[SRU][F][PATCH v2 0/7] CVE-2023-39198

[Bethany Jamison]

[Impact]

A race condition was found in the QXL driver in the Linux kernel. The
qxl_mode_dumb_create() function dereferences the qobj returned by the
qxl_gem_object_create_with_handle(), but the handle is the only one holding
a reference to it. This flaw allows an attacker to guess the returned
handle value and trigger a use-after-free issue, potentially leading to a
denial of service or privilege escalation.

[Fix]

Focal: The fix commit required many prereqs many of which come from the link
below at the request of the stable team. 6/7 commits were clean cherry-picks
1 commit required backporting. The backport was very simple, I accepted the
incoming change to delete the drm_gem_object_put_unlocked function since 
the only difference between Focal and upstream was that Focal had an
additional validation check in that function.
https://github.com/torvalds/linux/commits/master/?since=2020-05-12&until=2020-05-26&author=evelikov-work

[Test Case]

Compile and boot tested.

[Where issues could occur]

This change affects those who use the qxl driver, this patch introduces
many changes which naturally increases the risk of regression.

v2:
Resubmitted to apply additional prereq commits at the request of the stable
team to address potential regression.

Emil Velikov (5):
  drm/gem: use _unlocked reference in drm_gem_objects_lookup docs
  drm/gem: fold drm_gem_object_put_unlocked and __drm_gem_object_put()
  drm/gem: add _locked suffix to drm_gem_object_put
  drm/gem: add drm_gem_object_put helper
  drm/qxl: remove _unlocked suffix in drm_gem_object_put_unlocked

Gerd Hoffmann (1):
  drm/qxl: allocate dumb buffers in ram

Wander Lairson Costa (1):
  drm/qxl: fix UAF on handle creation

 drivers/gpu/drm/drm_gem.c                  | 38 +++-------------------
 drivers/gpu/drm/i915/gem/i915_gem_object.h |  2 +-
 drivers/gpu/drm/msm/adreno/a5xx_debugfs.c  |  4 +--
 drivers/gpu/drm/msm/msm_drv.c              |  2 +-
 drivers/gpu/drm/msm/msm_gem.c              |  6 ++--
 drivers/gpu/drm/msm/msm_gem_submit.c       |  2 +-
 drivers/gpu/drm/msm/msm_gpu.c              |  2 +-
 drivers/gpu/drm/qxl/qxl_cmd.c              |  2 +-
 drivers/gpu/drm/qxl/qxl_display.c          |  6 ++--
 drivers/gpu/drm/qxl/qxl_drv.h              |  2 +-
 drivers/gpu/drm/qxl/qxl_dumb.c             |  9 +++--
 drivers/gpu/drm/qxl/qxl_gem.c              | 25 +++++++++-----
 drivers/gpu/drm/qxl/qxl_ioctl.c            | 10 +++---
 drivers/gpu/drm/qxl/qxl_object.c           |  4 +--
 include/drm/drm_drv.h                      |  2 --
 include/drm/drm_gem.h                      | 22 ++++---------
 16 files changed, 54 insertions(+), 84 deletions(-)

-- 
2.34.1