From patchwork Tue Jul 9 06:58:00 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Janusz Krzysztofik X-Patchwork-Id: 11036365 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 2250913A4 for ; Tue, 9 Jul 2019 06:58:22 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0DF5A2857B for ; Tue, 9 Jul 2019 06:58:22 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 01FA42858E; Tue, 9 Jul 2019 06:58:21 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=unavailable version=3.3.1 Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher DHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id C1C182857B for ; Tue, 9 Jul 2019 06:58:21 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id A2E6C89613; Tue, 9 Jul 2019 06:58:18 +0000 (UTC) X-Original-To: dri-devel@lists.freedesktop.org Delivered-To: dri-devel@lists.freedesktop.org Received: from mga03.intel.com (mga03.intel.com [134.134.136.65]) by gabe.freedesktop.org (Postfix) with ESMTPS id 9E091895B5; Tue, 9 Jul 2019 06:58:16 +0000 (UTC) X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga008.jf.intel.com ([10.7.209.65]) by orsmga103.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 08 Jul 2019 23:58:15 -0700 X-IronPort-AV: E=Sophos;i="5.63,469,1557212400"; d="scan'208";a="159369367" Received: from jkrzyszt-desk.igk.intel.com ([172.22.244.18]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 08 Jul 2019 23:58:13 -0700 From: Janusz Krzysztofik To: Chris Wilson , =?utf-8?q?Micha=C5=82_Winiarski?= Subject: [PATCH] drm/i915: Fix reporting of size of created GEM object Date: Tue, 9 Jul 2019 08:58:00 +0200 Message-Id: <20190709065800.2354-1-janusz.krzysztofik@linux.intel.com> X-Mailer: git-send-email 2.21.0 MIME-Version: 1.0 X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: David Airlie , intel-gfx@lists.freedesktop.org, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, Rodrigo Vivi , Janusz Krzysztofik , =?utf-8?q?Micha?= =?utf-8?q?=C5=82_Wajdeczko?= Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" X-Virus-Scanned: ClamAV using ClamSMTP Commit e163484afa8d ("drm/i915: Update size upon return from GEM_CREATE") (re)introduced reporting of actual size of created GEM objects, possibly rounded up on object alignment. Unfortunately, its implementation resulted in a possible use-after-free bug. The bug has been fixed by commit 929eec99f5fd ("drm/i915: Avoid use-after-free in reporting create.size") at the cost of possibly incorrect value being reported as actual object size. Safely restore correct reporting by capturing actual size of created GEM object before a reference to the object is put. Fixes: 929eec99f5fd ("drm/i915: Avoid use-after-free in reporting create.size") Signed-off-by: Janusz Krzysztofik --- drivers/gpu/drm/i915/i915_gem.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c index 7ade42b8ec99..16bae5870d6f 100644 --- a/drivers/gpu/drm/i915/i915_gem.c +++ b/drivers/gpu/drm/i915/i915_gem.c @@ -171,6 +171,7 @@ i915_gem_create(struct drm_file *file, obj = i915_gem_object_create_shmem(dev_priv, size); if (IS_ERR(obj)) return PTR_ERR(obj); + size = obj->base.size; ret = drm_gem_handle_create(file, &obj->base, &handle); /* drop reference from allocate - handle holds it now */