iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/gpu/drm
History
Eric Biggers 21d2b12273
drm/vgem: fix use-after-free when drm_gem_handle_create() fails 
If drm_gem_handle_create() fails in vgem_gem_create(), then the
drm_vgem_gem_object is freed twice: once when the reference is dropped
by drm_gem_object_put_unlocked(), and again by __vgem_gem_destroy().

This was hit by syzkaller using fault injection.

Fix it by skipping the second free.

Reported-by: syzbot+e73f2fb5ed5a5df36d33@syzkaller.appspotmail.com
Fixes: af33a9190d02 ("drm/vgem: Enable dmabuf import interfaces")
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Laura Abbott <labbott@redhat.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Acked-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: Rodrigo Siqueira <rodrigosiqueiramelo@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20190226214451.195123-1-ebiggers@kernel.org
Signed-off-by: Maxime Ripard <maxime.ripard@bootlin.com>
2019-03-18 08:45:57 +01:00
..
amd
Merge branch 'drm-next-5.1' of git://people.freedesktop.org/~agd5f/linux into drm-next
2019-03-14 12:15:02 +10:00
arc
drm: Split out drm_probe_helper.h
2019-01-24 13:20:42 +01:00
arm
drm/komeda: fix build with drm_modeset_helper.h update
2019-02-11 10:36:00 +01:00
armada
drm: Split out drm_probe_helper.h
2019-01-24 13:20:42 +01:00
ast
Merge branch 'drm-next-5.1' of git://people.freedesktop.org/~agd5f/linux into drm-next
2019-02-04 14:57:34 +10:00
atmel-hlcdc
drm/irq: Don't check for DRIVER_HAVE_IRQ in drm_irq_(un)install
2019-01-29 15:45:06 +01:00
bochs
Linux 5.0
2019-03-04 12:02:55 +10:00
bridge
drm next pull request for 5.1
2019-03-08 08:23:15 -08:00
cirrus
drm/cirrus: add plane setup
2019-02-05 10:28:13 +01:00
etnaviv
Merge branch 'etnaviv/next' of https://git.pengutronix.de/git/lst/linux into drm-next
2019-03-12 15:20:57 +10:00
exynos
drm/exynos: Change Andrzej Pietrasiewicz's e-mail address
2019-02-07 19:59:44 +09:00
fsl-dcu
drm/irq: Don't check for DRIVER_HAVE_IRQ in drm_irq_(un)install
2019-01-29 15:45:06 +01:00
gma500
drm/irq: Ditch DRIVER_IRQ_SHARED
2019-01-29 15:45:21 +01:00
hisilicon
drm/irq: Don't check for DRIVER_HAVE_IRQ in drm_irq_(un)install
2019-01-29 15:45:06 +01:00
i2c
drm: Split out drm_probe_helper.h
2019-01-24 13:20:42 +01:00
i810
…
i915
drm i915, amdgpu, qxl and etnaviv fixes
2019-03-15 13:58:35 -07:00
imx
drm/imx: handle pending updates better, add plane zpos property support
2019-02-28 12:53:16 +10:00
lib
…
mediatek
drm: Split out drm_probe_helper.h
2019-01-24 13:20:42 +01:00
meson
Linux 5.0-rc7
2019-02-18 13:27:15 +10:00
mga
drm/irq: Ditch DRIVER_IRQ_SHARED
2019-01-29 15:45:21 +01:00
mgag200
Merge branch 'drm-next-5.1' of git://people.freedesktop.org/~agd5f/linux into drm-next
2019-02-04 14:57:34 +10:00
msm
drm next pull request for 5.1
2019-03-08 08:23:15 -08:00
mxsfb
drm/irq: Don't check for DRIVER_HAVE_IRQ in drm_irq_(un)install
2019-01-29 15:45:06 +01:00
nouveau
mm/hmm: convert to use vm_fault_t
2019-03-12 10:04:00 -07:00
omapdrm
Linux 5.0-rc7
2019-02-18 13:27:15 +10:00
panel
drm/panel: simple: Add support for PDA 91-00156-A0 panel
2019-01-28 17:45:28 +01:00
pl111
drm: Split out drm_probe_helper.h
2019-01-24 13:20:42 +01:00
qxl
- qxl: Remove the conflicting framebuffers earlier
2019-03-14 11:37:46 +10:00
r128
drm/irq: Ditch DRIVER_IRQ_SHARED
2019-01-29 15:45:21 +01:00
radeon
Linux 5.0
2019-03-04 12:02:55 +10:00
rcar-du
Merge drm/drm-next into drm-misc-next
2019-02-11 10:35:35 +01:00
rockchip
Linux 5.0-rc7
2019-02-18 13:27:15 +10:00
savage
drm/savage: mark expected switch fall-throughs
2019-01-30 17:35:29 +01:00
scheduler
Merge branch 'drm-next-5.1' of git://people.freedesktop.org/~agd5f/linux into drm-next
2019-02-22 15:56:42 +10:00
selftests
drm/selftest: fix spelling mistake "dimention" -> "dimension"
2018-12-11 15:19:42 +01:00
shmobile
drm/irq: Don't check for DRIVER_HAVE_IRQ in drm_irq_(un)install
2019-01-29 15:45:06 +01:00
sis
…
sti
drm: Split out drm_probe_helper.h
2019-01-24 13:20:42 +01:00
stm
drm: Split out drm_probe_helper.h
2019-01-24 13:20:42 +01:00
sun4i
Linux 5.0-rc7
2019-02-18 13:27:15 +10:00
tdfx
…
tegra
drm/tegra: Changes for v5.1-rc1
2019-02-11 13:32:49 +10:00
tilcdc
drm/irq: Don't check for DRIVER_HAVE_IRQ in drm_irq_(un)install
2019-01-29 15:45:06 +01:00
tinydrm
drm: Split out drm_probe_helper.h
2019-01-24 13:20:42 +01:00
ttm
drm/ttm: Remove ttm_bo_reference and ttm_bo_unref
2019-01-28 11:43:38 -05:00
tve200
drm: Split out drm_probe_helper.h
2019-01-24 13:20:42 +01:00
udl
drm: Split out drm_probe_helper.h
2019-01-24 13:20:42 +01:00
v3d
drm/sched: Refactor ring mirror list handling.
2019-01-25 16:15:36 -05:00
vc4
drm/vc4: Use struct_size() in kzalloc()
2019-02-06 15:16:08 -08:00
vgem
drm/vgem: fix use-after-free when drm_gem_handle_create() fails
2019-03-18 08:45:57 +01:00
via
drm/via: mark expected switch fall-throughs
2019-01-30 17:35:29 +01:00
virtio
Linux 5.0-rc7
2019-02-18 13:27:15 +10:00
vkms
Linux 5.0-rc7
2019-02-18 13:27:15 +10:00
vmwgfx
5.1 Merge Window Pull Request
2019-03-09 15:53:03 -08:00
xen
drm/xen-front: Fix mmap attributes for display buffers
2019-02-04 08:39:31 +02:00
zte
drm: Split out drm_probe_helper.h
2019-01-24 13:20:42 +01:00
ati_pcigart.c
drm/ati_pcigart: Fix error code in drm_ati_pcigart_init()
2018-12-17 10:47:17 +01:00
drm_agpsupport.c
drm: Trivial comment grammar cleanups
2019-02-04 10:21:17 +01:00
drm_atomic_helper.c
- Properly mark the ptr_to_compat argument with the __user tag
2019-03-12 14:57:14 +10:00
drm_atomic_state_helper.c
drm: Put damage blob when destroy plane state
2018-12-24 11:53:50 +01:00
drm_atomic_uapi.c
Linux 5.0-rc7
2019-02-18 13:27:15 +10:00
drm_atomic.c
drm-misc-next for 5.1:
2019-01-10 05:58:52 +10:00
drm_auth.c
drm: set is_master to 0 upon drm_new_set_master() failure
2018-11-26 16:14:27 -05:00
drm_blend.c
…
drm_bridge.c
drm: bridge: Constify mode arguments to bridge .mode_set() operation
2019-01-14 03:51:14 +02:00
drm_bufs.c
drm: Trivial comment grammar cleanups
2019-02-04 10:21:17 +01:00
drm_cache.c
…
drm_client.c
drm/gem: Add drm_gem_object_funcs
2018-11-20 14:56:18 +01:00
drm_color_mgmt.c
drm: Constify drm_color_lut_check()
2019-01-29 23:26:12 +02:00
drm_connector.c
drm: Trivial comment grammar cleanups
2019-02-04 10:21:17 +01:00
drm_context.c
drm: Fix error handling in drm_legacy_addctx
2019-01-07 11:26:31 +01:00
drm_crtc_helper_internal.h
…
drm_crtc_helper.c
drm: Remove use of drm_mode_object
2019-01-15 13:20:56 +01:00
drm_crtc_internal.h
drm: Unexport drm_crtc_force_disable
2019-01-11 15:56:40 +01:00
drm_crtc.c
drm: Move the legacy kms disable_all helper to crtc helpers
2019-01-11 22:54:29 +01:00
drm_damage_helper.c
drm: prepare for drmP.h removal from drm_modeset_helper.h
2019-02-07 21:48:28 +01:00
drm_debugfs_crc.c
…
drm_debugfs.c
drm: Merge drm_info.c into drm_debugfs.c
2018-11-22 09:52:27 +01:00
drm_dma.c
…
drm_dp_aux_dev.c
…
drm_dp_cec.c
…
drm_dp_dual_mode_helper.c
…
drm_dp_helper.c
drm/dsc: Add kernel documentation for DRM DP DSC helpers
2019-02-08 13:38:51 -08:00
drm_dp_mst_topology.c
drm/dp_mst: Remove rebase-detritus in VCPI helper kernel-docs
2019-02-06 13:37:38 -05:00
drm_drv.c
drm/docs: improve docs for drm_drv.c
2019-01-12 13:07:30 +01:00
drm_dsc.c
drm/dsc: Add kernel documentation for DRM DP DSC helpers
2019-02-08 13:38:51 -08:00
drm_dumb_buffers.c
…
drm_edid_load.c
…
drm_edid.c
drm/edid: Add display_info.rgb_quant_range_selectable
2019-01-10 19:01:06 +02:00
drm_encoder_slave.c
…
drm_encoder.c
…
drm_fb_cma_helper.c
drm/cma-helper: Remove unused fbdev code
2019-01-17 10:56:38 +01:00
drm_fb_helper.c
Linux 5.0-rc7
2019-02-18 13:27:15 +10:00
drm_file.c
drm-misc-fixes for v5.0:
2019-03-05 08:14:22 +10:00
drm_flip_work.c
drm: move drm_can_sleep() to drm_util.h
2019-01-14 10:58:37 +01:00
drm_fourcc.c
drm/fourcc: Add new P010, P016 video format
2019-02-08 22:17:08 +01:00
drm_framebuffer.c
drm: Trivial comment grammar cleanups
2019-02-04 10:21:17 +01:00
drm_gem_cma_helper.c
drm/cma-helper: Add DRM_GEM_CMA_VMAP_DRIVER_OPS
2018-11-20 14:57:25 +01:00
drm_gem_framebuffer_helper.c
drm/gem-fb-helper: Add drm_gem_fb_create_with_dirty()
2019-01-17 10:56:45 +01:00
drm_gem.c
drm: Trivial comment grammar cleanups
2019-02-04 10:21:17 +01:00
drm_hashtab.c
…
drm_internal.h
drm-misc-next for 5.1:
2019-01-10 05:58:52 +10:00
drm_ioc32.c
drm: add __user attribute to ptr_to_compat()
2019-03-04 09:55:31 -05:00
drm_ioctl.c
drm: allow render capable master with DRM_AUTH ioctls
2019-02-13 17:42:36 +00:00
drm_irq.c
drm/irq: Ditch DRIVER_IRQ_SHARED
2019-01-29 15:45:21 +01:00
drm_kms_helper_common.c
…
drm_lease.c
Linux 5.0-rc7
2019-02-18 13:27:15 +10:00
drm_legacy.h
…
drm_lock.c
…
drm_memory.c
…
drm_mipi_dsi.c
…
drm_mm.c
drm: Trivial comment grammar cleanups
2019-02-04 10:21:17 +01:00
drm_mode_config.c
drm-misc-next for 5.1:
2019-01-10 05:58:52 +10:00
drm_mode_object.c
gpu/drm: Fix lock held when returning to user space.
2019-01-10 11:31:58 +01:00
drm_modes.c
Linux 5.0-rc7
2019-02-18 13:27:15 +10:00
drm_modeset_helper.c
drm: prepare for drmP.h removal from drm_modeset_helper.h
2019-02-07 21:48:28 +01:00
drm_modeset_lock.c
drm/atomic: integrate modeset lock with private objects
2018-12-11 15:24:30 +01:00
drm_of.c
drm/of: Fix kerneldoc
2019-01-12 13:07:58 +01:00
drm_panel_orientation_quirks.c
drm: panel-orientation-quirks: Do rotation quirk for new GPD Win2 FW
2018-11-15 10:55:30 +01:00
drm_panel.c
drm/panel: Small documentation polish
2019-01-12 13:08:12 +01:00
drm_pci.c
cross-tree: phase out dma_zalloc_coherent()
2019-01-08 07:58:37 -05:00
drm_plane_helper.c
…
drm_plane.c
drm: Auto-set allow_fb_modifiers when given modifiers at plane init
2019-01-11 16:53:55 +01:00
drm_prime.c
drm/prime: Fix drm_gem_prime_mmap() stack use
2018-11-22 15:44:05 +01:00
drm_print.c
…
drm_probe_helper.c
drm: Split out drm_probe_helper.h
2019-01-24 13:20:42 +01:00
drm_property.c
drm: Trivial comment grammar cleanups
2019-02-04 10:21:17 +01:00
drm_rect.c
drm: Nuke drm_calc_{h,v}scale_relaxed()
2019-02-07 13:14:06 +02:00
drm_scatter.c
…
drm_scdc_helper.c
…
drm_simple_kms_helper.c
drm: Split out drm_probe_helper.h
2019-01-24 13:20:42 +01:00
drm_syncobj.c
drm/syncobj: remove drm_syncobj_cb and cleanup
2018-12-11 17:38:38 +01:00
drm_sysfs.c
drm/lease: Send a distinct uevent
2018-11-30 10:57:18 +01:00
drm_trace_points.c
…
drm_trace.h
…
drm_vblank.c
drm: Trivial comment grammar cleanups
2019-02-04 10:21:17 +01:00
drm_vm.c
…
drm_vma_manager.c
…
drm_writeback.c
…
Kconfig
drm/cma-helper: Remove unused fbdev code
2019-01-17 10:56:38 +01:00
Makefile
drm: rcar-du: lvds: Add API to enable/disable clock output
2019-02-08 02:25:56 +02:00