On 30-10-2026 06:59, Maaz Mombasawala <[email protected]> wrote:
> How is userspace able to see the gem handle to call DRM_IOCTL_GEM_CLOSE
> on it before DRM_IOCTL_MODE_CREATE_DUMB has returned it?
>
The handle is installed in file_priv->object_idr by
drm_gem_handle_create() inside vmw_gb_surface_define_ext_ioctl(), before
DRM_IOCTL_MODE_CREATE_DUMB returns it, and GEM handles are predictable:
idr_alloc() hands out the lowest free id starting at 1. On a freshly
opened fd the dumb buffer gets handle 1, so a second thread on the same
fd can spin on DRM_IOCTL_GEM_CLOSE(1), getting -EINVAL until the handle
appears. Once closed, id 1 is free again, so the race can be retried
indefinitely.
I tried this methodology and got a KASAN splat:
BUG: KASAN: slab-use-after-free in vmw_dumb_create+0x705/0x850
Read of size 8 at addr ffff88810fd5b2d0 by task poc/228
...
Allocated by task 228:
__kmalloc_cache_noprof+0x166/0x3b0
vmw_bo_create+0xbc/0x660
vmw_gem_object_create_with_handle+0xf9/0x190
vmw_gb_surface_define_internal.constprop.0+0xe23/0x17c0
vmw_dumb_create+0x415/0x850
...
Freed by task 228:
kfree+0x216/0x450
vmw_bo_free+0x414/0x640
ttm_bo_release+0x3bc/0x9a0
vmw_dumb_create+0x6d9/0x850
...
The buggy address belongs to the object at ffff88810fd5b000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 720 bytes inside of
freed 1024-byte region [ffff88810fd5b000, ffff88810fd5b400)
...
BUG: unable to handle page fault for address: ffffffffffffffb0
#PF: supervisor write access in kernel mode
RIP: 0010:vmw_dumb_create+0x667/0x850
R12: 0000000000000000
Kernel panic - not syncing: Fatal exception
The read is vbo->dumb_surface (offset 0x2d0); it comes back NULL and the
subsequent usurf->prime.base.refcount_release = NULL store faults at
NULL - 0x50.
> --
> Maaz Mombasawala <[email protected]>
>
