github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-07 05:55:44 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

drm/msm/gpu: Fix potential double-free

Browse Source 
[ Upstream commit a66f1efcf7 ]

If userspace was calling the MSM_SET_PARAM ioctl on multiple threads to
set the COMM or CMDLINE param, it could trigger a race causing the
previous value to be kfree'd multiple times.  Fix this by serializing on
the gpu lock.

Signed-off-by: Rob Clark <robdclark@chromium.org>
Fixes: d4726d7700 ("drm/msm: Add a way to override processes comm/cmdline")
Patchwork: https://patchwork.freedesktop.org/patch/517778/
Link: https://lore.kernel.org/r/20230110212903.1925878-1-robdclark@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Rob Clark 2023-01-10 13:28:59 -08:00 committed by Greg Kroah-Hartman
parent ba4ca7d2dd
commit 8103d53f25
3 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/gpu/drm/msm/adreno/adreno_gpu.c
View File

@ -351,6 +351,8 @@ int adreno_set_param(struct msm_gpu *gpu, struct msm_file_private *ctx,
/* Ensure string is null terminated: */
str[len] = '\0';
mutex_lock(&gpu->lock);
if (param == MSM_PARAM_COMM) {
paramp = &ctx->comm;
} else {
@ -360,6 +362,8 @@ int adreno_set_param(struct msm_gpu *gpu, struct msm_file_private *ctx,
kfree(*paramp);
*paramp = str;
mutex_unlock(&gpu->lock);
return 0;
}
case MSM_PARAM_SYSPROF:

2
drivers/gpu/drm/msm/msm_gpu.c
View File

@ -335,6 +335,8 @@ static void get_comm_cmdline(struct msm_gem_submit *submit, char **comm, char **
struct msm_file_private *ctx = submit->queue->ctx;
struct task_struct *task;
WARN_ON(!mutex_is_locked(&submit->gpu->lock));
/* Note that kstrdup will return NULL if argument is NULL: */
*comm = kstrdup(ctx->comm, GFP_KERNEL);
*cmd = kstrdup(ctx->cmdline, GFP_KERNEL);

12
drivers/gpu/drm/msm/msm_gpu.h
View File

@ -366,10 +366,18 @@ struct msm_file_private {
*/
int sysprof;
/** comm: Overridden task comm, see MSM_PARAM_COMM */
/**
* comm: Overridden task comm, see MSM_PARAM_COMM
*
* Accessed under msm_gpu::lock
*/
char *comm;
/** cmdline: Overridden task cmdline, see MSM_PARAM_CMDLINE */
/**
* cmdline: Overridden task cmdline, see MSM_PARAM_CMDLINE
*
* Accessed under msm_gpu::lock
*/
char *cmdline;
/**