From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out203-205-221-205.mail.qq.com (out203-205-221-205.mail.qq.com [203.205.221.205]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7ADD72494D8 for ; Thu, 16 Apr 2026 02:59:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=203.205.221.205 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776308382; cv=none; b=SZAfhlm3dYNpc0Jkap0W5DqY6g9B5/FZEjbUgCR6dJRfpQ7wdZS9OglQLdruyRovnLSwG//o17xRZ+7kCHwnc96Sz3HTLKzq+AdzWX7+gqRCZmImLlq/xD4TIGMhYl6vpaqHG5CyNKM7EInznOfdXpwG6l25L3pT3rtJBma7Y5Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776308382; c=relaxed/simple; bh=9PcenXyeeO3qGtjRblCMwAJuu8hkQUNCuUINJyfvxdA=; h=Message-ID:From:To:Cc:Subject:Date:In-Reply-To:References: MIME-Version; b=hZm/oQa403sYCRKncOyHyqvM8acm2JuyyPUsw5OYmhUxok/WnL7YkZYAockJGCIPuS2l0+VtbPYLeVgSNlZBd6kl0A1iTIYM/cu4F6psDG8dFrPdXYDAT8DeQI6L10pXcJgThEeYcTVPJjgZx8wGrjefBuPV7vHXOdqXPj0i+vs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com; spf=pass smtp.mailfrom=qq.com; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b=RJKeh3EH; arc=none smtp.client-ip=203.205.221.205 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=qq.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=qq.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=qq.com header.i=@qq.com header.b="RJKeh3EH" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qq.com; s=s201512; t=1776308371; bh=D/TlFXXdKX2RfmgAKdkGZ6NxeS47miaUYtRcjFY8f3Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=RJKeh3EHTuq5FqXNtVcZHB9sjs5UB/RlZc3jNXPg/Sd5U86nttdoYjShrnN86ZTDg 5McQecsv8XmRgbm3M5/Bnh+IiNwJRmLOcrjYtbHos0r1sCtGr4kSjou5nkOVjP6upW JUcyFbMKdilFqdl9EM7DFjwO40x7CVVNkabyFgSE= Received: from lxu-ped-host.. ([111.198.231.89]) by newxmesmtplogicsvrsza53-0.qq.com (NewEsmtp) with SMTP id EDCB1EBA; Thu, 16 Apr 2026 10:59:28 +0800 X-QQ-mid: xmsmtpt1776308368t94d1jvwn Message-ID: X-QQ-XMAILINFO: MidKUt01ypo8bOjnm03aPjAhOD4UK83yNCFWoOBxjQaBjhDmfK2UcvVga+tgZR GC7ojLuPmNuXKrJmFLWg+gFsZ/z/C1ui16RKKU0BOP0itu+h95/S6WkFf9+6u98vFL3EbHyvVGY6 gxeDPt6jqeYE5Tux0DrEVl8Bixm9ht21f0WfUWsboE3+H+xYvM1nMGLwLlI2z42ehkAVtQnQ6vya qx+7oDwfHBJJG0i6lbGVehkqqUPcj5hIVdu2xjKO4dXsHYyeMrbBECXjuM7TlE0lLSOKHKaiDVbv mTnqapEdCsmUyrPE2ct9pqfhnTQveyfgLr4mYpR8cqluOCfmXGmU13aWe5XvL4UBuV6wfW6jGopz vQNr/SOZxpXxJVcKsRq7rsJFdkp1Isa8LnObKUpj+eHixq4QLOve9+GnnUCf4JdOGqNKljavCzdx 9BMQujGtT3VoSIrpYx+b6aPWoybaVGBJ7WOgzDC8Udp9q4v/CiIRvUha5ARMSLERvKBP1poXSZK1 FpuuZYQjWAeSG77gAQsLgDBeo8OtNbVtIzG5CTopz6I3NHjZuPbMV7r/HTzQCRxPyQMt2BAtuk8f /47P8mOcTBB7rqyzKhdn7kcJeGLWWcbPthTVq007ZF2R1H/oMsBUH6HorMDyqZCrnxi851wo1zL9 uBSsUvwaAQLj/NY2fJQB/INqjxZP436RtdN1UWrDG/tsRuGv+Kig1BzcI9HoscEIzs7MKqczGzMb HkMdLQNiIHATc4GrdP3EzytHYZ+bLZpXkgXYM6VhR9wTa9Sqd9hlcqE6BvGGoTAd8d84Zr94ev/R fLv1S6VYdg1NeSciW/CCUSH6NltJ1f/Tm5E4GzyoBZJH8ClX1iCiB0ComEhVX9D2j3jFWVPESk4H bZl356ceZ0v2o80CQNPTlDLqO8Bqcmhftvhd//VJBfNjaUvBV5muRTG/bVen2G9xx4S6DPNEPtO1 ProS1W8Y+/fzgQbccl53UuYbr3jfFfHXqp2VVEFyDorranvMaxW3RYb6J+hq887QCTpRa91Ujflf lrXmowC8a9LMzc0gEkgm7E0l4TTTh8/Kd+Bi4Qfw== X-QQ-XMRINFO: Nq+8W0+stu50tPAe92KXseR0ZZmBTk3gLg== From: Edward Adam Davis To: syzbot+b2e951687503f32f74ce@syzkaller.appspotmail.com Cc: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: [syzbot] [dri?] KASAN: slab-use-after-free Read in drm_gem_object_release_handle Date: Thu, 16 Apr 2026 10:59:29 +0800 X-OQ-MSGID: <20260416025928.357214-2-eadavis@qq.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <69dd24f4.a00a0220.468cb.004a.GAE@google.com> References: <69dd24f4.a00a0220.468cb.004a.GAE@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit #syz test diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 891c3bff5ae0..63a8d7e980b5 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -374,14 +374,8 @@ drm_gem_object_release_handle(int id, void *ptr, void *data) if (obj->funcs->close) obj->funcs->close(obj, file_priv); - mutex_lock(&file_priv->prime.lock); - drm_prime_remove_buf_handle(&file_priv->prime, id); - - mutex_unlock(&file_priv->prime.lock); - drm_vma_node_revoke(&obj->vma_node, file_priv); - drm_gem_object_handle_put_unlocked(obj); return 0; @@ -401,13 +395,16 @@ drm_gem_handle_delete(struct drm_file *filp, u32 handle) { struct drm_gem_object *obj; + mutex_lock(&filp->prime.lock); spin_lock(&filp->table_lock); /* Check if we currently have a reference on the object */ obj = idr_replace(&filp->object_idr, NULL, handle); spin_unlock(&filp->table_lock); - if (IS_ERR_OR_NULL(obj)) + if (IS_ERR_OR_NULL(obj)) { + mutex_unlock(&filp->prime.lock); return -EINVAL; + } /* Release driver's reference and decrement refcount. */ drm_gem_object_release_handle(handle, obj, filp); @@ -416,6 +413,7 @@ drm_gem_handle_delete(struct drm_file *filp, u32 handle) spin_lock(&filp->table_lock); idr_remove(&filp->object_idr, handle); spin_unlock(&filp->table_lock); + mutex_unlock(&filp->prime.lock); return 0; } @@ -1012,17 +1010,18 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data, return -EINVAL; handle = args->new_handle; + mutex_lock(&file_priv->prime.lock); obj = drm_gem_object_lookup(file_priv, args->handle); - if (!obj) + if (!obj) { + mutex_unlock(&file_priv->prime.lock); return -ENOENT; + } if (args->handle == handle) { ret = 0; - goto out; + goto out_unlock; } - mutex_lock(&file_priv->prime.lock); - spin_lock(&file_priv->table_lock); ret = idr_alloc(&file_priv->object_idr, obj, handle, handle + 1, GFP_NOWAIT); @@ -1051,9 +1050,8 @@ int drm_gem_change_handle_ioctl(struct drm_device *dev, void *data, spin_unlock(&file_priv->table_lock); out_unlock: - mutex_unlock(&file_priv->prime.lock); -out: drm_gem_object_put(obj); + mutex_unlock(&file_priv->prime.lock); return ret; } @@ -1085,8 +1083,10 @@ drm_gem_open(struct drm_device *dev, struct drm_file *file_private) void drm_gem_release(struct drm_device *dev, struct drm_file *file_private) { + mutex_lock(&file_private->prime.lock); idr_for_each(&file_private->object_idr, &drm_gem_object_release_handle, file_private); + mutex_unlock(&file_private->prime.lock); idr_destroy(&file_private->object_idr); }