Daniel Vetter
380c7ceabd
drm/atomic: Fix potential use-after-free in nonblocking commits ...
commit 4e076c73e4f6e90816b30fcd4a0d7ab365087255 upstream.
This requires a bit of background. Properly done a modeset driver's
unload/remove sequence should be
drm_dev_unplug();
drm_atomic_helper_shutdown();
drm_dev_put();
The trouble is that the drm_dev_unplugged() checks are by design racy,
they do not synchronize against all outstanding ioctl. This is because
those ioctl could block forever (both for modeset and for driver
specific ioctls), leading to deadlocks in hotunplug. Instead the code
sections that touch the hardware need to be annotated with
drm_dev_enter/exit, to avoid accessing hardware resources after the
unload/remove has finished.
To avoid use-after-free issues all the involved userspace visible
objects are supposed to hold a reference on the underlying drm_device,
like drm_file does.
The issue now is that we missed one, the atomic modeset ioctl can be run
in a nonblocking fashion, and in that case it cannot rely on the implied
drm_device reference provided by the ioctl calling context. This can
result in a use-after-free if an nonblocking atomic commit is carefully
raced against a driver unload.
Fix this by unconditionally grabbing a drm_device reference for any
drm_atomic_state structures. Strictly speaking this isn't required for
blocking commits and TEST_ONLY calls, but it's the simpler approach.
Thanks to shanzhulig for the initial idea of grabbing an unconditional
reference, I just added comments, a condensed commit message and fixed a
minor potential issue in where exactly we drop the final reference.
Reported-by: shanzhulig <shanzhulig@gmail.com>
Suggested-by: shanzhulig <shanzhulig@gmail.com>
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-07-27 08:37:40 +02:00
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
binder: fix UAF caused by faulty buffer cleanup
2023-06-05 08:17:33 +02:00
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
PM: domains: fix integer overflow issues in genpd_parse_state()
2023-07-27 08:37:06 +02:00
xen/blkfront: Only check REQ_FUA for writes
2023-06-21 15:44:09 +02:00
Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work"
2023-05-17 11:35:45 +02:00
bus: imx-weim: fix branch condition evaluates to a garbage value
2023-04-05 11:16:42 +02:00
hwrng: imx-rngc - fix the timeout for init and self check
2023-07-27 08:37:38 +02:00
clk: keystone: sci-clk: check return value of kasprintf()
2023-07-27 08:37:15 +02:00
clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe
2023-07-27 08:37:05 +02:00
counter: 104-quad-8: Fix race condition between FLAG and CNTR reads
2023-05-17 11:35:31 +02:00
cpufreq: armada-37xx: stop using 0 as NULL pointer
2023-02-06 07:52:41 +01:00
crypto: marvell/cesa - Fix type mismatch warning
2023-07-27 08:37:18 +02:00
PM/devfreq: governor: Add a private governor_data for governor
2023-01-18 11:41:52 +01:00
dmaengine: pl330: rename _start to prevent build error
2023-06-09 10:28:52 +02:00
EDAC/skx: Fix overflows on the DRAM row address mapping arrays
2023-05-17 11:35:35 +02:00
extcon: Fix kernel doc of property capability fields to avoid warnings
2023-07-27 08:37:20 +02:00
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool()
2023-07-27 08:37:37 +02:00
fpga: bridge: fix kernel-doc parameter description
2023-05-17 11:35:46 +02:00
WRITE is "data source", not destination...
2023-02-22 12:50:23 +01:00
gpio: mockup: Fix mode of debugfs files
2023-05-30 12:44:09 +01:00
drm/atomic: Fix potential use-after-free in nonblocking commits
2023-07-27 08:37:40 +02:00
HID: wacom: Use ktime_t rather than int when dealing with timestamps
2023-07-27 08:37:03 +02:00
Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs
2023-06-28 10:18:36 +02:00
hwmon (it87): Fix voltage scaling for chips with 10.9mV ADCs
2023-04-05 11:16:38 +02:00
coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet()
2023-05-30 12:44:10 +01:00
i2c: xiic: Don't try to handle more interrupt events after error
2023-07-27 08:37:24 +02:00
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
meson saradc: fix clock divider mask length
2023-07-27 08:37:38 +02:00
IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
2023-07-27 08:37:14 +02:00
Input: adxl34x - do not hardcode interrupt trigger type
2023-07-27 08:37:13 +02:00
interconnect: fix mem leak when freeing nodes
2023-03-22 13:28:08 +01:00
iommu/amd: Don't block updates to GATag if guest mode is on
2023-06-09 10:28:52 +02:00
irqchip/jcore-aic: Fix missing allocation of IRQ descriptors
2023-07-27 08:37:05 +02:00
leds: TI_LMU_COMMON: select REGMAP instead of depending on it
2023-05-17 11:35:53 +02:00
macintosh: via-pmu-led: requires ATA to be set
2023-05-17 11:35:50 +02:00
mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
2023-07-27 08:37:23 +02:00
mcb-pci: Reallocate memory region to avoid memory overlapping
2023-05-30 12:44:04 +01:00
md/raid0: add discard support for the 'original' layout
2023-07-27 08:37:37 +02:00
media: usb: siano: Fix warning due to null work_func_t function pointer
2023-07-27 08:37:20 +02:00
memory: brcmstb_dpfe: fix testing array offset after use
2023-07-27 08:37:14 +02:00
memstick r592: make memstick_debug_get_tpc_name() static
2023-07-27 08:37:10 +02:00
scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition
2023-05-30 12:44:03 +01:00
mfd: stmpe: Only disable the regulators if they are enabled
2023-07-27 08:37:22 +02:00
misc: pci_endpoint_test: Re-init completion for every test
2023-07-27 08:37:37 +02:00
mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used.
2023-07-27 08:37:25 +02:00
mtd: rawnand: meson: fix unaligned DMA buffers handling
2023-07-27 08:37:34 +02:00
net: bcmgenet: Ensure MDIO unregistration has clocks enabled
2023-07-27 08:37:34 +02:00
nfcsim.c: Fix error checking for debugfs_create_dir
2023-06-28 10:18:41 +02:00
NTB: ntb_tool: Add check for devm_kcalloc
2023-07-27 08:37:32 +02:00
nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage"
2023-05-17 11:35:43 +02:00
nvmem: core: fix cell removal on error
2023-02-22 12:50:28 +01:00
of: Fix modalias string generation
2023-05-17 11:35:47 +02:00
OPP: fix error checking in opp_migrate_dentry()
2023-03-11 16:43:41 +01:00
PCI: rockchip: Set address alignment for endpoint mode
2023-07-27 08:37:36 +02:00
phy: st: miphy28lp: use _poll_timeout functions for waits
2023-05-30 12:44:04 +01:00
pinctrl: amd: Only use special debounce behavior for GPIO 0
2023-07-27 08:37:34 +02:00
platform/x86: wmi: Break possible infinite loop when parsing GUID
2023-07-27 08:37:33 +02:00
power: supply: Fix logic checking if system is running from battery
2023-06-21 15:44:09 +02:00
powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
2023-07-27 08:37:06 +02:00
ptp_qoriq: fix memory leak in probe()
2023-04-05 11:16:43 +02:00
pwm: sysfs: Do not apply state to already disabled PWMs
2023-07-27 08:37:22 +02:00
regulator: core: Streamline debugfs operations
2023-07-27 08:37:07 +02:00
remoteproc: st: Call of_node_put() on iteration error
2023-05-17 11:36:01 +02:00
rpmsg: glink: Avoid infinite loop on intent for missing channel
2023-03-11 16:43:53 +01:00
rtc: st-lpc: Release some resources in st_rtc_probe() in case of error
2023-07-27 08:37:22 +02:00
s390/cio: unregister device when the only path is gone
2023-06-28 10:18:41 +02:00
scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue
2023-07-27 08:37:40 +02:00
soc/fsl/qe: fix usb.c build errors
2023-07-27 08:37:14 +02:00
spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
2023-07-27 08:37:22 +02:00
spmi: Add a check for remove callback when removing a SPMI driver
2023-05-17 11:35:49 +02:00
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE"
2023-06-14 11:00:00 +02:00
scsi: target: iscsi: Prevent login threads from racing between each other
2023-06-28 10:18:40 +02:00
thermal: intel: BXT_PMIC: select REGMAP instead of depending on it
2023-03-11 16:44:13 +01:00
thunderbolt: Use const qualifier for ring_interrupt_index
2023-04-05 11:16:39 +02:00
tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk
2023-07-27 08:37:38 +02:00
usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
2023-07-27 08:37:21 +02:00
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()
2023-07-27 08:37:15 +02:00
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
w1: fix loop in w1_fini()
2023-07-27 08:37:19 +02:00
watchdog: menz069_wdt: fix watchdog initialisation
2023-06-09 10:28:55 +02:00
xen/pvcalls-back: fix double frees with pvcalls_new_active_socket()
2023-05-30 12:44:10 +01:00
380c7ceabd