kernel_optimize_test/drivers/dma-buf
Charan Teja Reddy a19dae4254 dmabuf: fix use-after-free of dmabuf's file->f_inode
commit 05cd84691eafcd7959a1e120d5e72c0dd98c5d91 upstream.

It is observed 'use-after-free' on the dmabuf's file->f_inode with the
race between closing the dmabuf file and reading the dmabuf's debug
info.

Consider the below scenario where P1 is closing the dma_buf file
and P2 is reading the dma_buf's debug info in the system:

P1						P2
					dma_buf_debug_show()
dma_buf_put()
  __fput()
    file->f_op->release()
    dput()
    ....
      dentry_unlink_inode()
        iput(dentry->d_inode)
        (where the inode is freed)
					mutex_lock(&db_list.lock)
					read 'dma_buf->file->f_inode'
					(the same inode is freed by P1)
					mutex_unlock(&db_list.lock)
      dentry->d_op->d_release()-->
        dma_buf_release()
          .....
          mutex_lock(&db_list.lock)
          removes the dmabuf from the list
          mutex_unlock(&db_list.lock)

In the above scenario, when dma_buf_put() is called on a dma_buf, it
first frees the dma_buf's file->f_inode(=dentry->d_inode) and then
removes this dma_buf from the system db_list. In between P2 traversing
the db_list tries to access this dma_buf's file->f_inode that was freed
by P1 which is a use-after-free case.

Since, __fput() calls f_op->release first and then later calls the
d_op->d_release, move the dma_buf's db_list removal from d_release() to
f_op->release(). This ensures that dma_buf's file->f_inode is not
accessed after it is released.

Cc: <stable@vger.kernel.org> # 5.4.x-
Fixes: 4ab59c3c63 ("dma-buf: Move dma_buf_release() from fops to dentry_ops")
Acked-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/1609857399-31549-1-git-send-email-charante@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-12 20:18:24 +01:00
..
heaps dma-mapping updates for 5.10 2020-10-15 14:43:29 -07:00
dma-buf.c dmabuf: fix use-after-free of dmabuf's file->f_inode 2021-01-12 20:18:24 +01:00
dma-fence-array.c dma-fence: Propagate errors to dma-fence-array container 2019-08-12 08:25:52 +01:00
dma-fence-chain.c dma-buf: fence-chain: Document missing dma_fence_chain_init() parameter in kerneldoc 2020-09-03 17:47:02 +05:30
dma-fence.c dma-buf: fix kernel-doc warning in dma-fence.c 2020-09-02 14:39:15 +02:00
dma-heap.c dma-heap: Make the symbol 'dma_heap_ioctl_cmds' static 2019-12-18 00:41:29 +05:30
dma-resv.c dma-buf/dma-resv: Respect num_fences when initializing the shared fence list. 2020-12-30 11:54:26 +01:00
Kconfig treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
Makefile dma-buf: Exercise dma-fence-chain under selftests 2020-04-09 19:58:55 +01:00
selftest.c dma-buf: Introduce selftesting framework 2019-08-19 18:01:34 +01:00
selftest.h dma-buf: Introduce selftesting framework 2019-08-19 18:01:34 +01:00
selftests.h Merge drm/drm-next into drm-intel-next-queued 2020-06-25 18:05:03 +03:00
seqno-fence.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174 2019-05-30 11:26:41 -07:00
st-dma-fence-chain.c dma-buf: fix dma-fence-chain out of order test 2020-07-02 15:21:40 +02:00
st-dma-fence.c dmabuf: Mark up onstack timer for selftests 2019-08-20 13:49:15 +01:00
sw_sync.c compat_ioctl: move more drivers to compat_ptr_ioctl 2019-10-23 17:23:44 +02:00
sync_debug.c Linux 5.2-rc5 2019-06-19 12:07:29 +02:00
sync_debug.h dma-buf: Remove unused sync_dump() 2019-04-23 09:30:07 +01:00
sync_file.c - A fix for a memory leak in the dma-buf support 2019-12-09 17:13:19 +10:00
sync_trace.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
udmabuf.c drm-misc-next for 5.10: 2020-09-23 09:52:24 +10:00