mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/drivers
History
Vitaly Prosyak e87e08c94c drm/amdgpu: fix use-after-free bug 
commit 22207fd5c8 upstream.

The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl
to the AMDGPU DRM driver on any ASICs with an invalid address and size.
The bug was reported by Joonkyo Jung <joonkyoj@yonsei.ac.kr>.
For example the following code:

static void Syzkaller1(int fd)
{
	struct drm_amdgpu_gem_userptr arg;
	int ret;

	arg.addr = 0xffffffffffff0000;
	arg.size = 0x80000000; /*2 Gb*/
	arg.flags = 0x7;
	ret = drmIoctl(fd, 0xc1186451/*amdgpu_gem_userptr_ioctl*/, &arg);
}

Due to the address and size are not valid there is a failure in
amdgpu_hmm_register->mmu_interval_notifier_insert->__mmu_interval_notifier_insert->
check_shl_overflow, but we even the amdgpu_hmm_register failure we still call
amdgpu_hmm_unregister into  amdgpu_gem_object_free which causes access to a bad address.
The following stack is below when the issue is reproduced when Kazan is enabled:

[  +0.000014] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020
[  +0.000009] RIP: 0010:mmu_interval_notifier_remove+0x327/0x340
[  +0.000017] Code: ff ff 49 89 44 24 08 48 b8 00 01 00 00 00 00 ad de 4c 89 f7 49 89 47 40 48 83 c0 22 49 89 47 48 e8 ce d1 2d 01 e9 32 ff ff ff <0f> 0b e9 16 ff ff ff 4c 89 ef e8 fa 14 b3 ff e9 36 ff ff ff e8 80
[  +0.000014] RSP: 0018:ffffc90002657988 EFLAGS: 00010246
[  +0.000013] RAX: 0000000000000000 RBX: 1ffff920004caf35 RCX: ffffffff8160565b
[  +0.000011] RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffff8881a9f78260
[  +0.000010] RBP: ffffc90002657a70 R08: 0000000000000001 R09: fffff520004caf25
[  +0.000010] R10: 0000000000000003 R11: ffffffff8161d1d6 R12: ffff88810e988c00
[  +0.000010] R13: ffff888126fb5a00 R14: ffff88810e988c0c R15: ffff8881a9f78260
[  +0.000011] FS:  00007ff9ec848540(0000) GS:ffff8883cc880000(0000) knlGS:0000000000000000
[  +0.000012] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  +0.000010] CR2: 000055b3f7e14328 CR3: 00000001b5770000 CR4: 0000000000350ef0
[  +0.000010] Call Trace:
[  +0.000006]  <TASK>
[  +0.000007]  ? show_regs+0x6a/0x80
[  +0.000018]  ? __warn+0xa5/0x1b0
[  +0.000019]  ? mmu_interval_notifier_remove+0x327/0x340
[  +0.000018]  ? report_bug+0x24a/0x290
[  +0.000022]  ? handle_bug+0x46/0x90
[  +0.000015]  ? exc_invalid_op+0x19/0x50
[  +0.000016]  ? asm_exc_invalid_op+0x1b/0x20
[  +0.000017]  ? kasan_save_stack+0x26/0x50
[  +0.000017]  ? mmu_interval_notifier_remove+0x23b/0x340
[  +0.000019]  ? mmu_interval_notifier_remove+0x327/0x340
[  +0.000019]  ? mmu_interval_notifier_remove+0x23b/0x340
[  +0.000020]  ? __pfx_mmu_interval_notifier_remove+0x10/0x10
[  +0.000017]  ? kasan_save_alloc_info+0x1e/0x30
[  +0.000018]  ? srso_return_thunk+0x5/0x5f
[  +0.000014]  ? __kasan_kmalloc+0xb1/0xc0
[  +0.000018]  ? srso_return_thunk+0x5/0x5f
[  +0.000013]  ? __kasan_check_read+0x11/0x20
[  +0.000020]  amdgpu_hmm_unregister+0x34/0x50 [amdgpu]
[  +0.004695]  amdgpu_gem_object_free+0x66/0xa0 [amdgpu]
[  +0.004534]  ? __pfx_amdgpu_gem_object_free+0x10/0x10 [amdgpu]
[  +0.004291]  ? do_syscall_64+0x5f/0xe0
[  +0.000023]  ? srso_return_thunk+0x5/0x5f
[  +0.000017]  drm_gem_object_free+0x3b/0x50 [drm]
[  +0.000489]  amdgpu_gem_userptr_ioctl+0x306/0x500 [amdgpu]
[  +0.004295]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]
[  +0.004270]  ? srso_return_thunk+0x5/0x5f
[  +0.000014]  ? __this_cpu_preempt_check+0x13/0x20
[  +0.000015]  ? srso_return_thunk+0x5/0x5f
[  +0.000013]  ? sysvec_apic_timer_interrupt+0x57/0xc0
[  +0.000020]  ? srso_return_thunk+0x5/0x5f
[  +0.000014]  ? asm_sysvec_apic_timer_interrupt+0x1b/0x20
[  +0.000022]  ? drm_ioctl_kernel+0x17b/0x1f0 [drm]
[  +0.000496]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]
[  +0.004272]  ? drm_ioctl_kernel+0x190/0x1f0 [drm]
[  +0.000492]  drm_ioctl_kernel+0x140/0x1f0 [drm]
[  +0.000497]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]
[  +0.004297]  ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm]
[  +0.000489]  ? srso_return_thunk+0x5/0x5f
[  +0.000011]  ? __kasan_check_write+0x14/0x20
[  +0.000016]  drm_ioctl+0x3da/0x730 [drm]
[  +0.000475]  ? __pfx_amdgpu_gem_userptr_ioctl+0x10/0x10 [amdgpu]
[  +0.004293]  ? __pfx_drm_ioctl+0x10/0x10 [drm]
[  +0.000506]  ? __pfx_rpm_resume+0x10/0x10
[  +0.000016]  ? srso_return_thunk+0x5/0x5f
[  +0.000011]  ? __kasan_check_write+0x14/0x20
[  +0.000010]  ? srso_return_thunk+0x5/0x5f
[  +0.000011]  ? _raw_spin_lock_irqsave+0x99/0x100
[  +0.000015]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[  +0.000014]  ? srso_return_thunk+0x5/0x5f
[  +0.000013]  ? srso_return_thunk+0x5/0x5f
[  +0.000011]  ? srso_return_thunk+0x5/0x5f
[  +0.000011]  ? preempt_count_sub+0x18/0xc0
[  +0.000013]  ? srso_return_thunk+0x5/0x5f
[  +0.000010]  ? _raw_spin_unlock_irqrestore+0x27/0x50
[  +0.000019]  amdgpu_drm_ioctl+0x7e/0xe0 [amdgpu]
[  +0.004272]  __x64_sys_ioctl+0xcd/0x110
[  +0.000020]  do_syscall_64+0x5f/0xe0
[  +0.000021]  entry_SYSCALL_64_after_hwframe+0x6e/0x76
[  +0.000015] RIP: 0033:0x7ff9ed31a94f
[  +0.000012] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <41> 89 c0 3d 00 f0 ff ff 77 1f 48 8b 44 24 18 64 48 2b 04 25 28 00
[  +0.000013] RSP: 002b:00007fff25f66790 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  +0.000016] RAX: ffffffffffffffda RBX: 000055b3f7e133e0 RCX: 00007ff9ed31a94f
[  +0.000012] RDX: 000055b3f7e133e0 RSI: 00000000c1186451 RDI: 0000000000000003
[  +0.000010] RBP: 00000000c1186451 R08: 0000000000000000 R09: 0000000000000000
[  +0.000009] R10: 0000000000000008 R11: 0000000000000246 R12: 00007fff25f66ca8
[  +0.000009] R13: 0000000000000003 R14: 000055b3f7021ba8 R15: 00007ff9ed7af040
[  +0.000024]  </TASK>
[  +0.000007] ---[ end trace 0000000000000000 ]---

v2: Consolidate any error handling into amdgpu_hmm_register
    which applied to kfd_bo also. (Christian)
v3: Improve syntax and comment (Christian)

Cc: Christian Koenig <christian.koenig@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Felix Kuehling <felix.kuehling@amd.com>
Cc: Joonkyo Jung <joonkyoj@yonsei.ac.kr>
Cc: Dokyung Song <dokyungs@yonsei.ac.kr>
Cc: <jisoo.jang@yonsei.ac.kr>
Cc: <yw9865@yonsei.ac.kr>
Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2024-04-03 15:29:04 +02:00
..
accel accel/ivpu: Don't enable any tiles by default on VPU40xx 2024-03-01 13:35:01 +01:00
accessibility speakup: Fix 8bit characters from direct synth 2024-04-03 15:28:28 +02:00
acpi ACPI: scan: Fix device check notification handling 2024-03-26 18:19:35 -04:00
amba
…
android binder: signal epoll threads of self-work 2024-02-23 09:25:04 +01:00
ata scsi: sd: Fix TCG OPAL unlock on system resume 2024-04-03 15:28:59 +02:00
atm atm: idt77252: fix a memleak in open_card_ubr0 2024-02-16 19:10:49 +01:00
auxdisplay
…
base PM: sleep: wakeirq: fix wake irq warning in system suspend 2024-04-03 15:28:24 +02:00
bcma
…
block aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts 2024-03-26 18:19:19 -04:00
bluetooth Bluetooth: btnxpuart: Fix btnxpuart_close 2024-04-03 15:28:27 +02:00
bus bus: mhi: ep: check the correct variable in mhi_ep_register_controller() 2024-03-26 18:20:06 -04:00
cache cache: ax45mp_cache: Align end size to cache boundary in ax45mp_dma_cache_wback() 2024-03-01 13:35:08 +01:00
cdrom
…
cdx
…
char tpm,tpm_tis: Avoid warning splat at shutdown 2024-04-03 15:28:31 +02:00
clk clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays 2024-04-03 15:28:23 +02:00
clocksource clocksource/drivers/arm_global_timer: Fix maximum prescaler value 2024-04-03 15:28:50 +02:00
comedi comedi: comedi_test: Prevent timers rescheduling during deletion 2024-03-26 18:20:04 -04:00
connector connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" 2024-02-23 09:25:01 +01:00
counter
…
cpufreq cpufreq: dt: always allocate zeroed cpumask 2024-04-03 15:28:35 +02:00
cpuidle
…
crypto crypto: sun8i-ce - Fix use after free in unprepare 2024-04-03 15:28:40 +02:00
cxl cxl/trace: Properly initialize cxl_poison region name 2024-04-03 15:28:36 +02:00
dax
…
dca
…
devfreq
…
dio
…
dma dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA 2024-03-26 18:19:43 -04:00
dma-buf
…
edac
…
eisa
…
extcon extcon: fix possible name leak in extcon_dev_register() 2024-02-05 20:14:31 +00:00
firewire firewire: ohci: prevent leak of left-over IRQ on unbind 2024-04-03 15:28:41 +02:00
firmware x86/efistub: Reinstate soft limit for initrd loading 2024-04-03 15:28:53 +02:00
fpga
…
fsi
…
gnss
…
gpio gpiolib: Pass consumer device through to core in devm_fwnode_gpiod_get_index() 2024-03-26 18:19:34 -04:00
gpu drm/amdgpu: fix use-after-free bug 2024-04-03 15:29:04 +02:00
greybus
…
hid HID: amd_sfh: Avoid disabling the interrupt 2024-03-26 18:19:53 -04:00
hsi
…
hte
…
hv x86/hyperv: Use per cpu initial stack for vtl context 2024-03-26 18:20:06 -04:00
hwmon hwmon: (amc6821) add of_match table 2024-04-03 15:28:28 +02:00
hwspinlock
…
hwtracing hwtracing: hisi_ptt: Move type check to the beginning of hisi_ptt_pmu_event_init() 2024-03-26 18:20:06 -04:00
i2c i2c: i801: Avoid potential double call to gpiod_remove_lookup_table 2024-04-03 15:28:45 +02:00
i3c i3c: dw: Disable IBI IRQ depends on hot-join and SIR enabling 2024-03-26 18:20:01 -04:00
idle
…
iio iio: imu: inv_mpu6050: fix FIFO parsing when empty 2024-04-03 15:28:45 +02:00
infiniband RDMA/mana_ib: Fix bug in creation of dma regions 2024-03-26 18:20:02 -04:00
input Input: xpad - add additional HyperX Controller Identifiers 2024-04-03 15:28:41 +02:00
interconnect interconnect: qcom: sm8550: Enable sync_state 2024-02-23 09:24:57 +01:00
iommu iommu/dma: Force swiotlb_max_mapping_size on an untrusted device 2024-04-03 15:28:51 +02:00
ipack
…
irqchip irqchip/renesas-rzg2l: Prevent spurious interrupts when setting trigger type 2024-04-03 15:28:52 +02:00
isdn
…
leds leds: trigger: netdev: Fix kernel panic on interface rename trig notify 2024-04-03 15:28:27 +02:00
macintosh
…
mailbox mailbox: arm_mhuv2: Fix a bug for mhuv2_sender_interrupt 2024-02-05 20:14:31 +00:00
mcb
…
md dm snapshot: fix lockup in dm_exception_table_exit 2024-04-03 15:28:37 +02:00
media media: nxp: imx8-isi: Mark all crossbar sink pads as MUST_CONNECT 2024-04-03 15:28:18 +02:00
memory memory: tegra: Correct DLA client names 2024-03-26 18:19:32 -04:00
memstick
…
message
…
mfd mfd: cs42l43: Fix wrong GPIO_FN_SEL and SPI_CLK_CONFIG1 defaults 2024-03-26 18:19:55 -04:00
misc mei: me: add arrow lake point H DID 2024-04-03 15:28:43 +02:00
mmc sdhci-of-dwcmshc: disable PM runtime in dwcmshc_remove() 2024-04-03 15:28:56 +02:00
most
…
mtd mtd: rawnand: Constrain even more when continuous reads are enabled 2024-04-03 15:28:35 +02:00
mux
…
net net: ll_temac: platform_get_resource replaced by wrong function 2024-04-03 15:28:56 +02:00
nfc
…
ntb NTB: fix possible name leak in ntb_register_device() 2024-03-26 18:19:48 -04:00
nubus
…
nvdimm
…
nvme nvme: fix reconnection fail due to reserved tag allocation 2024-03-26 18:20:09 -04:00
nvmem nvmem: meson-efuse: fix function pointer type mismatch 2024-04-03 15:28:28 +02:00
of of: property: fw_devlink: Fix stupid bug in remote-endpoint parsing 2024-03-06 14:48:39 +00:00
opp OPP: debugfs: Fix warning around icc_get_name() 2024-03-26 18:19:40 -04:00
parisc
…
parport
…
pci PCI: hv: Fix ring buffer size calculation 2024-04-03 15:28:30 +02:00
pcmcia
…
peci
…
perf perf: RISCV: Fix panic on pmu overflow handler 2024-03-26 18:19:14 -04:00
phy phy: tegra: xusb: Add API to retrieve the port number of phy 2024-04-03 15:28:28 +02:00
pinctrl gpio: nomadik: fix offset bug in nmk_pmx_set() 2024-03-26 18:19:54 -04:00
platform platform/x86/intel/tpmi: Change vsec offset to u64 2024-04-03 15:28:31 +02:00
pmdomain pmdomain: qcom: rpmhpd: Drop SA8540P gfx.lvl 2024-03-26 18:19:23 -04:00
pnp
…
power power: supply: bq27xxx-i2c: Do not free non existing IRQ 2024-03-06 14:48:37 +00:00
powercap powercap: intel_rapl_tpmi: Fix System Domain probing 2024-04-03 15:28:19 +02:00
pps
…
ps3
…
ptp
…
pwm pwm: img: fix pwm clock lookup 2024-04-03 15:28:52 +02:00
rapidio
…
ras
…
regulator regulator: userspace-consumer: add module device table 2024-03-26 18:19:34 -04:00
remoteproc remoteproc: virtio: Fix wdg cannot recovery remote processor 2024-04-03 15:28:16 +02:00
reset
…
rpmsg
…
rtc rtc: mt6397: select IRQ_DOMAIN instead of depending on it 2024-03-26 18:20:06 -04:00
s390 s390/zcrypt: fix reference counting on zcrypt card objects 2024-04-03 15:28:32 +02:00
sbus
…
scsi scsi: libsas: Fix disk not being scanned in after being removed 2024-04-03 15:29:03 +02:00
sh
…
siox
…
slimbus slimbus: core: Remove usage of the deprecated ida_simple_xx() API 2024-04-03 15:28:28 +02:00
soc soc: fsl: qbman: Use raw spinlock for cgr_lock 2024-04-03 15:28:32 +02:00
soundwire
…
spi spi: spi-mt65xx: Fix NULL pointer access in interrupt handler 2024-03-26 18:20:13 -04:00
spmi spmi: mediatek: Fix UAF on device remove 2024-02-05 20:14:32 +00:00
ssb
…
staging staging: vc04_services: fix information leak in create_component() 2024-04-03 15:28:59 +02:00
target scsi: target: pscsi: Fix bio_put() for error case 2024-03-01 13:34:59 +01:00
tc
…
tee tee: optee: Fix kernel panic caused by incorrect error handling 2024-04-03 15:28:44 +02:00
thermal thermal: devfreq_cooling: Fix perf state when calculate dfc res_util 2024-04-03 15:28:56 +02:00
thunderbolt thunderbolt: Fix setting the CNS bit in ROUTER_CS_5 2024-02-23 09:25:13 +01:00
tty Revert "tty: serial: simplify qcom_geni_serial_send_chunk_fifo()" 2024-04-03 15:28:43 +02:00
ufs scsi: ufs: core: Remove the ufshcd_release() in ufshcd_err_handling_prepare() 2024-03-01 13:34:55 +01:00
uio
…
usb usb: dwc3: pci: Drop duplicate ID 2024-04-03 15:29:03 +02:00
vdpa vdpa/mlx5: Allow CVQ size changes 2024-03-26 18:20:10 -04:00
vfio vfio/pds: Make sure migration file isn't accessed after reset 2024-04-03 15:28:59 +02:00
vhost
…
video backlight: lp8788: Fully initialize backlight_properties during probe 2024-03-26 18:19:56 -04:00
virt
…
virtio virtio: reenable config if freezing device failed 2024-04-03 15:28:36 +02:00
vlynq
…
w1
…
watchdog watchdog: stm32_iwdg: initialize default timeout 2024-03-26 18:20:02 -04:00
xen xen/events: increment refcnt only if event channel is refcounted 2024-03-26 18:20:09 -04:00
zorro
…
Kconfig
…
Makefile
…