leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
Files
a0f90c8815706981c483a652a6aefca51a5e191c
linux/drivers/gpu/drm
History
Mathias Krause a0f90c8815 drm/vmwgfx: Fix stale file descriptors on failed usercopy 
A failing usercopy of the fence_rep object will lead to a stale entry in
the file descriptor table as put_unused_fd() won't release it. This
enables userland to refer to a dangling 'file' object through that still
valid file descriptor, leading to all kinds of use-after-free
exploitation scenarios.

Fix this by deferring the call to fd_install() until after the usercopy
has succeeded.

Fixes: c906965dee ("drm/vmwgfx: Add export fence to file descriptor support")
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
Signed-off-by: Zack Rusin <zackr@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2022-01-27 17:55:20 +02:00
..
amd
Merge tag 'drm-next-2022-01-21' of git://anongit.freedesktop.org/drm/drm
2022-01-21 09:25:38 +02:00
arm
drm: Remove CONFIG_DRM_KMS_CMA_HELPER option
2021-11-30 11:10:03 +01:00
armada
Merge tag 'char-misc-5.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2021-11-04 08:21:47 -07:00
aspeed
Merge v5.16-rc5 into drm-next
2021-12-14 10:24:28 +01:00
ast
Merge tag 'drm-misc-fixes-2022-01-14' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2022-01-14 15:17:17 +01:00
atmel-hlcdc
drm: Remove CONFIG_DRM_KMS_CMA_HELPER option
2021-11-30 11:10:03 +01:00
bridge
drm/bridge: ti-sn65dsi86: Set max register for regmap
2021-12-16 13:02:23 +01:00
etnaviv
Merge tag 'bitmap-5.17-rc1' of git://github.com/norov/linux
2022-01-23 06:20:44 +02:00
exynos
drm/exynos: drop the use of label from exynos_dsi_register_te_irq
2021-12-22 11:39:39 +09:00
fsl-dcu
drm: fsl-dcu: select CONFIG_DRM_GEM_CMA_HELPER
2021-12-06 09:30:16 +01:00
gma500
drm/gma500: Remove generic DRM drivers in probe function
2021-10-21 09:32:51 +02:00
gud
drm/format-helper: Rework format-helper conversion functions
2021-11-11 12:06:57 +01:00
hisilicon
drm: Remove CONFIG_DRM_KMS_CMA_HELPER option
2021-11-30 11:10:03 +01:00
hyperv
Merge v5.16-rc5 into drm-next
2021-12-14 10:24:28 +01:00
i2c
…
i810
drm: IRQ midlayer is now legacy
2021-08-10 20:14:01 +02:00
i915
drm/i915: Flush TLBs before releasing backing store
2022-01-25 20:06:06 +02:00
imx
drm: Remove CONFIG_DRM_KMS_CMA_HELPER option
2021-11-30 11:10:03 +01:00
ingenic
drm: Remove CONFIG_DRM_KMS_CMA_HELPER option
2021-11-30 11:10:03 +01:00
kmb
drm: Remove CONFIG_DRM_KMS_CMA_HELPER option
2021-11-30 11:10:03 +01:00
lib
…
lima
Merge v5.16-rc5 into drm-next
2021-12-14 10:24:28 +01:00
mcde
drm: Remove CONFIG_DRM_KMS_CMA_HELPER option
2021-11-30 11:10:03 +01:00
mediatek
Merge tag 'drm-next-2022-01-07' of git://anongit.freedesktop.org/drm/drm
2022-01-10 12:58:46 -08:00
meson
drm: Remove CONFIG_DRM_KMS_CMA_HELPER option
2021-11-30 11:10:03 +01:00
mga
drm/mga/mga_ioc32: Use struct_group() for memcpy() region
2021-09-25 08:20:48 -07:00
mgag200
drm: Move nomodeset kernel parameter to the DRM subsystem
2021-11-27 13:52:22 +01:00
msm
Merge tag 'drm-msm-next-2021-12-26' of ssh://gitlab.freedesktop.org/drm/msm into drm-next
2021-12-29 14:02:44 +10:00
mxsfb
drm: Remove CONFIG_DRM_KMS_CMA_HELPER option
2021-11-30 11:10:03 +01:00
nouveau
Merge tag 'drm-misc-fixes-2022-01-14' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2022-01-14 15:17:17 +01:00
omapdrm
omapdrm: dss: mark runtime PM functions __maybe_unused
2021-12-08 10:04:59 +02:00
panel
drm/panel: simple: Add Team Source Display TST043015CMHX panel
2021-12-16 09:39:25 +01:00
panfrost
drm: Return error codes from struct drm_driver.gem_create_object
2021-12-02 11:12:39 +01:00
pl111
drm: Remove CONFIG_DRM_KMS_CMA_HELPER option
2021-11-30 11:10:03 +01:00
qxl
drm/qxl: use iterator instead of dma_resv_shared_list
2021-11-30 14:53:02 +01:00
r128
BackMerge tag 'v5.15-rc7' into drm-next
2021-10-28 14:59:38 +10:00
radeon
drm/radeon: fix error handling in radeon_driver_open_kms
2022-01-18 18:00:58 -05:00
rcar-du
Merge tag 'drm-misc-next-2021-12-09' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2021-12-10 15:08:21 +10:00
rockchip
drm/rockchip: pass 0 to drm_fbdev_generic_setup()
2021-12-07 13:57:29 +01:00
savage
…
scheduler
Merge tag 'drm-misc-next-2021-11-18' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2021-11-23 09:38:55 +10:00
selftests
drm/i915/selftests: Properly reset mock object propers for each test
2021-10-22 11:09:45 +02:00
shmobile
drm: Remove CONFIG_DRM_KMS_CMA_HELPER option
2021-11-30 11:10:03 +01:00
sis
…
sprd
drm/sprd: add Unisoc's drm mipi dsi&dphy driver
2021-12-10 12:38:10 +01:00
sti
drm: Remove CONFIG_DRM_KMS_CMA_HELPER option
2021-11-30 11:10:03 +01:00
stm
drm: Remove CONFIG_DRM_KMS_CMA_HELPER option
2021-11-30 11:10:03 +01:00
sun4i
Merge tag 'drm-misc-fixes-2022-01-14' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2022-01-14 15:17:17 +01:00
tdfx
…
tegra
drm/tegra: Add back arm_iommu_detach_device()
2021-12-16 14:30:45 +01:00
tidss
drm: Remove CONFIG_DRM_KMS_CMA_HELPER option
2021-11-30 11:10:03 +01:00
tilcdc
drm: Remove CONFIG_DRM_KMS_CMA_HELPER option
2021-11-30 11:10:03 +01:00
tiny
Merge tag 'drm-misc-fixes-2022-01-14' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2022-01-14 15:17:17 +01:00
ttm
Merge tag 'drm-misc-fixes-2022-01-14' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2022-01-14 15:17:17 +01:00
tve200
drm: Remove CONFIG_DRM_KMS_CMA_HELPER option
2021-11-30 11:10:03 +01:00
udl
drm/udl: fix control-message timeout
2021-11-05 11:15:14 +01:00
v3d
drm: Return error codes from struct drm_driver.gem_create_object
2021-12-02 11:12:39 +01:00
vboxvideo
drm: Move nomodeset kernel parameter to the DRM subsystem
2021-11-27 13:52:22 +01:00
vc4
Merge drm/drm-next into drm-misc-next
2021-12-16 14:48:27 +01:00
vgem
drm: Return error codes from struct drm_driver.gem_create_object
2021-12-02 11:12:39 +01:00
via
drm: IRQ midlayer is now legacy
2021-08-10 20:14:01 +02:00
virtio
Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost
2022-01-18 10:05:48 +02:00
vkms
drm/vkms: Use offset-adjusted shadow-plane mappings and output
2021-08-08 20:27:52 +02:00
vmwgfx
drm/vmwgfx: Fix stale file descriptors on failed usercopy
2022-01-27 17:55:20 +02:00
xen
Merge v5.16-rc5 into drm-next
2021-12-14 10:24:28 +01:00
xlnx
Merge tag 'sound-5.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
2022-01-14 14:55:38 +01:00
drm_agpsupport.c
…
drm_aperture.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_atomic_helper.c
drm: fix error found in some cases after the patch d1af5cd86997
2022-01-14 14:31:54 +01:00
drm_atomic_state_helper.c
…
drm_atomic_uapi.c
drm: get rid of DRM_DEBUG_* log calls in drm core, files drm_a*.c
2021-11-26 16:45:22 +01:00
drm_atomic.c
drm: get rid of DRM_DEBUG_* log calls in drm core, files drm_a*.c
2021-11-26 16:45:22 +01:00
drm_auth.c
drm: get rid of DRM_DEBUG_* log calls in drm core, files drm_a*.c
2021-11-26 16:45:22 +01:00
drm_blend.c
…
drm_bridge_connector.c
…
drm_bridge.c
drm/bridge: Document the probe issue with MIPI-DSI bridges
2021-09-24 19:25:23 +02:00
drm_bufs.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_cache.c
treewide: Replace the use of mem_encrypt_active() with cc_platform_has()
2021-10-04 11:47:24 +02:00
drm_client_modeset.c
Revert "drm: cleanup: drm_modeset_lock_all_ctx() --> DRM_MODESET_LOCK_ALL_BEGIN()"
2021-10-04 09:34:57 -04:00
drm_client.c
…
drm_color_mgmt.c
…
drm_connector.c
drm/connector: use drm_sysfs_connector_hotplug_event
2021-11-02 14:27:11 +01:00
drm_context.c
…
drm_crtc_helper_internal.h
…
drm_crtc_helper.c
Revert "drm: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN()"
2021-10-04 09:34:57 -04:00
drm_crtc_internal.h
drm/connector: Add drm_connector_find_by_fwnode() function (v3)
2021-08-20 12:35:59 +02:00
drm_crtc.c
…
drm_damage_helper.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_debugfs_crc.c
drm/doc: document how userspace should find out CRTC index
2021-06-10 19:14:47 +02:00
drm_debugfs.c
drm: avoid blocking in drm_clients_info's rcu section
2021-07-20 20:14:42 +02:00
drm_displayid.c
…
drm_dma.c
…
drm_dp_aux_bus.c
Merge tag 'bus_remove_return_void-5.15' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core into drm-next
2021-08-11 08:47:08 +10:00
drm_dp_aux_dev.c
…
drm_dp_cec.c
…
drm_dp_dual_mode_helper.c
…
drm_dp_helper.c
drm/dp, drm/i915: Add support for VESA backlights using PWM for brightness control
2021-11-17 17:36:48 -05:00
drm_dp_mst_topology_internal.h
…
drm_dp_mst_topology.c
lib/stackdepot: allow optional init and stack_table allocation by kvmalloc()
2022-01-22 08:33:37 +02:00
drm_drv.c
drm: fix null-ptr-deref in drm_dev_init_release()
2021-10-14 21:39:02 +02:00
drm_dsc.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_dumb_buffers.c
…
drm_edid_load.c
…
drm_edid.c
BackMerge tag 'v5.15-rc7' into drm-next
2021-10-28 14:59:38 +10:00
drm_encoder_slave.c
…
drm_encoder.c
…
drm_fb_cma_helper.c
…
drm_fb_helper.c
Merge tag 'drm-misc-fixes-2022-01-14' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2022-01-14 15:17:17 +01:00
drm_file.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_flip_work.c
…
drm_format_helper.c
drm/format-helper: Add drm_fb_xrgb8888_to_xrgb2101010_toio()
2021-12-16 11:06:30 +01:00
drm_fourcc.c
drm/fourcc: Add packed 10bit YUV 4:2:0 format
2021-12-16 11:23:22 +01:00
drm_framebuffer.c
Revert "drm: cleanup: drm_modeset_lock_all() --> DRM_MODESET_LOCK_ALL_BEGIN()"
2021-10-04 09:34:57 -04:00
drm_gem_atomic_helper.c
drm: use new iterator in drm_gem_plane_helper_prepare_fb v3
2021-10-25 09:33:22 +02:00
drm_gem_cma_helper.c
Merge tag 'drm-misc-next-2021-12-09' of git://anongit.freedesktop.org/drm/drm-misc into drm-next
2021-12-10 15:08:21 +10:00
drm_gem_framebuffer_helper.c
dma-buf: move dma-buf symbols into the DMA_BUF module namespace
2021-10-25 14:53:08 +02:00
drm_gem_shmem_helper.c
Merge v5.16-rc5 into drm-next
2021-12-14 10:24:28 +01:00
drm_gem_ttm_helper.c
…
drm_gem_vram_helper.c
drm: Return error codes from struct drm_driver.gem_create_object
2021-12-02 11:12:39 +01:00
drm_gem.c
drm: use new iterator in drm_gem_fence_array_add_implicit v3
2021-10-07 14:49:11 +02:00
drm_hashtab.c
drm: Declare hashtable as legacy
2021-11-30 09:41:28 +01:00
drm_hdcp.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_internal.h
…
drm_ioc32.c
drm: Copy drm_wait_vblank to user before returning
2021-08-17 13:56:03 -04:00
drm_ioctl.c
GPU: drm: fix style errors
2021-08-28 19:00:20 +02:00
drm_irq.c
drm: Build drm_irq.o only if CONFIG_DRM_LEGACY has been set
2021-10-22 16:20:12 +02:00
drm_kms_helper_common.c
drm: Remove unused code to load the non-existing fbcon.ko
2021-08-18 14:33:47 +02:00
drm_lease.c
drm/lease: allow empty leases
2021-10-01 15:55:47 +02:00
drm_legacy_misc.c
drm: IRQ midlayer is now legacy
2021-08-10 20:14:01 +02:00
drm_legacy.h
drm: Declare hashtable as legacy
2021-11-30 09:41:28 +01:00
drm_lock.c
…
drm_managed.c
…
drm_memory.c
…
drm_mipi_dbi.c
drm/mipi-dbi: Fix source-buffer address in mipi_dbi_buf_copy
2022-01-14 14:43:02 +01:00
drm_mipi_dsi.c
drm/mipi-dsi: Create devm device attachment
2021-09-24 19:25:33 +02:00
drm_mm.c
lib/stackdepot: allow optional init and stack_table allocation by kvmalloc()
2022-01-22 08:33:37 +02:00
drm_mode_config.c
…
drm_mode_object.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_modes.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_modeset_helper.c
…
drm_modeset_lock.c
lib/stackdepot: allow optional init and stack_table allocation by kvmalloc()
2022-01-22 08:33:37 +02:00
drm_nomodeset.c
drm: Fix build error caused by missing drm_nomodeset.o
2021-11-27 21:05:58 +01:00
drm_of.c
drm: of: Add drm_of_lvds_get_data_mapping
2021-10-14 20:47:30 +02:00
drm_panel_orientation_quirks.c
drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L
2021-11-18 11:42:08 +01:00
drm_panel.c
drm/dp: Move panel DP AUX backlight support to drm_dp_helper
2021-07-13 06:38:37 -07:00
drm_pci.c
…
drm_plane_helper.c
drm/plane-helper: fix uninitialized variable reference
2021-10-07 12:24:44 +02:00
drm_plane.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_prime.c
Merge tag 'drm-next-2021-11-12' of git://anongit.freedesktop.org/drm/drm
2021-11-12 12:11:07 -08:00
drm_print.c
isystem: ship and use stdarg.h
2021-08-19 09:02:55 +09:00
drm_privacy_screen_x86.c
drm/privacy-screen: Add X86 specific arch init code
2021-10-14 13:12:24 +02:00
drm_privacy_screen.c
drm/privacy-screen: Add notifier support (v2)
2021-10-14 13:12:25 +02:00
drm_probe_helper.c
drm/probe-helper: use drm_kms_helper_connector_hotplug_event
2021-11-02 14:27:14 +01:00
drm_property.c
drm: property: Replace strncpy() with strscpy_pad()
2021-10-07 05:42:13 +03:00
drm_rect.c
…
drm_scatter.c
…
drm_scdc_helper.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_self_refresh_helper.c
…
drm_simple_kms_helper.c
drm/simple-kms: Support custom CRTC state
2021-08-08 20:14:08 +02:00
drm_syncobj.c
drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence.
2021-12-08 17:19:48 +01:00
drm_sysfs.c
drm/sysfs: introduce drm_sysfs_connector_hotplug_event
2021-11-02 14:27:06 +01:00
drm_trace_points.c
…
drm_trace.h
…
drm_vblank_work.c
…
drm_vblank.c
drm: IRQ midlayer is now legacy
2021-08-10 20:14:01 +02:00
drm_vm.c
…
drm_vma_manager.c
drm: Fix typo in comments
2021-08-02 10:19:43 +02:00
drm_writeback.c
…
Kconfig
drm/sprd: add Unisoc's drm kms master
2021-12-10 12:36:52 +01:00
Makefile
drm/sprd: add Unisoc's drm kms master
2021-12-10 12:36:52 +01:00