Jan 2023 12:38:39 +0300 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.6.0 Subject: Re: [PATCH] drm/virtio: Fix GEM handle creation UAF Content-Language: en-US To: Rob Clark Cc: dri-devel@lists.freedesktop.org, Rob Clark , open list , Gurchetan Singh , Gerd Hoffmann , David Airlie , "open list:VIRTIO GPU DRIVER" References: <20221216233355.542197-1-robdclark@gmail.com> <20221216233355.542197-2-robdclark@gmail.com> <3ae74f28-580b-3b53-3d7b-e8bde97dabe3@collabora.com> From: Dmitry Osipenko In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 1/10/23 04:47, Rob Clark wrote: > On Mon, Jan 9, 2023 at 3:28 PM Dmitry Osipenko > wrote: >> >> On 12/17/22 02:33, Rob Clark wrote: >>> From: Rob Clark >>> >>> Userspace can guess the handle value and try to race GEM object creation >>> with handle close, resulting in a use-after-free if we dereference the >>> object after dropping the handle's reference. For that reason, dropping >>> the handle's reference must be done *after* we are done dereferencing >>> the object. >>> >>> Signed-off-by: Rob Clark >>> --- >>> drivers/gpu/drm/virtio/virtgpu_ioctl.c | 19 +++++++++++++++++-- >>> 1 file changed, 17 insertions(+), 2 deletions(-) >> >> Added fixes/stable tags and applied this virtio-gpu patch to misc-fixes. >> The Panfrost patch is untouched. > > Thanks.. the panfrost patch was not intended to be part of the same > series (but apparently that is what happens when I send them at the > same time), and was superceded by a patch from Steven Price (commit > 4217c6ac8174 ("drm/panfrost: Fix GEM handle creation ref-counting") > already applied to misc-fixes Okay, I wanted to make clear what has been applied. -- Best regards, Dmitry