1. 03 Nov, 2021 1 commit
    • Anand K Mistry's avatar
      drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap · 8244a3bc
      Anand K Mistry authored
      drm_gem_ttm_mmap() drops a reference to the gem object on success. If
      the gem object's refcount == 1 on entry to drm_gem_prime_mmap(), that
      drop will free the gem object, and the subsequent drm_gem_object_get()
      will be a UAF. Fix by grabbing a reference before calling the mmap
      helper.
      
      This issue was forseen when the reference dropping was adding in
      commit 9786b65b ("drm/ttm: fix mmap refcounting"):
        "For that to work properly the drm_gem_object_get() call in
        drm_gem_ttm_mmap() must be moved so it happens before calling
        obj->funcs->mmap(), otherwise the gem refcount would go down
        to zero."
      Signed-off-by: default avatarAnand K Mistry <amistry@google.com>
      Fixes: 9786b65b ("drm/ttm: fix mmap refcounting")
      Cc: Gerd Hoffmann <kraxel@redhat.com>
      Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
      Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Cc: Maxime Ripard <mripard@kernel.org>
      Cc: Thomas Zimmermann <tzimmermann@suse.de>
      Cc: David Airlie <airlied@linux.ie>
      Cc: Daniel Vetter <daniel@ffwll.ch>
      Cc: dri-devel@lists.freedesktop.org
      Cc: <stable@vger.kernel.org> # v5.5+
      Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
      Link: https://patchwork.freedesktop.org/patch/msgid/20210930085932.1.I8043d61cc238e0168e2f4ca5f4783223434aa587@changeid
      8244a3bc
  2. 29 Oct, 2021 1 commit
  3. 26 Oct, 2021 1 commit
  4. 22 Oct, 2021 1 commit
  5. 21 Oct, 2021 10 commits
  6. 18 Oct, 2021 17 commits
  7. 17 Oct, 2021 3 commits
  8. 16 Oct, 2021 6 commits