NACK/Cmnt: [SRU][F][PATCH v2 0/7] CVE-2023-39198

[Stefan Bader]

On 08.03.24 21:11, Bethany Jamison wrote:
> [Impact]
> 
> A race condition was found in the QXL driver in the Linux kernel. The
> qxl_mode_dumb_create() function dereferences the qobj returned by the
> qxl_gem_object_create_with_handle(), but the handle is the only one holding
> a reference to it. This flaw allows an attacker to guess the returned
> handle value and trigger a use-after-free issue, potentially leading to a
> denial of service or privilege escalation.
> 
> [Fix]
> 
> Focal: The fix commit required many prereqs many of which come from the link
> below at the request of the stable team. 6/7 commits were clean cherry-picks
> 1 commit required backporting. The backport was very simple, I accepted the
> incoming change to delete the drm_gem_object_put_unlocked function since
> the only difference between Focal and upstream was that Focal had an
> additional validation check in that function.
> https://github.com/torvalds/linux/commits/master/?since=2020-05-12&until=2020-05-26&author=evelikov-work
> 
> [Test Case]
> 
> Compile and boot tested.
> 
> [Where issues could occur]
> 
> This change affects those who use the qxl driver, this patch introduces
> many changes which naturally increases the risk of regression.
> 
> v2:
> Resubmitted to apply additional prereq commits at the request of the stable
> team to address potential regression.
> 
> Emil Velikov (5):
>    drm/gem: use _unlocked reference in drm_gem_objects_lookup docs
>    drm/gem: fold drm_gem_object_put_unlocked and __drm_gem_object_put()
>    drm/gem: add _locked suffix to drm_gem_object_put
>    drm/gem: add drm_gem_object_put helper
>    drm/qxl: remove _unlocked suffix in drm_gem_object_put_unlocked
> 
> Gerd Hoffmann (1):
>    drm/qxl: allocate dumb buffers in ram
> 
> Wander Lairson Costa (1):
>    drm/qxl: fix UAF on handle creation
> 
>   drivers/gpu/drm/drm_gem.c                  | 38 +++-------------------
>   drivers/gpu/drm/i915/gem/i915_gem_object.h |  2 +-
>   drivers/gpu/drm/msm/adreno/a5xx_debugfs.c  |  4 +--
>   drivers/gpu/drm/msm/msm_drv.c              |  2 +-
>   drivers/gpu/drm/msm/msm_gem.c              |  6 ++--
>   drivers/gpu/drm/msm/msm_gem_submit.c       |  2 +-
>   drivers/gpu/drm/msm/msm_gpu.c              |  2 +-
>   drivers/gpu/drm/qxl/qxl_cmd.c              |  2 +-
>   drivers/gpu/drm/qxl/qxl_display.c          |  6 ++--
>   drivers/gpu/drm/qxl/qxl_drv.h              |  2 +-
>   drivers/gpu/drm/qxl/qxl_dumb.c             |  9 +++--
>   drivers/gpu/drm/qxl/qxl_gem.c              | 25 +++++++++-----
>   drivers/gpu/drm/qxl/qxl_ioctl.c            | 10 +++---
>   drivers/gpu/drm/qxl/qxl_object.c           |  4 +--
>   include/drm/drm_drv.h                      |  2 --
>   include/drm/drm_gem.h                      | 22 ++++---------
>   16 files changed, 54 insertions(+), 84 deletions(-)
> 

Rejected for the following reasons:
This was sitting around now for quite a long time and I think it needs 
re-sending anyway. So I am closing this thread so we can clean up the queue.

-Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0xE8675DEECBEECEA3.asc
Type: application/pgp-keys
Size: 48643 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20240619/aa36644d/attachment-0001.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20240619/aa36644d/attachment-0001.sig>