vmw_gb_surface_reference_internal() rejects a surface that has no backup buffer by logging an error and jumping to out_bad_resource, but it never sets ret on that path. ret is still 0 from the earlier successful vmw_surface_handle_reference(), so the ioctl returns success while leaving the reply structure unfilled — user space is handed a "successful" reply that was never produced. DRM_VMW_GB_SURFACE_REF is DRM_RENDER_ALLOW, so an unprivileged local user can reach it. Set ret to -EINVAL and, on the error paths, drop the reference that vmw_surface_handle_reference() took; once the ioctl fails user space no longer releases it via DRM_VMW_UNREF_SURFACE. The unref is guarded by ret so the shared success fall-through keeps the reference the caller still owns, and it also plugs the same leak on the drm_gem_handle_create() failure path. Fixes: 14b1c33e8429 ("drm/vmwgfx: Add new ioctl for GB surface create and reference") Cc: stable@vger.kernel.org Suggested-by: Zack Rusin Signed-off-by: Aldo Ariel Panzardo --- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c index bd0563741e89..97966d849583 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c @@ -1720,6 +1720,7 @@ vmw_gb_surface_reference_internal(struct drm_device *dev, srf = &user_srf->srf; if (!srf->res.guest_memory_bo) { DRM_ERROR("Shared GB surface is missing a backup buffer.\n"); + ret = -EINVAL; goto out_bad_resource; } metadata = &srf->metadata; @@ -1758,6 +1759,9 @@ vmw_gb_surface_reference_internal(struct drm_device *dev, rep->creq.must_be_zero = 0; out_bad_resource: + if (ret) + ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile, + base->handle); ttm_base_object_unref(&base); return ret; -- 2.43.0