Eric Lee / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit 6a9428427da1775ae79baa8414fdb31db546a384

Authored by Steve Cohen
Committed by Greg Kroah-Hartman
1 parent 7eef3b463d

drm: hold gem reference until object is no longer accessed 

commit 8490d6a7e0a0a6fab5c2d82d57a3937306660864 upstream.

A use-after-free in drm_gem_open_ioctl can happen if the
GEM object handle is closed between the idr lookup and
retrieving the size from said object since a local reference
is not being held at that point. Hold the local reference
while the object can still be accessed to fix this and
plug the potential security hole.

Signed-off-by: Steve Cohen <cohens@codeaurora.org>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Showing 1 changed file with 4 additions and 6 deletions Side-by-side Diff

drivers/gpu/drm/drm_gem.c
Diff comments   View file @ 6a94284
... ... @@ -872,9 +872,6 @@
872 872 * @file_priv: drm file-private structure
873 873 *
874 874 * Open an object using the global name, returning a handle and the size.
875   - *
876   - * This handle (of course) holds a reference to the object, so the object
877   - * will not go away until the handle is deleted.
878 875 */
879 876 int
880 877 drm_gem_open_ioctl(struct drm_device *dev, void *data,
881 878  
882 879  
... ... @@ -899,14 +896,15 @@
899 896  
900 897 /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
901 898 ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
902   - drm_gem_object_put_unlocked(obj);
903 899 if (ret)
904   - return ret;
  900 + goto err;
905 901  
906 902 args->handle = handle;
907 903 args->size = obj->size;
908 904  
909   - return 0;
  905 +err:
  906 + drm_gem_object_put_unlocked(obj);
  907 + return ret;
910 908 }
911 909  
912 910 /**