github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 18:21:24 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
v7.1-rc7
linux/drivers/dma-buf
History
David Carlier ead6680f35 dma-buf: fix UAF in dma_buf_fd() tracepoint 
Once FD_ADD() returns, the fd is live in the file descriptor table
and a thread sharing that table can close() it before DMA_BUF_TRACE()
runs. The close drops the last reference, __fput() frees the dma_buf,
and the tracepoint then dereferences dmabuf to take dmabuf->name_lock
-- slab-use-after-free.

Split FD_ADD() back into get_unused_fd_flags() + fd_install() and
emit the tracepoint between them. While the fdtable slot is reserved
with a NULL file pointer, a racing close() returns -EBADF without
entering __fput(), so the dma_buf stays alive across the trace. Same
approach as commit 2d76319c4c ("dma-buf: fix UAF in dma_buf_put()
tracepoint").

This undoes the FD_ADD() conversion done in commit 34dfce523c
("dma: convert dma_buf_fd() to FD_ADD()"); FD_ADD() has no place to
hook the tracepoint safely.

Reported-by: syzbot+7f4987d0afb97dd090cb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=7f4987d0afb97dd090cb
Fixes: 281a226314 ("dma-buf: add some tracepoints to debug.")
Cc: stable@vger.kernel.org # 7.0.x
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
Link: https://patch.msgid.link/20260523181446.69525-1-devnexen@gmail.com
2026-05-28 20:05:43 +05:30
..
heaps dma-mapping updates for Linux 7.0: 2026-04-17 11:12:42 -07:00
dma-buf-mapping.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dma-buf.c dma-buf: fix UAF in dma_buf_fd() tracepoint 2026-05-28 20:05:43 +05:30
dma-fence-array.c dma-buf: Assign separate lockdep class to array lock 2026-02-25 01:19:41 -08:00
dma-fence-chain.c dma-buf: Assign separate lockdep class to chain lock 2026-02-25 01:16:11 -08:00
dma-fence-unwrap.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dma-fence.c drm fixes for 7.1-rc1 2026-04-24 11:44:52 -07:00
dma-heap.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dma-resv.c dma-buf: Suppress a thread-safety complaint 2026-03-03 08:39:13 +01:00
Kconfig dma-buf: Always build with DMABUF_MOVE_NOTIFY 2026-01-27 10:45:11 +01:00
Makefile dma-buf: Remove DMA-BUF sysfs stats 2026-01-19 19:10:01 +05:30
selftest.c
selftest.h
selftests.h
st-dma-fence-chain.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
st-dma-fence-unwrap.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
st-dma-fence.c dma-buf/selftests: test RCU ops and inline lock v2 2026-02-23 16:14:19 +01:00
st-dma-resv.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
sw_sync.c dma-buf: abstract fence locking v2 2026-02-23 16:14:19 +01:00
sync_debug.c dma-buf: Switch to use %ptSp 2025-11-19 10:24:13 +01:00
sync_debug.h dma-buf: inline spinlock for fence protection v5 2026-02-23 16:14:19 +01:00
sync_file.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
sync_trace.h
udmabuf.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00