leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

drm/vmwgfx: Fix stale file descriptors on failed usercopy

Browse Source 
A failing usercopy of the fence_rep object will lead to a stale entry in
the file descriptor table as put_unused_fd() won't release it. This
enables userland to refer to a dangling 'file' object through that still
valid file descriptor, leading to all kinds of use-after-free
exploitation scenarios.

Fix this by deferring the call to fd_install() until after the usercopy
has succeeded.

Fixes: c906965dee ("drm/vmwgfx: Add export fence to file descriptor support")
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
Signed-off-by: Zack Rusin <zackr@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Mathias Krause
2022-01-27 18:34:19 +10:00
committed by Linus Torvalds
parent 626b2dda76
commit a0f90c8815
4 changed files with 21 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
View File

@@ -1128,7 +1128,7 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
}
vmw_execbuf_copy_fence_user(dev_priv, vmw_fp, 0, user_fence_rep, fence,
handle, -1, NULL);
handle, -1);
vmw_fence_obj_unreference(&fence);
return 0;
out_no_create: