Commit 8742b2d8 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 

Pull habanalabs fix from Al Viro:
 "Yet another use-after-free fix due to dma_buf_fd() misuse"

* tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  habanalabs: fix UAF in export_dmabuf()
parents 0e39a731 33927f3d

drivers/accel/habanalabs/common/memory.c

+7 −16
Original line number Diff line number Diff line
@@ -1829,9 +1829,6 @@ static void hl_release_dmabuf(struct dma_buf *dmabuf) 
	struct hl_dmabuf_priv *hl_dmabuf = dmabuf->priv;

	struct hl_ctx *ctx;



	if (!hl_dmabuf)

		return;



	ctx = hl_dmabuf->ctx;



	if (hl_dmabuf->memhash_hnode)
@@ -1859,7 +1856,12 @@ static int export_dmabuf(struct hl_ctx *ctx, 
{

	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);

	struct hl_device *hdev = ctx->hdev;

	int rc, fd;

	CLASS(get_unused_fd, fd)(flags);



	if (fd < 0) {

		dev_err(hdev->dev, "failed to get a file descriptor for a dma-buf, %d\n", fd);

		return fd;

	}



	exp_info.ops = &habanalabs_dmabuf_ops;

	exp_info.size = total_size;
@@ -1872,13 +1874,6 @@ static int export_dmabuf(struct hl_ctx *ctx, 
		return PTR_ERR(hl_dmabuf->dmabuf);

	}



	fd = dma_buf_fd(hl_dmabuf->dmabuf, flags);

	if (fd < 0) {

		dev_err(hdev->dev, "failed to get a file descriptor for a dma-buf, %d\n", fd);

		rc = fd;

		goto err_dma_buf_put;

	}



	hl_dmabuf->ctx = ctx;

	hl_ctx_get(hl_dmabuf->ctx);

	atomic_inc(&ctx->hdev->dmabuf_export_cnt);
@@ -1890,13 +1885,9 @@ static int export_dmabuf(struct hl_ctx *ctx, 
	get_file(ctx->hpriv->file_priv->filp);



	*dmabuf_fd = fd;

	fd_install(take_fd(fd), hl_dmabuf->dmabuf->file);



	return 0;



err_dma_buf_put:

	hl_dmabuf->dmabuf->priv = NULL;

	dma_buf_put(hl_dmabuf->dmabuf);

	return rc;

}



static int validate_export_params_common(struct hl_device *hdev, u64 addr, u64 size, u64 offset)