Charan Teja Reddy a19dae4254 dmabuf: fix use-after-free of dmabuf's file->f_inode ... commit 05cd84691eafcd7959a1e120d5e72c0dd98c5d91 upstream. It is observed 'use-after-free' on the dmabuf's file->f_inode with the race between closing the dmabuf file and reading the dmabuf's debug info. Consider the below scenario where P1 is closing the dma_buf file and P2 is reading the dma_buf's debug info in the system: P1 P2 dma_buf_debug_show() dma_buf_put() __fput() file->f_op->release() dput() .... dentry_unlink_inode() iput(dentry->d_inode) (where the inode is freed) mutex_lock(&db_list.lock) read 'dma_buf->file->f_inode' (the same inode is freed by P1) mutex_unlock(&db_list.lock) dentry->d_op->d_release()--> dma_buf_release() ..... mutex_lock(&db_list.lock) removes the dmabuf from the list mutex_unlock(&db_list.lock) In the above scenario, when dma_buf_put() is called on a dma_buf, it first frees the dma_buf's file->f_inode(=dentry->d_inode) and then removes this dma_buf from the system db_list. In between P2 traversing the db_list tries to access this dma_buf's file->f_inode that was freed by P1 which is a use-after-free case. Since, __fput() calls f_op->release first and then later calls the d_op->d_release, move the dma_buf's db_list removal from d_release() to f_op->release(). This ensures that dma_buf's file->f_inode is not accessed after it is released. Cc: <stable@vger.kernel.org> # 5.4.x- Fixes: 4ab59c3c63 ("dma-buf: Move dma_buf_release() from fops to dentry_ops") Acked-by: Christian König <christian.koenig@amd.com> Signed-off-by: Charan Teja Reddy <charante@codeaurora.org> Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Link: https://patchwork.freedesktop.org/patch/msgid/1609857399-31549-1-git-send-email-charante@codeaurora.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-01-12 20:18:24 +01:00
..
heaps	dma-mapping updates for 5.10	2020-10-15 14:43:29 -07:00
dma-buf.c	dmabuf: fix use-after-free of dmabuf's file->f_inode	2021-01-12 20:18:24 +01:00
dma-fence-array.c
dma-fence-chain.c	dma-buf: fence-chain: Document missing dma_fence_chain_init() parameter in kerneldoc	2020-09-03 17:47:02 +05:30
dma-fence.c	dma-buf: fix kernel-doc warning in dma-fence.c	2020-09-02 14:39:15 +02:00
dma-heap.c
dma-resv.c	dma-buf/dma-resv: Respect num_fences when initializing the shared fence list.	2020-12-30 11:54:26 +01:00
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
Makefile
selftest.c
selftest.h
selftests.h	Merge drm/drm-next into drm-intel-next-queued	2020-06-25 18:05:03 +03:00
seqno-fence.c
st-dma-fence-chain.c	dma-buf: fix dma-fence-chain out of order test	2020-07-02 15:21:40 +02:00
st-dma-fence.c
sw_sync.c
sync_debug.c
sync_debug.h
sync_file.c
sync_trace.h
udmabuf.c	drm-misc-next for 5.10:	2020-09-23 09:52:24 +10:00