linux/drivers/gpu
Steve Cohen 8490d6a7e0 drm: hold gem reference until object is no longer accessed
A use-after-free in drm_gem_open_ioctl can happen if the
GEM object handle is closed between the idr lookup and
retrieving the size from said object since a local reference
is not being held at that point. Hold the local reference
while the object can still be accessed to fix this and
plug the potential security hole.

Signed-off-by: Steve Cohen <cohens@codeaurora.org>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org
2020-07-27 22:05:51 +02:00
..
drm drm: hold gem reference until object is no longer accessed 2020-07-27 22:05:51 +02:00
host1x gpu: host1x: Use SMMU on Tegra124 and Tegra210 2020-04-28 11:44:07 +02:00
ipu-v3
trace gpu/trace: add a gpu total memory usage tracepoint 2020-03-03 17:52:41 -05:00
vga
Makefile gpu/trace: add a gpu total memory usage tracepoint 2020-03-03 17:52:41 -05:00