Commit a66f1efc authored by Rob Clark's avatar Rob Clark
Browse files

drm/msm/gpu: Fix potential double-free 



If userspace was calling the MSM_SET_PARAM ioctl on multiple threads to
set the COMM or CMDLINE param, it could trigger a race causing the
previous value to be kfree'd multiple times.  Fix this by serializing on
the gpu lock.

Signed-off-by: default avatarRob Clark <robdclark@chromium.org>
Fixes: d4726d77 ("drm/msm: Add a way to override processes comm/cmdline")
Patchwork: https://patchwork.freedesktop.org/patch/517778/
Link: https://lore.kernel.org/r/20230110212903.1925878-1-robdclark@gmail.com
parent e752e545

drivers/gpu/drm/msm/adreno/adreno_gpu.c

+4 −0
Original line number Diff line number Diff line
@@ -352,6 +352,8 @@ int adreno_set_param(struct msm_gpu *gpu, struct msm_file_private *ctx, 
		/* Ensure string is null terminated: */

		str[len] = '\0';



		mutex_lock(&gpu->lock);



		if (param == MSM_PARAM_COMM) {

			paramp = &ctx->comm;

		} else {
@@ -361,6 +363,8 @@ int adreno_set_param(struct msm_gpu *gpu, struct msm_file_private *ctx, 
		kfree(*paramp);

		*paramp = str;



		mutex_unlock(&gpu->lock);



		return 0;

	}

	case MSM_PARAM_SYSPROF:

drivers/gpu/drm/msm/msm_gpu.c

+2 −0
Original line number Diff line number Diff line
@@ -335,6 +335,8 @@ static void get_comm_cmdline(struct msm_gem_submit *submit, char **comm, char ** 
	struct msm_file_private *ctx = submit->queue->ctx;

	struct task_struct *task;



	WARN_ON(!mutex_is_locked(&submit->gpu->lock));



	/* Note that kstrdup will return NULL if argument is NULL: */

	*comm = kstrdup(ctx->comm, GFP_KERNEL);

	*cmd  = kstrdup(ctx->cmdline, GFP_KERNEL);

drivers/gpu/drm/msm/msm_gpu.h

+10 −2
Original line number Diff line number Diff line
@@ -366,10 +366,18 @@ struct msm_file_private { 
	 */

	int sysprof;



	/** comm: Overridden task comm, see MSM_PARAM_COMM */

	/**

	 * comm: Overridden task comm, see MSM_PARAM_COMM

	 *

	 * Accessed under msm_gpu::lock

	 */

	char *comm;



	/** cmdline: Overridden task cmdline, see MSM_PARAM_CMDLINE */

	/**

	 * cmdline: Overridden task cmdline, see MSM_PARAM_CMDLINE

	 *

	 * Accessed under msm_gpu::lock

	 */

	char *cmdline;



	/**