Hello everyone, I'm Zheng Wang. I found a potential double-free bug in drivers/gpu/drm/i915/gvt/gtt.c. I haven't been replied for a long time. So I decided to send it to more relavent supporters and developers to help to solve the problem.
Best regards, Zheng Wang. xmzyshypnc <1002992...@qq.com> 于2022年9月4日周日 20:32写道: > There is a double-free security bug in split_2MB_gtt_entry. > > Here is a calling chain : > ppgtt_populate_spt->ppgtt_populate_shadow_entry->split_2MB_gtt_entry. If > intel_gvt_dma_map_guest_page failed, it will call ppgtt_invalidate_spt, > which will finally call ppgtt_free_spt and kfree(spt). But the caller does > not notice that, and it will call ppgtt_free_spt again in error path. > > Fix this by returning the result of ppgtt_invalidate_spt to > split_2MB_gtt_entry. > > Signed-off-by: Zheng Wang <1002992...@qq.com> > --- > drivers/gpu/drm/i915/gvt/gtt.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/i915/gvt/gtt.c > b/drivers/gpu/drm/i915/gvt/gtt.c > index ce0eb03709c3..9f14fded8c0c 100644 > --- a/drivers/gpu/drm/i915/gvt/gtt.c > +++ b/drivers/gpu/drm/i915/gvt/gtt.c > @@ -1215,7 +1215,7 @@ static int split_2MB_gtt_entry(struct intel_vgpu > *vgpu, > ret = intel_gvt_dma_map_guest_page(vgpu, start_gfn + > sub_index, > PAGE_SIZE, &dma_addr); > if (ret) { > - ppgtt_invalidate_spt(spt); > + ret = ppgtt_invalidate_spt(spt); > return ret; > } > sub_se.val64 = se->val64; > -- > 2.25.1 > >