mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-03 07:38:10 +00:00
drm: protect drm_master pointers in drm_lease.c
[ Upstream commit 56f0729a51
]
drm_file->master pointers should be protected by
drm_device.master_mutex or drm_file.master_lookup_lock when being
dereferenced.
However, in drm_lease.c, there are multiple instances where
drm_file->master is accessed and dereferenced while neither lock is
held. This makes drm_lease.c vulnerable to use-after-free bugs.
We address this issue in 2 ways:
1. Add a new drm_file_get_master() function that calls drm_master_get
on drm_file->master while holding on to
drm_file.master_lookup_lock. Since drm_master_get increments the
reference count of master, this prevents master from being freed until
we unreference it with drm_master_put.
2. In each case where drm_file->master is directly accessed and
eventually dereferenced in drm_lease.c, we wrap the access in a call
to the new drm_file_get_master function, then unreference the master
pointer once we are done using it.
Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210712043508.11584-6-desmondcheongzx@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
06a553a99b
commit
34609faad0
4 changed files with 93 additions and 20 deletions
|
@ -376,6 +376,31 @@ struct drm_master *drm_master_get(struct drm_master *master)
|
||||||
}
|
}
|
||||||
EXPORT_SYMBOL(drm_master_get);
|
EXPORT_SYMBOL(drm_master_get);
|
||||||
|
|
||||||
|
/**
|
||||||
|
* drm_file_get_master - reference &drm_file.master of @file_priv
|
||||||
|
* @file_priv: DRM file private
|
||||||
|
*
|
||||||
|
* Increments the reference count of @file_priv's &drm_file.master and returns
|
||||||
|
* the &drm_file.master. If @file_priv has no &drm_file.master, returns NULL.
|
||||||
|
*
|
||||||
|
* Master pointers returned from this function should be unreferenced using
|
||||||
|
* drm_master_put().
|
||||||
|
*/
|
||||||
|
struct drm_master *drm_file_get_master(struct drm_file *file_priv)
|
||||||
|
{
|
||||||
|
struct drm_master *master = NULL;
|
||||||
|
|
||||||
|
spin_lock(&file_priv->master_lookup_lock);
|
||||||
|
if (!file_priv->master)
|
||||||
|
goto unlock;
|
||||||
|
master = drm_master_get(file_priv->master);
|
||||||
|
|
||||||
|
unlock:
|
||||||
|
spin_unlock(&file_priv->master_lookup_lock);
|
||||||
|
return master;
|
||||||
|
}
|
||||||
|
EXPORT_SYMBOL(drm_file_get_master);
|
||||||
|
|
||||||
static void drm_master_destroy(struct kref *kref)
|
static void drm_master_destroy(struct kref *kref)
|
||||||
{
|
{
|
||||||
struct drm_master *master = container_of(kref, struct drm_master, refcount);
|
struct drm_master *master = container_of(kref, struct drm_master, refcount);
|
||||||
|
|
|
@ -107,10 +107,19 @@ static bool _drm_has_leased(struct drm_master *master, int id)
|
||||||
*/
|
*/
|
||||||
bool _drm_lease_held(struct drm_file *file_priv, int id)
|
bool _drm_lease_held(struct drm_file *file_priv, int id)
|
||||||
{
|
{
|
||||||
if (!file_priv || !file_priv->master)
|
bool ret;
|
||||||
|
struct drm_master *master;
|
||||||
|
|
||||||
|
if (!file_priv)
|
||||||
return true;
|
return true;
|
||||||
|
|
||||||
return _drm_lease_held_master(file_priv->master, id);
|
master = drm_file_get_master(file_priv);
|
||||||
|
if (!master)
|
||||||
|
return true;
|
||||||
|
ret = _drm_lease_held_master(master, id);
|
||||||
|
drm_master_put(&master);
|
||||||
|
|
||||||
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
@ -129,13 +138,22 @@ bool drm_lease_held(struct drm_file *file_priv, int id)
|
||||||
struct drm_master *master;
|
struct drm_master *master;
|
||||||
bool ret;
|
bool ret;
|
||||||
|
|
||||||
if (!file_priv || !file_priv->master || !file_priv->master->lessor)
|
if (!file_priv)
|
||||||
return true;
|
return true;
|
||||||
|
|
||||||
master = file_priv->master;
|
master = drm_file_get_master(file_priv);
|
||||||
|
if (!master)
|
||||||
|
return true;
|
||||||
|
if (!master->lessor) {
|
||||||
|
ret = true;
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
mutex_lock(&master->dev->mode_config.idr_mutex);
|
mutex_lock(&master->dev->mode_config.idr_mutex);
|
||||||
ret = _drm_lease_held_master(master, id);
|
ret = _drm_lease_held_master(master, id);
|
||||||
mutex_unlock(&master->dev->mode_config.idr_mutex);
|
mutex_unlock(&master->dev->mode_config.idr_mutex);
|
||||||
|
|
||||||
|
out:
|
||||||
|
drm_master_put(&master);
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -155,10 +173,16 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
|
||||||
int count_in, count_out;
|
int count_in, count_out;
|
||||||
uint32_t crtcs_out = 0;
|
uint32_t crtcs_out = 0;
|
||||||
|
|
||||||
if (!file_priv || !file_priv->master || !file_priv->master->lessor)
|
if (!file_priv)
|
||||||
return crtcs_in;
|
return crtcs_in;
|
||||||
|
|
||||||
master = file_priv->master;
|
master = drm_file_get_master(file_priv);
|
||||||
|
if (!master)
|
||||||
|
return crtcs_in;
|
||||||
|
if (!master->lessor) {
|
||||||
|
crtcs_out = crtcs_in;
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
dev = master->dev;
|
dev = master->dev;
|
||||||
|
|
||||||
count_in = count_out = 0;
|
count_in = count_out = 0;
|
||||||
|
@ -177,6 +201,9 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)
|
||||||
count_in++;
|
count_in++;
|
||||||
}
|
}
|
||||||
mutex_unlock(&master->dev->mode_config.idr_mutex);
|
mutex_unlock(&master->dev->mode_config.idr_mutex);
|
||||||
|
|
||||||
|
out:
|
||||||
|
drm_master_put(&master);
|
||||||
return crtcs_out;
|
return crtcs_out;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -490,7 +517,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
|
||||||
size_t object_count;
|
size_t object_count;
|
||||||
int ret = 0;
|
int ret = 0;
|
||||||
struct idr leases;
|
struct idr leases;
|
||||||
struct drm_master *lessor = lessor_priv->master;
|
struct drm_master *lessor;
|
||||||
struct drm_master *lessee = NULL;
|
struct drm_master *lessee = NULL;
|
||||||
struct file *lessee_file = NULL;
|
struct file *lessee_file = NULL;
|
||||||
struct file *lessor_file = lessor_priv->filp;
|
struct file *lessor_file = lessor_priv->filp;
|
||||||
|
@ -502,12 +529,6 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
|
||||||
if (!drm_core_check_feature(dev, DRIVER_MODESET))
|
if (!drm_core_check_feature(dev, DRIVER_MODESET))
|
||||||
return -EOPNOTSUPP;
|
return -EOPNOTSUPP;
|
||||||
|
|
||||||
/* Do not allow sub-leases */
|
|
||||||
if (lessor->lessor) {
|
|
||||||
DRM_DEBUG_LEASE("recursive leasing not allowed\n");
|
|
||||||
return -EINVAL;
|
|
||||||
}
|
|
||||||
|
|
||||||
/* need some objects */
|
/* need some objects */
|
||||||
if (cl->object_count == 0) {
|
if (cl->object_count == 0) {
|
||||||
DRM_DEBUG_LEASE("no objects in lease\n");
|
DRM_DEBUG_LEASE("no objects in lease\n");
|
||||||
|
@ -519,12 +540,22 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
lessor = drm_file_get_master(lessor_priv);
|
||||||
|
/* Do not allow sub-leases */
|
||||||
|
if (lessor->lessor) {
|
||||||
|
DRM_DEBUG_LEASE("recursive leasing not allowed\n");
|
||||||
|
ret = -EINVAL;
|
||||||
|
goto out_lessor;
|
||||||
|
}
|
||||||
|
|
||||||
object_count = cl->object_count;
|
object_count = cl->object_count;
|
||||||
|
|
||||||
object_ids = memdup_user(u64_to_user_ptr(cl->object_ids),
|
object_ids = memdup_user(u64_to_user_ptr(cl->object_ids),
|
||||||
array_size(object_count, sizeof(__u32)));
|
array_size(object_count, sizeof(__u32)));
|
||||||
if (IS_ERR(object_ids))
|
if (IS_ERR(object_ids)) {
|
||||||
return PTR_ERR(object_ids);
|
ret = PTR_ERR(object_ids);
|
||||||
|
goto out_lessor;
|
||||||
|
}
|
||||||
|
|
||||||
idr_init(&leases);
|
idr_init(&leases);
|
||||||
|
|
||||||
|
@ -535,14 +566,15 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
|
||||||
if (ret) {
|
if (ret) {
|
||||||
DRM_DEBUG_LEASE("lease object lookup failed: %i\n", ret);
|
DRM_DEBUG_LEASE("lease object lookup failed: %i\n", ret);
|
||||||
idr_destroy(&leases);
|
idr_destroy(&leases);
|
||||||
return ret;
|
goto out_lessor;
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Allocate a file descriptor for the lease */
|
/* Allocate a file descriptor for the lease */
|
||||||
fd = get_unused_fd_flags(cl->flags & (O_CLOEXEC | O_NONBLOCK));
|
fd = get_unused_fd_flags(cl->flags & (O_CLOEXEC | O_NONBLOCK));
|
||||||
if (fd < 0) {
|
if (fd < 0) {
|
||||||
idr_destroy(&leases);
|
idr_destroy(&leases);
|
||||||
return fd;
|
ret = fd;
|
||||||
|
goto out_lessor;
|
||||||
}
|
}
|
||||||
|
|
||||||
DRM_DEBUG_LEASE("Creating lease\n");
|
DRM_DEBUG_LEASE("Creating lease\n");
|
||||||
|
@ -578,6 +610,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
|
||||||
/* Hook up the fd */
|
/* Hook up the fd */
|
||||||
fd_install(fd, lessee_file);
|
fd_install(fd, lessee_file);
|
||||||
|
|
||||||
|
drm_master_put(&lessor);
|
||||||
DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl succeeded\n");
|
DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl succeeded\n");
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
|
@ -587,6 +620,8 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
|
||||||
out_leases:
|
out_leases:
|
||||||
put_unused_fd(fd);
|
put_unused_fd(fd);
|
||||||
|
|
||||||
|
out_lessor:
|
||||||
|
drm_master_put(&lessor);
|
||||||
DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl failed: %d\n", ret);
|
DRM_DEBUG_LEASE("drm_mode_create_lease_ioctl failed: %d\n", ret);
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
@ -609,7 +644,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
|
||||||
struct drm_mode_list_lessees *arg = data;
|
struct drm_mode_list_lessees *arg = data;
|
||||||
__u32 __user *lessee_ids = (__u32 __user *) (uintptr_t) (arg->lessees_ptr);
|
__u32 __user *lessee_ids = (__u32 __user *) (uintptr_t) (arg->lessees_ptr);
|
||||||
__u32 count_lessees = arg->count_lessees;
|
__u32 count_lessees = arg->count_lessees;
|
||||||
struct drm_master *lessor = lessor_priv->master, *lessee;
|
struct drm_master *lessor, *lessee;
|
||||||
int count;
|
int count;
|
||||||
int ret = 0;
|
int ret = 0;
|
||||||
|
|
||||||
|
@ -620,6 +655,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
|
||||||
if (!drm_core_check_feature(dev, DRIVER_MODESET))
|
if (!drm_core_check_feature(dev, DRIVER_MODESET))
|
||||||
return -EOPNOTSUPP;
|
return -EOPNOTSUPP;
|
||||||
|
|
||||||
|
lessor = drm_file_get_master(lessor_priv);
|
||||||
DRM_DEBUG_LEASE("List lessees for %d\n", lessor->lessee_id);
|
DRM_DEBUG_LEASE("List lessees for %d\n", lessor->lessee_id);
|
||||||
|
|
||||||
mutex_lock(&dev->mode_config.idr_mutex);
|
mutex_lock(&dev->mode_config.idr_mutex);
|
||||||
|
@ -643,6 +679,7 @@ int drm_mode_list_lessees_ioctl(struct drm_device *dev,
|
||||||
arg->count_lessees = count;
|
arg->count_lessees = count;
|
||||||
|
|
||||||
mutex_unlock(&dev->mode_config.idr_mutex);
|
mutex_unlock(&dev->mode_config.idr_mutex);
|
||||||
|
drm_master_put(&lessor);
|
||||||
|
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
@ -662,7 +699,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
|
||||||
struct drm_mode_get_lease *arg = data;
|
struct drm_mode_get_lease *arg = data;
|
||||||
__u32 __user *object_ids = (__u32 __user *) (uintptr_t) (arg->objects_ptr);
|
__u32 __user *object_ids = (__u32 __user *) (uintptr_t) (arg->objects_ptr);
|
||||||
__u32 count_objects = arg->count_objects;
|
__u32 count_objects = arg->count_objects;
|
||||||
struct drm_master *lessee = lessee_priv->master;
|
struct drm_master *lessee;
|
||||||
struct idr *object_idr;
|
struct idr *object_idr;
|
||||||
int count;
|
int count;
|
||||||
void *entry;
|
void *entry;
|
||||||
|
@ -676,6 +713,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
|
||||||
if (!drm_core_check_feature(dev, DRIVER_MODESET))
|
if (!drm_core_check_feature(dev, DRIVER_MODESET))
|
||||||
return -EOPNOTSUPP;
|
return -EOPNOTSUPP;
|
||||||
|
|
||||||
|
lessee = drm_file_get_master(lessee_priv);
|
||||||
DRM_DEBUG_LEASE("get lease for %d\n", lessee->lessee_id);
|
DRM_DEBUG_LEASE("get lease for %d\n", lessee->lessee_id);
|
||||||
|
|
||||||
mutex_lock(&dev->mode_config.idr_mutex);
|
mutex_lock(&dev->mode_config.idr_mutex);
|
||||||
|
@ -703,6 +741,7 @@ int drm_mode_get_lease_ioctl(struct drm_device *dev,
|
||||||
arg->count_objects = count;
|
arg->count_objects = count;
|
||||||
|
|
||||||
mutex_unlock(&dev->mode_config.idr_mutex);
|
mutex_unlock(&dev->mode_config.idr_mutex);
|
||||||
|
drm_master_put(&lessee);
|
||||||
|
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
@ -721,7 +760,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
|
||||||
void *data, struct drm_file *lessor_priv)
|
void *data, struct drm_file *lessor_priv)
|
||||||
{
|
{
|
||||||
struct drm_mode_revoke_lease *arg = data;
|
struct drm_mode_revoke_lease *arg = data;
|
||||||
struct drm_master *lessor = lessor_priv->master;
|
struct drm_master *lessor;
|
||||||
struct drm_master *lessee;
|
struct drm_master *lessee;
|
||||||
int ret = 0;
|
int ret = 0;
|
||||||
|
|
||||||
|
@ -731,6 +770,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
|
||||||
if (!drm_core_check_feature(dev, DRIVER_MODESET))
|
if (!drm_core_check_feature(dev, DRIVER_MODESET))
|
||||||
return -EOPNOTSUPP;
|
return -EOPNOTSUPP;
|
||||||
|
|
||||||
|
lessor = drm_file_get_master(lessor_priv);
|
||||||
mutex_lock(&dev->mode_config.idr_mutex);
|
mutex_lock(&dev->mode_config.idr_mutex);
|
||||||
|
|
||||||
lessee = _drm_find_lessee(lessor, arg->lessee_id);
|
lessee = _drm_find_lessee(lessor, arg->lessee_id);
|
||||||
|
@ -751,6 +791,7 @@ int drm_mode_revoke_lease_ioctl(struct drm_device *dev,
|
||||||
|
|
||||||
fail:
|
fail:
|
||||||
mutex_unlock(&dev->mode_config.idr_mutex);
|
mutex_unlock(&dev->mode_config.idr_mutex);
|
||||||
|
drm_master_put(&lessor);
|
||||||
|
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
|
@ -107,6 +107,7 @@ struct drm_master {
|
||||||
};
|
};
|
||||||
|
|
||||||
struct drm_master *drm_master_get(struct drm_master *master);
|
struct drm_master *drm_master_get(struct drm_master *master);
|
||||||
|
struct drm_master *drm_file_get_master(struct drm_file *file_priv);
|
||||||
void drm_master_put(struct drm_master **master);
|
void drm_master_put(struct drm_master **master);
|
||||||
bool drm_is_current_master(struct drm_file *fpriv);
|
bool drm_is_current_master(struct drm_file *fpriv);
|
||||||
|
|
||||||
|
|
|
@ -233,6 +233,12 @@ struct drm_file {
|
||||||
* this only matches &drm_device.master if the master is the currently
|
* this only matches &drm_device.master if the master is the currently
|
||||||
* active one.
|
* active one.
|
||||||
*
|
*
|
||||||
|
* When dereferencing this pointer, either hold struct
|
||||||
|
* &drm_device.master_mutex for the duration of the pointer's use, or
|
||||||
|
* use drm_file_get_master() if struct &drm_device.master_mutex is not
|
||||||
|
* currently held and there is no other need to hold it. This prevents
|
||||||
|
* @master from being freed during use.
|
||||||
|
*
|
||||||
* See also @authentication and @is_master and the :ref:`section on
|
* See also @authentication and @is_master and the :ref:`section on
|
||||||
* primary nodes and authentication <drm_primary_node>`.
|
* primary nodes and authentication <drm_primary_node>`.
|
||||||
*/
|
*/
|
||||||
|
|
Loading…
Reference in a new issue