tree fa61abffafe141c23e625143ee801a5aaf3330e4
parent d6e8ea926933d8cd7e9df1487a2c063fbeffaea7
author Hridya Valsaraju <hridya@google.com> 1633668009 -0700
committer Hridya Valsaraju <hridya@google.com> 1634662494 +0000

BACKPORT: dmabuf: fix use-after-free of dmabuf's file->f_inode

It is observed 'use-after-free' on the dmabuf's file->f_inode with the
race between closing the dmabuf file and reading the dmabuf's debug
info.

Consider the below scenario where P1 is closing the dma_buf file
and P2 is reading the dma_buf's debug info in the system:

P1						P2
					dma_buf_debug_show()
dma_buf_put()
  __fput()
    file->f_op->release()
    dput()
    ....
      dentry_unlink_inode()
        iput(dentry->d_inode)
        (where the inode is freed)
					mutex_lock(&db_list.lock)
					read 'dma_buf->file->f_inode'
					(the same inode is freed by P1)
					mutex_unlock(&db_list.lock)
      dentry->d_op->d_release()-->
        dma_buf_release()
          .....
          mutex_lock(&db_list.lock)
          removes the dmabuf from the list
          mutex_unlock(&db_list.lock)

In the above scenario, when dma_buf_put() is called on a dma_buf, it
first frees the dma_buf's file->f_inode(=dentry->d_inode) and then
removes this dma_buf from the system db_list. In between P2 traversing
the db_list tries to access this dma_buf's file->f_inode that was freed
by P1 which is a use-after-free case.

Since, __fput() calls f_op->release first and then later calls the
d_op->d_release, move the dma_buf's db_list removal from d_release() to
f_op->release(). This ensures that dma_buf's file->f_inode is not
accessed after it is released.

Bug: 202076713
Cc: <stable@vger.kernel.org> # 5.4+
Fixes: 4ab59c3c638c ("dma-buf: Move dma_buf_release() from fops to dentry_ops")
Acked-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>
Change-Id: Id85b6d3a8e9b1d637f31661db6adf854b01d8467
(cherry picked from commit 05cd84691eafcd7959a1e120d5e72c0dd98c5d91)
[hridya: minor conflict resolution]
Signed-off-by: Hridya Valsaraju <hridya@google.com>