Mathias Krause a0f90c8815 drm/vmwgfx: Fix stale file descriptors on failed usercopy ... A failing usercopy of the fence_rep object will lead to a stale entry in the file descriptor table as put_unused_fd() won't release it. This enables userland to refer to a dangling 'file' object through that still valid file descriptor, leading to all kinds of use-after-free exploitation scenarios. Fix this by deferring the call to fd_install() until after the usercopy has succeeded. Fixes: c906965dee ("drm/vmwgfx: Add export fence to file descriptor support") Signed-off-by: Mathias Krause <minipli@grsecurity.net> Signed-off-by: Zack Rusin <zackr@vmware.com> Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2022-01-27 17:55:20 +02:00
..
drm	drm/vmwgfx: Fix stale file descriptors on failed usercopy	2022-01-27 17:55:20 +02:00
host1x	gpu: host1x: Add back arm_iommu_detach_device()	2021-12-16 14:28:51 +01:00
ipu-v3
trace
vga
Makefile