Searched hist:"9 b73bde3" (Results 1 – 1 of 1) sorted by relevance
/openbmc/linux/drivers/gpu/drm/msm/ |
H A D | msm_gem.c | 9b73bde3 Thu Nov 26 07:02:23 CST 2020 Iskren Chernev <iskren.chernev@gmail.com> drm/msm: Fix use-after-free in msm_gem with carveout
When using gem with vram carveout the page allocation is managed via drm_mm. The necessary drm_mm_node is allocated in add_vma, but it is referenced in msm_gem_object as well. It is freed before the drm_mm_node has been deallocated leading to use-after-free on every single vram allocation.
Currently put_iova is called before put_pages in both msm_gem_free_object and msm_gem_purge:
put_iova -> del_vma -> kfree(vma) // vma holds drm_mm_node /* later */ put_pages -> put_pages_vram -> drm_mm_remove_node( msm_obj->vram_node) // vram_node is a ref to // drm_mm_node; in _msm_gem_new
It looks like del_vma does nothing else other than freeing the vma object and removing it from it's list, so delaying the deletion should be harmless.
This patch splits put_iova in put_iova_spaces and put_iova_vmas, so the vma can be freed after the mm_node has been deallocated with the mm.
Note: The breaking commit separated the vma allocation from within msm_gem_object to outside, so the vram_node reference became outside the msm_gem_object allocation, and freeing order was therefore overlooked.
Fixes: 4b85f7f5cf7 ("drm/msm: support for an arbitrary number of address spaces") Signed-off-by: Iskren Chernev <iskren.chernev@gmail.com> Signed-off-by: Rob Clark <robdclark@chromium.org>
|