Linux Kernel Accel/Rocket Component Use-After-Free Vulnerability via Dangling GEM Handle

A use-after-free vulnerability has been identified in the Linux kernel's acceleration component for the Rocket graphics driver. This issue arises in the 'create_bo' ioctl function, where a Graphics Execution Manager (GEM) handle is inserted into the file's IDR (Index Descriptor Register) via 'drm_gem_handle_create()' before completing several critical operations that could fail. If any of these operations, such as scatter-gather table allocation or IOMMU mapping, fail after the handle has been activated, the error handling routine frees the associated object without removing the handle from the IDR. This oversight creates a dangling handle that points to deallocated memory, leading to a use-after-free condition. Subsequent ioctls that use this handle can dereference the freed memory, causing potential exploitation.

Impact

Exploitation of this vulnerability leads to a use-after-free condition, allowing for the dereferencing of freed memory, which can be exploited to execute arbitrary code or cause a denial-of-service.

Reproduction

To reproduce this vulnerability, invoke the 'rocket_ioctl_create_bo' function in the Rocket graphics driver. The function will insert a GEM handle into the file's IDR. If the subsequent operations, such as allocating a scatter-gather table or inserting a node into the memory manager, fail after the handle is live, the error handling will free the associated object without removing the handle from the IDR. This leaves a dangling handle that can be used in later ioctls, such as 'PREP_BO', 'FINI_BO', or 'SUBMIT', which will then dereference the freed memory, creating a use-after-free vulnerability.

Remediation

The vulnerability has been addressed by modifying the 'rocket_ioctl_create_bo' function to move the GEM handle creation process to after all potentially failing operations have successfully completed. This adjustment aligns with the handling patterns used by other drivers such as Panfrost, Lima, and Etnaviv.