Commit 49f6f648 authored by Min Li's avatar Min Li Committed by Tvrtko Ursulin
Browse files

drm/i915: fix race condition UAF in i915_perf_add_config_ioctl 



Userspace can guess the id value and try to race oa_config object creation
with config remove, resulting in a use-after-free if we dereference the
object after unlocking the metrics_lock.  For that reason, unlocking the
metrics_lock must be done after we are done dereferencing the object.

Signed-off-by: default avatarMin Li <lm0963hack@gmail.com>
Fixes: f89823c2 ("drm/i915/perf: Implement I915_PERF_ADD/REMOVE_CONFIG interface")
Cc: <stable@vger.kernel.org> # v4.14+
Reviewed-by: default avatarAndi Shyti <andi.shyti@linux.intel.com>
Reviewed-by: default avatarUmesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Signed-off-by: default avatarTvrtko Ursulin <tvrtko.ursulin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230328093627.5067-1-lm0963hack@gmail.com
[tursulin: Manually added stable tag.]
parent b7d70b8b

drivers/gpu/drm/i915/i915_perf.c

+3 −3
Original line number Diff line number Diff line
@@ -4802,13 +4802,13 @@ int i915_perf_add_config_ioctl(struct drm_device *dev, void *data, 
		err = oa_config->id;

		goto sysfs_err;

	}



	mutex_unlock(&perf->metrics_lock);

	id = oa_config->id;



	drm_dbg(&perf->i915->drm,

		"Added config %s id=%i\n", oa_config->uuid, oa_config->id);

	mutex_unlock(&perf->metrics_lock);



	return oa_config->id;

	return id;



sysfs_err:

	mutex_unlock(&perf->metrics_lock);