Re: [PATCH] drm/vmwgfx: Fix use-after-free race in vmw_dumb_create()

["Nair, Jayapal Ashwin" <jayapalashwin.nair@amd.com>]

On 30-10-2026 06:59, Maaz Mombasawala <maaz.mombasawala@broadcom.com> wrote:
> How is userspace able to see the gem handle to call DRM_IOCTL_GEM_CLOSE
> on it before DRM_IOCTL_MODE_CREATE_DUMB has returned it?
> 
The handle is installed in file_priv->object_idr by
drm_gem_handle_create() inside vmw_gb_surface_define_ext_ioctl(), before
DRM_IOCTL_MODE_CREATE_DUMB returns it, and GEM handles are predictable:
idr_alloc() hands out the lowest free id starting at 1. On a freshly
opened fd the dumb buffer gets handle 1, so a second thread on the same
fd can spin on DRM_IOCTL_GEM_CLOSE(1), getting -EINVAL until the handle
appears. Once closed, id 1 is free again, so the race can be retried
indefinitely.

I tried this methodology and got a KASAN splat:

 BUG: KASAN: slab-use-after-free in vmw_dumb_create+0x705/0x850
   Read of size 8 at addr ffff88810fd5b2d0 by task poc/228
   ...
   Allocated by task 228:
    __kmalloc_cache_noprof+0x166/0x3b0
    vmw_bo_create+0xbc/0x660
    vmw_gem_object_create_with_handle+0xf9/0x190
    vmw_gb_surface_define_internal.constprop.0+0xe23/0x17c0
    vmw_dumb_create+0x415/0x850
   ...
   Freed by task 228:
    kfree+0x216/0x450
    vmw_bo_free+0x414/0x640
    ttm_bo_release+0x3bc/0x9a0
    vmw_dumb_create+0x6d9/0x850
   ...
   The buggy address belongs to the object at ffff88810fd5b000
    which belongs to the cache kmalloc-1k of size 1024
   The buggy address is located 720 bytes inside of
    freed 1024-byte region [ffff88810fd5b000, ffff88810fd5b400)
   ...
   BUG: unable to handle page fault for address: ffffffffffffffb0
   #PF: supervisor write access in kernel mode
   RIP: 0010:vmw_dumb_create+0x667/0x850
   R12: 0000000000000000
   Kernel panic - not syncing: Fatal exception

The read is vbo->dumb_surface (offset 0x2d0); it comes back NULL and the
subsequent usurf->prime.base.refcount_release = NULL store faults at
NULL - 0x50.

> --
> Maaz Mombasawala <maaz.mombasawala@broadcom.com>
>