public inbox for netdev@vger.kernel.org 
 help / color / mirror / Atom feed

From: Dan Carpenter <dan.carpenter@oracle•com>
To: syzbot <syzbot+0dc4444774d419e916c8@syzkaller•appspotmail.com>
Cc: airlied@linux•ie, alexander.deucher@amd•com,
	amd-gfx@lists•freedesktop.org, chris@chris-wilson•co.uk,
	christian.koenig@amd•com, daniel@ffwll•ch, davem@davemloft•net,
	dri-devel@lists•freedesktop.org, emil.velikov@collabora•com,
	eric@anholt•net, linaro-mm-sig@lists•linaro.org,
	linux-kernel@vger•kernel.org, linux-media@vger•kernel.org,
	netdev@vger•kernel.org, robdclark@chromium•org,
	seanpaul@chromium•org, sumit.semwal@linaro•org,
	syzkaller-bugs@googlegroups•com
Subject: Re: KASAN: use-after-free Read in vgem_gem_dumb_create
Date: Sat, 1 Feb 2020 08:56:12 +0300	[thread overview]
Message-ID: <20200201055612.GF1778@kadam> (raw)
In-Reply-To: <000000000000ae2f81059d7716b8@google.com>

I don't totally understand the stack trace but I do see a double free
bug.

drivers/gpu/drm/vgem/vgem_drv.c
   186  static struct drm_gem_object *vgem_gem_create(struct drm_device *dev,
   187                                                struct drm_file *file,
   188                                                unsigned int *handle,
   189                                                unsigned long size)
   190  {
   191          struct drm_vgem_gem_object *obj;
   192          int ret;
   193  
   194          obj = __vgem_gem_create(dev, size);

obj->base.handle_count is zero.

   195          if (IS_ERR(obj))
   196                  return ERR_CAST(obj);
   197  
   198          ret = drm_gem_handle_create(file, &obj->base, handle);

We bump it +1 and then the error handling calls
drm_gem_object_handle_put_unlocked(obj);
which calls drm_gem_object_put_unlocked(); which frees obj.


   199          drm_gem_object_put_unlocked(&obj->base);

So this is a double free.  Could someone check my thinking and send
a patch?  It's just a one liner.  Otherwise I can send it on Monday.

   200          if (ret)
   201                  return ERR_PTR(ret);
   202  
   203          return &obj->base;
   204  }

regards,
dan carpenter

next prev parent reply	other threads:[~2020-02-01  5:57 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-01-31 22:28 KASAN: use-after-free Read in vgem_gem_dumb_create syzbot
2020-02-01  5:56 ` Dan Carpenter [this message]
2020-02-02  4:38 ` syzbot
2020-02-02 13:19 ` Daniel Vetter
2020-02-03  9:06   ` Dan Carpenter
2020-02-03 15:08     ` Christian König
     [not found] <20200201043209.13412-1-hdanton@sina.com>
2020-02-01  6:17 ` Dan Carpenter
     [not found] ` <20200201090247.10928-1-hdanton@sina.com>
2020-02-01 16:25   ` Dan Carpenter
2020-02-02 13:17     ` Daniel Vetter

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200201055612.GF1778@kadam \
    --to=dan.carpenter@oracle$(echo .)com \
    --cc=airlied@linux$(echo .)ie \
    --cc=alexander.deucher@amd$(echo .)com \
    --cc=amd-gfx@lists$(echo .)freedesktop.org \
    --cc=chris@chris-wilson$(echo .)co.uk \
    --cc=christian.koenig@amd$(echo .)com \
    --cc=daniel@ffwll$(echo .)ch \
    --cc=davem@davemloft$(echo .)net \
    --cc=dri-devel@lists$(echo .)freedesktop.org \
    --cc=emil.velikov@collabora$(echo .)com \
    --cc=eric@anholt$(echo .)net \
    --cc=linaro-mm-sig@lists$(echo .)linaro.org \
    --cc=linux-kernel@vger$(echo .)kernel.org \
    --cc=linux-media@vger$(echo .)kernel.org \
    --cc=netdev@vger$(echo .)kernel.org \
    --cc=robdclark@chromium$(echo .)org \
    --cc=seanpaul@chromium$(echo .)org \
    --cc=sumit.semwal@linaro$(echo .)org \
    --cc=syzbot+0dc4444774d419e916c8@syzkaller$(echo .)appspotmail.com \
    --cc=syzkaller-bugs@googlegroups$(echo .)com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox