Hello,
While fuzzing the amdgpu driver on Linux 6.19.10 with a hardware-free
device-model approach, I found a slab-use-after-free (write) in the DRM buddy
allocator. The faulting object is a drm_buddy_block from the drm_buddy_block
slab cache (80-byte region); the write is 8 bytes into the freed rb-node field.
The bug is reached through amdgpu, but the root cause is in the generic DRM
buddy allocator (drivers/gpu/drm/drm_buddy.c), not in amdgpu itself. It appears
to be the write-side manifestation of the same allocator rollback defect as the
slab-use-after-free (read) in drm_buddy_alloc_blocks that I am reporting
separately.
Root cause analysis:
During a drm_buddy_alloc_blocks() request, __alloc_range_bias() splits blocks
to satisfy a biased/ranged allocation (split_block at drm_buddy.c:437). On a
split failure it takes a rollback path that calls __drm_buddy_free()
(drm_buddy.c:213 via __alloc_range_bias at drm_buddy.c:689), which frees one or
more child drm_buddy_block objects via drm_block_free() while merging upward.
A stale reference to a freed child block survives in the allocator's
bookkeeping, so the resulting VRAM resource ends up referencing a dangling
drm_buddy_block. Later, when user space closes the DRM fd, the release path
amdgpu_driver_postclose_kms -> ttm_bo_release -> amdgpu_vram_mgr_del
(amdgpu_vram_mgr.c:652) -> __drm_buddy_free_list (drm_buddy.c:560) ->
__drm_buddy_free (drm_buddy.c:209) -> rbtree_remove (drm_buddy.c:112) walks
that freed block and calls rb_erase(&block->rb, root), writing into the freed
rb-node. This is the reported UAF write.
The crash report attached below:
BUG: KASAN: slab-use-after-free in __rb_erase_augmented
include/linux/rbtree_augmented.h:251 [inline]
BUG: KASAN: slab-use-after-free in rb_erase+0x229/0xe20 lib/rbtree.c:443
Write of size 8 at addr ffff888111229178 by task syz.0.836/3355
CPU: 0 UID: 0 PID: 3355 Comm: syz.0.836 Not tainted 6.19.10 #3
PREEMPT(voluntary)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Arch Linux 1.17.0-2-2
04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xa2/0xd0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xbc/0x260 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
__rb_erase_augmented include/linux/rbtree_augmented.h:251 [inline]
rb_erase+0x229/0xe20 lib/rbtree.c:443
rbtree_remove drivers/gpu/drm/drm_buddy.c:112 [inline]
__drm_buddy_free+0x32e/0x5a0 drivers/gpu/drm/drm_buddy.c:209
drm_buddy_free_block drivers/gpu/drm/drm_buddy.c:542 [inline]
__drm_buddy_free_list+0x23b/0x2e0 drivers/gpu/drm/drm_buddy.c:560
amdgpu_vram_mgr_del+0x1cb/0x220
drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c:652
ttm_resource_free+0x15c/0x1b0 drivers/gpu/drm/ttm/ttm_resource.c:422
ttm_bo_cleanup_memtype_use drivers/gpu/drm/ttm/ttm_bo.c:188 [inline]
ttm_bo_release drivers/gpu/drm/ttm/ttm_bo.c:315 [inline]
kref_put include/linux/kref.h:65 [inline]
ttm_bo_put+0x978/0xb50 drivers/gpu/drm/ttm/ttm_bo.c:326
kref_put include/linux/kref.h:65 [inline]
__drm_gem_object_put include/drm/drm_gem.h:526 [inline]
drm_gem_object_put include/drm/drm_gem.h:539 [inline]
amdgpu_bo_unref+0x60/0xb0 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c:905
amdgpu_driver_postclose_kms+0x39d/0x520
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c:1536
drm_file_free+0x6ca/0x910 drivers/gpu/drm/drm_file.c:270
drm_close_helper drivers/gpu/drm/drm_file.c:293 [inline]
drm_release+0x279/0x370 drivers/gpu/drm/drm_file.c:441
amdgpu_drm_release+0x113/0x160 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c:2981
__fput+0x41f/0xa40 fs/file_table.c:468
task_work_run+0x18e/0x200 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
exit_to_user_mode_loop+0xe3/0x460 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x29e/0x360 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f33d3659c6d
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48
89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01
c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffeec7e40e8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffeec7e41b0 RCX: 00007f33d3659c6d
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f33d3887ba0 R08: 0000000000000000 R09: ffffffffffffffff
R10: 00007f33d34a0000 R11: 0000000000000246 R12: 00007f33d3885fac
R13: 00000000000003e8 R14: 0000000000034256 R15: 00007f33d3885fa0
</TASK>
Allocated by task 3356:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x4b/0x60 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:5045 [inline]
slab_alloc_node mm/slub.c:5355 [inline]
kmem_cache_alloc_noprof+0x1f3/0x670 mm/slub.c:5362
drm_block_alloc drivers/gpu/drm/drm_buddy.c:36 [inline]
split_block+0xa6/0x7f0 drivers/gpu/drm/drm_buddy.c:437
__alloc_range_bias+0x5f1/0x8d0 drivers/gpu/drm/drm_buddy.c:668
drm_buddy_alloc_blocks+0x4d3/0xce0 drivers/gpu/drm/drm_buddy.c:1174
amdgpu_vram_mgr_new+0x72c/0x10e0
drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c:539
ttm_resource_alloc+0x13b/0x230 drivers/gpu/drm/ttm/ttm_resource.c:392
ttm_bo_alloc_resource+0x2c7/0x8c0 drivers/gpu/drm/ttm/ttm_bo.c:742
ttm_bo_validate+0x1e8/0x530 drivers/gpu/drm/ttm/ttm_bo.c:858
ttm_bo_init_reserved+0x32e/0x480 drivers/gpu/drm/ttm/ttm_bo.c:972
amdgpu_bo_create+0x6a2/0xe00 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c:703
amdgpu_bo_create_user+0x87/0x100 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c:768
amdgpu_gem_object_create drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c:188 [inline]
amdgpu_mode_dumb_create+0x250/0x400
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c:1259
drm_mode_create_dumb drivers/gpu/drm/drm_dumb_buffers.c:227 [inline]
drm_mode_create_dumb_ioctl+0x211/0x2a0 drivers/gpu/drm/drm_dumb_buffers.c:236
drm_ioctl_kernel+0x23f/0x300 drivers/gpu/drm/drm_ioctl.c:804
drm_ioctl+0x644/0xac0 drivers/gpu/drm/drm_ioctl.c:901
amdgpu_drm_ioctl+0xb0/0x120 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c:2996
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd8/0x360 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 3356:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x3a/0x60 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2580 [inline]
slab_free mm/slub.c:6791 [inline]
kmem_cache_free+0x180/0x560 mm/slub.c:6906
drm_block_free drivers/gpu/drm/drm_buddy.c:53 [inline]
__drm_buddy_free+0x357/0x5a0 drivers/gpu/drm/drm_buddy.c:213
__alloc_range_bias+0x88c/0x8d0 drivers/gpu/drm/drm_buddy.c:689
drm_buddy_alloc_blocks+0x4d3/0xce0 drivers/gpu/drm/drm_buddy.c:1174
amdgpu_vram_mgr_new+0x72c/0x10e0
drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c:539
ttm_resource_alloc+0x13b/0x230 drivers/gpu/drm/ttm/ttm_resource.c:392
ttm_bo_alloc_resource+0x2c7/0x8c0 drivers/gpu/drm/ttm/ttm_bo.c:742
ttm_bo_validate+0x1e8/0x530 drivers/gpu/drm/ttm/ttm_bo.c:858
ttm_bo_init_reserved+0x32e/0x480 drivers/gpu/drm/ttm/ttm_bo.c:972
amdgpu_bo_create+0x6a2/0xe00 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c:703
amdgpu_bo_create_user+0x87/0x100 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c:768
amdgpu_gem_object_create drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c:188 [inline]
amdgpu_mode_dumb_create+0x250/0x400
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c:1259
drm_mode_create_dumb drivers/gpu/drm/drm_dumb_buffers.c:227 [inline]
drm_mode_create_dumb_ioctl+0x211/0x2a0 drivers/gpu/drm/drm_dumb_buffers.c:236
drm_ioctl_kernel+0x23f/0x300 drivers/gpu/drm/drm_ioctl.c:804
drm_ioctl+0x644/0xac0 drivers/gpu/drm/drm_ioctl.c:901
amdgpu_drm_ioctl+0xb0/0x120 drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c:2996
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xd8/0x360 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888111229150
which belongs to the cache drm_buddy_block of size 80
The buggy address is located 40 bytes inside of
freed 80-byte region [ffff888111229150, ffff8881112291a0)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111229
flags: 0x200000000000000(node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000000 ffff88810497a780 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080240024 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888111229000: fa fb fb fb fb fb fb fb fb fb fc fc fc fc fa fb
ffff888111229080: fb fb fb fb fb fb fb fb fc fc fc fc fa fb fb fb
>ffff888111229100: fb fb fb fb fb fb fc fc fc fc fa fb fb fb fb fb
^
ffff888111229180: fb fb fb fb fc fc fc fc fa fb fb fb fb fb fb fb
ffff888111229200: fb fb fc fc fc fc fa fb fb fb fb fb fb fb fb fb
==================================================================
Regards,
Yang Zi
