Re: [PATCH v3 2/2] drm: protect drm_master pointers in drm_lease.c

2021-06-23 Thread Daniel Vetter
On Wed, Jun 23, 2021 at 5:49 AM Desmond Cheong Zhi Xi
 wrote:
>
> On 21/6/21 10:47 pm, Daniel Vetter wrote:
> > On Sun, Jun 20, 2021 at 07:03:27PM +0800, Desmond Cheong Zhi Xi wrote:
> >> diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
> >> index 86d4b72e95cb..0c64a77c67a6 100644
> >> --- a/drivers/gpu/drm/drm_auth.c
> >> +++ b/drivers/gpu/drm/drm_auth.c
> >> @@ -384,6 +384,28 @@ struct drm_master *drm_master_get(struct drm_master 
> >> *master)
> >>   }
> >>   EXPORT_SYMBOL(drm_master_get);
> >>
> >> +/**
> >> + * drm_file_get_master - reference @file_priv->master
> >> + * @file_priv: DRM file private
> >> + *
> >> + * Increments the reference count of @file_priv->master and returns
> >
> > Does this format correctly? I'd go with "_file.master of @file_priv".
> >
>
> Got it. "file_priv->master" was bolded, but no link to drm_file.master
> was generated. I'll update this.
>
> >> + * @file_priv->master.
> >> + *
> >> + * Master pointers returned from this function should be unreferenced 
> >> using
> >> + * drm_master_put().
> >> + */
> >> +struct drm_master *drm_file_get_master(struct drm_file *file_priv)
> >> +{
> >> +struct drm_master *master;
> >> +
> >> +mutex_lock(_priv->master->dev->master_mutex);
> >> +master = drm_master_get(file_priv->master);
> >> +mutex_unlock(_priv->master->dev->master_mutex);
> >> +
> >> +return master;
> >> +}
> >> +EXPORT_SYMBOL(drm_file_get_master);
> >> +
> >>   static void drm_master_destroy(struct kref *kref)
> >>   {
> >>  struct drm_master *master = container_of(kref, struct drm_master, 
> >> refcount);
> >> diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
> >> index da4f085fc09e..65eab82f8acc 100644
> >> --- a/drivers/gpu/drm/drm_lease.c
> >> +++ b/drivers/gpu/drm/drm_lease.c
> >> @@ -107,10 +107,17 @@ static bool _drm_has_leased(struct drm_master 
> >> *master, int id)
> >>*/
> >>   bool _drm_lease_held(struct drm_file *file_priv, int id)
> >>   {
> >> +bool ret;
> >> +struct drm_master *master;
> >> +
> >>  if (!file_priv || !file_priv->master)
> >
> > So here we still have a ->master access outside of the locked code
> > section. I think the best fix for that would be to move the NULL check
> > into drm_file_get_master (where we grab the lock already anyway), and
> > update the kerneldoc to state that it might return NULL.
> >
> > Same with all the checks for ->master below.
> >
>
> Moving the check into drm_file_get_master sounds good. Grabbing the lock
> before performing the NULL check poses a little chicken-and-egg problem
> though.
>
> It's true that without the lock, even if file_priv->master passes the
> NULL check, it could be freed in the time between the check and grabbing
> the lock.
>
> However, based on the original code, it seems there's the possibility
> that file_priv->master might be NULL. In this case, grabbing the lock
> results in a null ptr dereference because we get the mutex via
> _priv->master->dev->master_mutex.
>
> By this reasoning, I think the safer method is still to perform the NULL
> check before grabbing the lock.

file_priv->dev->master_mutex should also work and avoid the trouble.

Please also cc intel-gfx list, there's a CI system there to test your
patches. Since patch 1 of this series had pretty bad deadlock that I
didn't see would be good to make sure we get more test coverage on
these.

Thanks, Daniel

>
> >>  return true;
> >>
> >> -return _drm_lease_held_master(file_priv->master, id);
> >> +master = drm_file_get_master(file_priv);
> >> +ret = _drm_lease_held_master(master, id);
> >> +drm_master_put();
> >> +
> >> +return ret;
> >>   }
> >>
> >>   /**
> >> @@ -132,10 +139,11 @@ bool drm_lease_held(struct drm_file *file_priv, int 
> >> id)
> >>  if (!file_priv || !file_priv->master || !file_priv->master->lessor)
> >>  return true;
> >
> > master->lessor dereferenced outside the lock or without holding a
> > reference.
> >
> >>
> >> -master = file_priv->master;
> >> +master = drm_file_get_master(file_priv);
> >>  mutex_lock(>dev->mode_config.idr_mutex);
> >>  ret = _drm_lease_held_master(master, id);
> >>  mutex_unlock(>dev->mode_config.idr_mutex);
> >> +drm_master_put();
> >>  return ret;
> >>   }
> >>
> >> @@ -158,7 +166,7 @@ uint32_t drm_lease_filter_crtcs(struct drm_file 
> >> *file_priv, uint32_t crtcs_in)
> >>  if (!file_priv || !file_priv->master || !file_priv->master->lessor)
> >>  return crtcs_in;
> >
> > Same here.
> >
> >>
> >> -master = file_priv->master;
> >> +master = drm_file_get_master(file_priv);
> >>  dev = master->dev;
> >>
> >>  count_in = count_out = 0;
> >> @@ -177,6 +185,7 @@ uint32_t drm_lease_filter_crtcs(struct drm_file 
> >> *file_priv, uint32_t crtcs_in)
> >>  count_in++;
> >>  }
> >>  mutex_unlock(>dev->mode_config.idr_mutex);
> >> +drm_master_put();
> >>  return crtcs_out;
> >>   }

Re: [PATCH v3 2/2] drm: protect drm_master pointers in drm_lease.c

2021-06-22 Thread Desmond Cheong Zhi Xi

On 21/6/21 10:47 pm, Daniel Vetter wrote:

On Sun, Jun 20, 2021 at 07:03:27PM +0800, Desmond Cheong Zhi Xi wrote:

diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index 86d4b72e95cb..0c64a77c67a6 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -384,6 +384,28 @@ struct drm_master *drm_master_get(struct drm_master 
*master)
  }
  EXPORT_SYMBOL(drm_master_get);
  
+/**

+ * drm_file_get_master - reference @file_priv->master
+ * @file_priv: DRM file private
+ *
+ * Increments the reference count of @file_priv->master and returns


Does this format correctly? I'd go with "_file.master of @file_priv".



Got it. "file_priv->master" was bolded, but no link to drm_file.master 
was generated. I'll update this.



+ * @file_priv->master.
+ *
+ * Master pointers returned from this function should be unreferenced using
+ * drm_master_put().
+ */
+struct drm_master *drm_file_get_master(struct drm_file *file_priv)
+{
+   struct drm_master *master;
+
+   mutex_lock(_priv->master->dev->master_mutex);
+   master = drm_master_get(file_priv->master);
+   mutex_unlock(_priv->master->dev->master_mutex);
+
+   return master;
+}
+EXPORT_SYMBOL(drm_file_get_master);
+
  static void drm_master_destroy(struct kref *kref)
  {
struct drm_master *master = container_of(kref, struct drm_master, 
refcount);
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index da4f085fc09e..65eab82f8acc 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -107,10 +107,17 @@ static bool _drm_has_leased(struct drm_master *master, 
int id)
   */
  bool _drm_lease_held(struct drm_file *file_priv, int id)
  {
+   bool ret;
+   struct drm_master *master;
+
if (!file_priv || !file_priv->master)


So here we still have a ->master access outside of the locked code
section. I think the best fix for that would be to move the NULL check
into drm_file_get_master (where we grab the lock already anyway), and
update the kerneldoc to state that it might return NULL.

Same with all the checks for ->master below.



Moving the check into drm_file_get_master sounds good. Grabbing the lock 
before performing the NULL check poses a little chicken-and-egg problem 
though.


It's true that without the lock, even if file_priv->master passes the 
NULL check, it could be freed in the time between the check and grabbing 
the lock.


However, based on the original code, it seems there's the possibility 
that file_priv->master might be NULL. In this case, grabbing the lock 
results in a null ptr dereference because we get the mutex via 
_priv->master->dev->master_mutex.


By this reasoning, I think the safer method is still to perform the NULL 
check before grabbing the lock.



return true;
  
-	return _drm_lease_held_master(file_priv->master, id);

+   master = drm_file_get_master(file_priv);
+   ret = _drm_lease_held_master(master, id);
+   drm_master_put();
+
+   return ret;
  }
  
  /**

@@ -132,10 +139,11 @@ bool drm_lease_held(struct drm_file *file_priv, int id)
if (!file_priv || !file_priv->master || !file_priv->master->lessor)
return true;


master->lessor dereferenced outside the lock or without holding a
reference.

  
-	master = file_priv->master;

+   master = drm_file_get_master(file_priv);
mutex_lock(>dev->mode_config.idr_mutex);
ret = _drm_lease_held_master(master, id);
mutex_unlock(>dev->mode_config.idr_mutex);
+   drm_master_put();
return ret;
  }
  
@@ -158,7 +166,7 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, uint32_t crtcs_in)

if (!file_priv || !file_priv->master || !file_priv->master->lessor)
return crtcs_in;


Same here.

  
-	master = file_priv->master;

+   master = drm_file_get_master(file_priv);
dev = master->dev;
  
  	count_in = count_out = 0;

@@ -177,6 +185,7 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, 
uint32_t crtcs_in)
count_in++;
}
mutex_unlock(>dev->mode_config.idr_mutex);
+   drm_master_put();
return crtcs_out;
  }
  
@@ -490,7 +499,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,

size_t object_count;
int ret = 0;
struct idr leases;
-   struct drm_master *lessor = lessor_priv->master;
+   struct drm_master *lessor;
struct drm_master *lessee = NULL;
struct file *lessee_file = NULL;
struct file *lessor_file = lessor_priv->filp;
@@ -502,12 +511,6 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
  
-	/* Do not allow sub-leases */

-   if (lessor->lessor) {
-   DRM_DEBUG_LEASE("recursive leasing not allowed\n");
-   return -EINVAL;
-   }
-
/* need some objects */
if (cl->object_count 

Re: [PATCH v3 2/2] drm: protect drm_master pointers in drm_lease.c

2021-06-21 Thread Daniel Vetter
On Sun, Jun 20, 2021 at 07:03:27PM +0800, Desmond Cheong Zhi Xi wrote:
> Currently, direct copies of drm_file->master pointers should be
> protected by drm_device.master_mutex when being dereferenced. This is
> because drm_file->master is not invariant for the lifetime of
> drm_file. If drm_file is not the creator of master, then
> drm_file->is_master is false, and a call to drm_setmaster_ioctl will
> invoke drm_new_set_master, which then allocates a new master for
> drm_file and puts the old master.
> 
> Thus, without holding drm_device.master_mutex, the old value of
> drm_file->master could be freed while it is being used by another
> concurrent process.
> 
> In drm_lease.c, there are multiple instances where drm_file->master is
> accessed and dereferenced while drm_device.master_mutex is not
> held. This makes drm_lease.c vulnerable to use-after-free bugs.
> 
> We address this issue as follows:
> 
> 1. Clarify in the kerneldoc that drm_file->master is protected by
> drm_device.master_mutex.
> 
> 2. Add a new drm_file_get_master() function that calls drm_master_get
> on drm_file->master while holding on to drm_device.master_mutex. Since
> drm_master_get increments the reference count of master, this
> prevents master from being freed until we unreference it with
> drm_master_put.
> 
> 3. In each case where drm_file->master is directly accessed and
> eventually dereferenced in drm_lease.c, we wrap the access in a call
> to the new drm_file_get_master function, then unreference the master
> pointer once we are done using it.
> 
> Reported-by: Daniel Vetter 
> Signed-off-by: Desmond Cheong Zhi Xi 

I think this approach looks much clearer than the previous. I've found a
few smaller things below still. I think at least ...

Cheers, Daniel

> ---
>  drivers/gpu/drm/drm_auth.c  | 22 ++
>  drivers/gpu/drm/drm_lease.c | 57 ++---
>  include/drm/drm_auth.h  |  1 +
>  include/drm/drm_file.h  | 15 --
>  4 files changed, 75 insertions(+), 20 deletions(-)
> 
> diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
> index 86d4b72e95cb..0c64a77c67a6 100644
> --- a/drivers/gpu/drm/drm_auth.c
> +++ b/drivers/gpu/drm/drm_auth.c
> @@ -384,6 +384,28 @@ struct drm_master *drm_master_get(struct drm_master 
> *master)
>  }
>  EXPORT_SYMBOL(drm_master_get);
>  
> +/**
> + * drm_file_get_master - reference @file_priv->master
> + * @file_priv: DRM file private
> + *
> + * Increments the reference count of @file_priv->master and returns

Does this format correctly? I'd go with "_file.master of @file_priv".

> + * @file_priv->master.
> + *
> + * Master pointers returned from this function should be unreferenced using
> + * drm_master_put().
> + */
> +struct drm_master *drm_file_get_master(struct drm_file *file_priv)
> +{
> + struct drm_master *master;
> +
> + mutex_lock(_priv->master->dev->master_mutex);
> + master = drm_master_get(file_priv->master);
> + mutex_unlock(_priv->master->dev->master_mutex);
> +
> + return master;
> +}
> +EXPORT_SYMBOL(drm_file_get_master);
> +
>  static void drm_master_destroy(struct kref *kref)
>  {
>   struct drm_master *master = container_of(kref, struct drm_master, 
> refcount);
> diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
> index da4f085fc09e..65eab82f8acc 100644
> --- a/drivers/gpu/drm/drm_lease.c
> +++ b/drivers/gpu/drm/drm_lease.c
> @@ -107,10 +107,17 @@ static bool _drm_has_leased(struct drm_master *master, 
> int id)
>   */
>  bool _drm_lease_held(struct drm_file *file_priv, int id)
>  {
> + bool ret;
> + struct drm_master *master;
> +
>   if (!file_priv || !file_priv->master)

So here we still have a ->master access outside of the locked code
section. I think the best fix for that would be to move the NULL check
into drm_file_get_master (where we grab the lock already anyway), and
update the kerneldoc to state that it might return NULL.

Same with all the checks for ->master below.

>   return true;
>  
> - return _drm_lease_held_master(file_priv->master, id);
> + master = drm_file_get_master(file_priv);
> + ret = _drm_lease_held_master(master, id);
> + drm_master_put();
> +
> + return ret;
>  }
>  
>  /**
> @@ -132,10 +139,11 @@ bool drm_lease_held(struct drm_file *file_priv, int id)
>   if (!file_priv || !file_priv->master || !file_priv->master->lessor)
>   return true;

master->lessor dereferenced outside the lock or without holding a
reference.

>  
> - master = file_priv->master;
> + master = drm_file_get_master(file_priv);
>   mutex_lock(>dev->mode_config.idr_mutex);
>   ret = _drm_lease_held_master(master, id);
>   mutex_unlock(>dev->mode_config.idr_mutex);
> + drm_master_put();
>   return ret;
>  }
>  
> @@ -158,7 +166,7 @@ uint32_t drm_lease_filter_crtcs(struct drm_file 
> *file_priv, uint32_t crtcs_in)
>   if (!file_priv || !file_priv->master || 

[PATCH v3 2/2] drm: protect drm_master pointers in drm_lease.c

2021-06-20 Thread Desmond Cheong Zhi Xi
Currently, direct copies of drm_file->master pointers should be
protected by drm_device.master_mutex when being dereferenced. This is
because drm_file->master is not invariant for the lifetime of
drm_file. If drm_file is not the creator of master, then
drm_file->is_master is false, and a call to drm_setmaster_ioctl will
invoke drm_new_set_master, which then allocates a new master for
drm_file and puts the old master.

Thus, without holding drm_device.master_mutex, the old value of
drm_file->master could be freed while it is being used by another
concurrent process.

In drm_lease.c, there are multiple instances where drm_file->master is
accessed and dereferenced while drm_device.master_mutex is not
held. This makes drm_lease.c vulnerable to use-after-free bugs.

We address this issue as follows:

1. Clarify in the kerneldoc that drm_file->master is protected by
drm_device.master_mutex.

2. Add a new drm_file_get_master() function that calls drm_master_get
on drm_file->master while holding on to drm_device.master_mutex. Since
drm_master_get increments the reference count of master, this
prevents master from being freed until we unreference it with
drm_master_put.

3. In each case where drm_file->master is directly accessed and
eventually dereferenced in drm_lease.c, we wrap the access in a call
to the new drm_file_get_master function, then unreference the master
pointer once we are done using it.

Reported-by: Daniel Vetter 
Signed-off-by: Desmond Cheong Zhi Xi 
---
 drivers/gpu/drm/drm_auth.c  | 22 ++
 drivers/gpu/drm/drm_lease.c | 57 ++---
 include/drm/drm_auth.h  |  1 +
 include/drm/drm_file.h  | 15 --
 4 files changed, 75 insertions(+), 20 deletions(-)

diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index 86d4b72e95cb..0c64a77c67a6 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -384,6 +384,28 @@ struct drm_master *drm_master_get(struct drm_master 
*master)
 }
 EXPORT_SYMBOL(drm_master_get);
 
+/**
+ * drm_file_get_master - reference @file_priv->master
+ * @file_priv: DRM file private
+ *
+ * Increments the reference count of @file_priv->master and returns
+ * @file_priv->master.
+ *
+ * Master pointers returned from this function should be unreferenced using
+ * drm_master_put().
+ */
+struct drm_master *drm_file_get_master(struct drm_file *file_priv)
+{
+   struct drm_master *master;
+
+   mutex_lock(_priv->master->dev->master_mutex);
+   master = drm_master_get(file_priv->master);
+   mutex_unlock(_priv->master->dev->master_mutex);
+
+   return master;
+}
+EXPORT_SYMBOL(drm_file_get_master);
+
 static void drm_master_destroy(struct kref *kref)
 {
struct drm_master *master = container_of(kref, struct drm_master, 
refcount);
diff --git a/drivers/gpu/drm/drm_lease.c b/drivers/gpu/drm/drm_lease.c
index da4f085fc09e..65eab82f8acc 100644
--- a/drivers/gpu/drm/drm_lease.c
+++ b/drivers/gpu/drm/drm_lease.c
@@ -107,10 +107,17 @@ static bool _drm_has_leased(struct drm_master *master, 
int id)
  */
 bool _drm_lease_held(struct drm_file *file_priv, int id)
 {
+   bool ret;
+   struct drm_master *master;
+
if (!file_priv || !file_priv->master)
return true;
 
-   return _drm_lease_held_master(file_priv->master, id);
+   master = drm_file_get_master(file_priv);
+   ret = _drm_lease_held_master(master, id);
+   drm_master_put();
+
+   return ret;
 }
 
 /**
@@ -132,10 +139,11 @@ bool drm_lease_held(struct drm_file *file_priv, int id)
if (!file_priv || !file_priv->master || !file_priv->master->lessor)
return true;
 
-   master = file_priv->master;
+   master = drm_file_get_master(file_priv);
mutex_lock(>dev->mode_config.idr_mutex);
ret = _drm_lease_held_master(master, id);
mutex_unlock(>dev->mode_config.idr_mutex);
+   drm_master_put();
return ret;
 }
 
@@ -158,7 +166,7 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, 
uint32_t crtcs_in)
if (!file_priv || !file_priv->master || !file_priv->master->lessor)
return crtcs_in;
 
-   master = file_priv->master;
+   master = drm_file_get_master(file_priv);
dev = master->dev;
 
count_in = count_out = 0;
@@ -177,6 +185,7 @@ uint32_t drm_lease_filter_crtcs(struct drm_file *file_priv, 
uint32_t crtcs_in)
count_in++;
}
mutex_unlock(>dev->mode_config.idr_mutex);
+   drm_master_put();
return crtcs_out;
 }
 
@@ -490,7 +499,7 @@ int drm_mode_create_lease_ioctl(struct drm_device *dev,
size_t object_count;
int ret = 0;
struct idr leases;
-   struct drm_master *lessor = lessor_priv->master;
+   struct drm_master *lessor;
struct drm_master *lessee = NULL;
struct file *lessee_file = NULL;
struct file *lessor_file = lessor_priv->filp;
@@ -502,12 +511,6 @@ int