Commit 8490d6a7 authored by Steve Cohen's avatar Steve Cohen Committed by Daniel Vetter

drm: hold gem reference until object is no longer accessed

A use-after-free in drm_gem_open_ioctl can happen if the
GEM object handle is closed between the idr lookup and
retrieving the size from said object since a local reference
is not being held at that point. Hold the local reference
while the object can still be accessed to fix this and
plug the potential security hole.
Signed-off-by: default avatarSteve Cohen <cohens@codeaurora.org>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org
parent 900ab59e
...@@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data, ...@@ -871,9 +871,6 @@ drm_gem_flink_ioctl(struct drm_device *dev, void *data,
* @file_priv: drm file-private structure * @file_priv: drm file-private structure
* *
* Open an object using the global name, returning a handle and the size. * Open an object using the global name, returning a handle and the size.
*
* This handle (of course) holds a reference to the object, so the object
* will not go away until the handle is deleted.
*/ */
int int
drm_gem_open_ioctl(struct drm_device *dev, void *data, drm_gem_open_ioctl(struct drm_device *dev, void *data,
...@@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data, ...@@ -898,14 +895,15 @@ drm_gem_open_ioctl(struct drm_device *dev, void *data,
/* drm_gem_handle_create_tail unlocks dev->object_name_lock. */ /* drm_gem_handle_create_tail unlocks dev->object_name_lock. */
ret = drm_gem_handle_create_tail(file_priv, obj, &handle); ret = drm_gem_handle_create_tail(file_priv, obj, &handle);
drm_gem_object_put_unlocked(obj);
if (ret) if (ret)
return ret; goto err;
args->handle = handle; args->handle = handle;
args->size = obj->size; args->size = obj->size;
return 0; err:
drm_gem_object_put_unlocked(obj);
return ret;
} }
/** /**
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment