On Fri, Jul 22, 2022 at 9:23 AM Dipanjan Das <mail.dipanjan.das@xxxxxxxxx> wrote: > ====================================================== > description: KASAN: use-after-free Read in drm_gem_object_release > affected file: drivers/gpu/drm/drm_gem.c > kernel version: 5.4.206 > kernel commit: 981f87403bb9841f1e0b7953e12a51f09a47a4f0 > git tree: upstream > kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=1aab6d4187ddf667 > crash reproducer: attached > ====================================================== > Crash log: > ====================================================== > BUG: KASAN: use-after-free in drm_gem_object_release+0xf7/0x120 > drivers/gpu/drm/drm_gem.c:952 > ================================================================== > BUG: KASAN: double-free or invalid-free in > drm_gem_vram_create+0x1b7/0x1f0 > drivers/gpu/drm/drm_gem_vram_helper.c:142 We did an initial analysis for this bug and figured out the following: If ttm_bo_init_reserved() fails, the `gbo` and `gbo->bo.base` will be freed by ttm_buffer_object_destroy(). But then drm_gem_vram_create() and drm_gem_vram_init() will attempt to free `gbo` and `gbo->bo.base` again. This will result in UAF and Double Free. A similar bug (the stack traces were a bit different) has been patched by this upstream commit: https://github.com/torvalds/linux/commit/da62cb7230f0871c30dc9789071f63229158d261. We applied this patch and can confirm that the repro does not trigger the issue anymore. -- Thanks and Regards, Dipanjan
