From patchwork Tue Jan 3 23:49:46 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rob Clark X-Patchwork-Id: 38707 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4e01:0:0:0:0:0 with SMTP id p1csp4874312wrt; Tue, 3 Jan 2023 15:54:21 -0800 (PST) X-Google-Smtp-Source: AMrXdXsgKte9Po60b9NiSJqG1sUpsErdHOVQEcR+5MdiJhpuSn9H8B/TjFYNmc4AIRVTadXkR5HM X-Received: by 2002:a05:6402:25c6:b0:46c:d2a3:76b3 with SMTP id x6-20020a05640225c600b0046cd2a376b3mr42048401edb.14.1672790060922; Tue, 03 Jan 2023 15:54:20 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1672790060; cv=none; d=google.com; s=arc-20160816; b=vWHeWvmqGzeIp19cGfCK4BRemb4Hkw9AeHjO1MVKrC3NsXuTxGfeXwk6L85NVRFTR+ 5EDsq8swUcASVIKfqsMURZDLCWvCpo+XO8prl354Hf/gP5eqyi98gXsooKvDIBKC2fb3 362skFkfISSWqNCq1tHIj5n14TSfOYpcNAdSDmXPl1OreFLALL8MsjKMJs4jw3QuRJl3 8FB5yEsN7shyMh7RWNXLowVZDCP2i/ZYo39Mqq2GmwBWWER0Vk11t+kORTriIaabIa7H tNK4e2SPmoc/F+ou+6igzlxi5jb7ZsB05uOs3jIrsDD7oDs23o9ZKz1l9PE/aZEybIq0 l+VQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=zQnU0ECVT+dQJ7sR8SG4+GexJhlU25T9FqYe8rjLTKY=; b=FE+MdN3QpvmbsjyfN1jsgv/zl7lnyUUJaN6Ic9CvSIOAxr8oQi7BrADGTqMX/Hui8M 0FbZUJvJL0xCm6Yjc8+1itoS+M3A2TiS5NHVJlPDE1050imnJ0KjuQno9xGIRlsIsKa6 8ojtl0EyODOzXhesDWsZ53zjKg1MRl9veQUgjtviA+mJ+enBQ2Zn9VlcEbliYaBewjXo O6GjKn5i4zvmTokV8ptjhDRaC3Klt5zhRxJpzCdsXndZUM8s+TYNeEveHCRSFslLEiOw TTVj2c42lwh55rvtPoWqbAJis6RvR2xwS0QmCh+XNqQJ58usfGY7EWzBbLEh3ZV8JExU +jrw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=e73Thfno; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id qf1-20020a1709077f0100b007c0d6b34c2bsi28243421ejc.647.2023.01.03.15.53.55; Tue, 03 Jan 2023 15:54:20 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b=e73Thfno; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238178AbjACXuL (ORCPT + 99 others); Tue, 3 Jan 2023 18:50:11 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56074 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234287AbjACXuJ (ORCPT ); Tue, 3 Jan 2023 18:50:09 -0500 Received: from mail-pl1-x629.google.com (mail-pl1-x629.google.com [IPv6:2607:f8b0:4864:20::629]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2A6B71004E for ; Tue, 3 Jan 2023 15:50:07 -0800 (PST) Received: by mail-pl1-x629.google.com with SMTP id c6so1083396pls.4 for ; Tue, 03 Jan 2023 15:50:07 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=zQnU0ECVT+dQJ7sR8SG4+GexJhlU25T9FqYe8rjLTKY=; b=e73Thfnoz4SFEpjmH9KHhQUwNlNGkZNP9KeQqQk9FqpYgcFXDcpgCTa/VjhO9lcDys UW7szsViVc5SLrUAMqx7eDU0kyRcaq8LcQfcc5ikJOhBkfyla1zipbs29GDyAnIvSBBS KP+fnov4T1MNTpUkSsQoH6MwJ2zb8f2WdtTK7RnjEk6De0ODYH6/SxUz9NYsiNyUDNtY N1JCne/SWolLkyRYckgFOHfEBVENlDdmuahFAxnE0LT3LapU4bBxtfOYiOYHJ8SQzDWy sffcALiAJyNFdxkGAT6gCNLsXb968lzVQ9UqosNCO9QkpzdFiGx9zqCRkdyrvsVTy2Qu dEAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=zQnU0ECVT+dQJ7sR8SG4+GexJhlU25T9FqYe8rjLTKY=; b=x5ELQWGXWtxKZWkwQpWp2/6Wkus3RlH/eUIZR5IZfeFhxhmadUwwmpu/wxTYB/L2fe k8OxJKpJY1mNFL0yJxgBrqjFVSreBLuyOH/wpZjWRjqIB7A35SZzVJhh7Y17tPx/+La8 KMfqbpAIhWS6bPfX7Kt3L39r0Wt85lm+3bJDYo2RSG96tM5L7iAak5wioM6Be/02bSrK xfSHKc0K6j7myCIhQ4PGaOx7Q9rDj+zhdcvlJqFcoN5GBpVYDxiBjceX9kfBARz7Y56z aBfnCHP7fzc88ZXnZrhURiQqqjcJk4JljwbXis7b9x39bfpyhLSR7N98kbl4zq05tHCB O3Ug== X-Gm-Message-State: AFqh2kq+GrppKUq8s9oIkBuiWXdWOPuLurKxe9S/kiiooq7DPzaMyqQz VsIzTIW3LcLnmnykdWuATR4= X-Received: by 2002:a17:903:186:b0:188:d2b3:26c1 with SMTP id z6-20020a170903018600b00188d2b326c1mr63172199plg.10.1672789806528; Tue, 03 Jan 2023 15:50:06 -0800 (PST) Received: from localhost ([2a00:79e1:abd:4a00:2703:3c72:eb1a:cffd]) by smtp.gmail.com with ESMTPSA id u12-20020a170902e80c00b0018968d1c6f3sm22889770plg.59.2023.01.03.15.50.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 03 Jan 2023 15:50:06 -0800 (PST) From: Rob Clark To: dri-devel@lists.freedesktop.org Cc: Rob Clark , Jani Nikula , Joonas Lahtinen , Rodrigo Vivi , Tvrtko Ursulin , David Airlie , Daniel Vetter , Chris Wilson , Andi Shyti , John Harrison , Matthew Brost , katrinzhou , =?utf-8?q?Thomas_Hellstr=C3=B6m?= , intel-gfx@lists.freedesktop.org (open list:INTEL DRM DRIVERS), linux-kernel@vger.kernel.org (open list) Subject: [PATCH] drm/i915: Fix potential context UAFs Date: Tue, 3 Jan 2023 15:49:46 -0800 Message-Id: <20230103234948.1218393-1-robdclark@gmail.com> X-Mailer: git-send-email 2.38.1 MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1754047510635776248?= X-GMAIL-MSGID: =?utf-8?q?1754047510635776248?= From: Rob Clark gem_context_register() makes the context visible to userspace, and which point a separate thread can trigger the I915_GEM_CONTEXT_DESTROY ioctl. So we need to ensure that nothing uses the ctx ptr after this. And we need to ensure that adding the ctx to the xarray is the *last* thing that gem_context_register() does with the ctx pointer. Signed-off-by: Rob Clark Reviewed-by: Tvrtko Ursulin Reviewed-by: Andi Shyti --- drivers/gpu/drm/i915/gem/i915_gem_context.c | 24 +++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_context.c b/drivers/gpu/drm/i915/gem/i915_gem_context.c index 7f2831efc798..6250de9b9196 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_context.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c @@ -1688,6 +1688,10 @@ void i915_gem_init__contexts(struct drm_i915_private *i915) init_contexts(&i915->gem.contexts); } +/* + * Note that this implicitly consumes the ctx reference, by placing + * the ctx in the context_xa. + */ static void gem_context_register(struct i915_gem_context *ctx, struct drm_i915_file_private *fpriv, u32 id) @@ -1703,10 +1707,6 @@ static void gem_context_register(struct i915_gem_context *ctx, snprintf(ctx->name, sizeof(ctx->name), "%s[%d]", current->comm, pid_nr(ctx->pid)); - /* And finally expose ourselves to userspace via the idr */ - old = xa_store(&fpriv->context_xa, id, ctx, GFP_KERNEL); - WARN_ON(old); - spin_lock(&ctx->client->ctx_lock); list_add_tail_rcu(&ctx->client_link, &ctx->client->ctx_list); spin_unlock(&ctx->client->ctx_lock); @@ -1714,6 +1714,10 @@ static void gem_context_register(struct i915_gem_context *ctx, spin_lock(&i915->gem.contexts.lock); list_add_tail(&ctx->link, &i915->gem.contexts.list); spin_unlock(&i915->gem.contexts.lock); + + /* And finally expose ourselves to userspace via the idr */ + old = xa_store(&fpriv->context_xa, id, ctx, GFP_KERNEL); + WARN_ON(old); } int i915_gem_context_open(struct drm_i915_private *i915, @@ -2199,14 +2203,22 @@ finalize_create_context_locked(struct drm_i915_file_private *file_priv, if (IS_ERR(ctx)) return ctx; + /* + * One for the xarray and one for the caller. We need to grab + * the reference *prior* to making the ctx visble to userspace + * in gem_context_register(), as at any point after that + * userspace can try to race us with another thread destroying + * the context under our feet. + */ + i915_gem_context_get(ctx); + gem_context_register(ctx, file_priv, id); old = xa_erase(&file_priv->proto_context_xa, id); GEM_BUG_ON(old != pc); proto_context_close(file_priv->dev_priv, pc); - /* One for the xarray and one for the caller */ - return i915_gem_context_get(ctx); + return ctx; } struct i915_gem_context *