In gud_fb_queue_damage(), freeing gdrm->shadow_buf on framebuffer
dimension changes while the asynchronous worker gud_flush_work() is
running causes a race condition where gud_flush_work() dereferences the
freed gdrm->shadow_buf during a USB bulk transfer, triggering a slab
Use-After-Free (UAF).
Flush any pending background work (flush_work(&gdrm->work)) prior to
freeing and reallocating gdrm->shadow_buf when framebuffer dimensions
change.
Tested in QEMU against Linux 7.3.0-rc3 with KASAN enabled by queuing damage
on a resized framebuffer while background USB flush work (gud_flush_work)
was actively reading shadow_buf: on the unfixed kernel KASAN detected
BUG: KASAN: slab-use-after-free in gud_flush_damage(); whereas with this
fix applied (flushing pending work before vfreeing shadow_buf), 0 KASAN
warnings were generated.
Fixes: 40e1a70b4aed ("drm: Add GUD USB Display driver")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Hui Peng <[email protected]>
---
drivers/gpu/drm/gud/gud_pipe.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/gpu/drm/gud/gud_pipe.c b/drivers/gpu/drm/gud/gud_pipe.c
index aa7792966287..f9726e3d849f 100644
--- a/drivers/gpu/drm/gud/gud_pipe.c
+++ b/drivers/gpu/drm/gud/gud_pipe.c
@@ -397,6 +407,16 @@ static int gud_fb_queue_damage(struct gud_device *gdrm,
struct drm_framebuffer *
struct drm_framebuffer *old_fb = NULL;
struct iosys_map shadow_map;
+ if (gdrm->shadow_buf && gdrm->fb &&
+ (fb->pitches[0] != gdrm->fb->pitches[0] || fb->height !=
gdrm->fb->height)) {
+ flush_work(&gdrm->work);
+ mutex_lock(&gdrm->damage_lock);
+ vfree(gdrm->shadow_buf);
+ gdrm->shadow_buf = NULL;
+ gud_clear_damage(gdrm);
+ mutex_unlock(&gdrm->damage_lock);
+ }
+
mutex_lock(&gdrm->damage_lock);
if (!gdrm->shadow_buf) {
