iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/drivers/gpu/drm
History
Steve Cohen 6a9428427d drm: hold gem reference until object is no longer accessed 
commit 8490d6a7e0a0a6fab5c2d82d57a3937306660864 upstream.

A use-after-free in drm_gem_open_ioctl can happen if the
GEM object handle is closed between the idr lookup and
retrieving the size from said object since a local reference
is not being held at that point. Hold the local reference
while the object can still be accessed to fix this and
plug the potential security hole.

Signed-off-by: Steve Cohen <cohens@codeaurora.org>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-05 09:59:44 +02:00
..
amd
drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()
2020-08-05 09:59:43 +02:00
arc
drm/arc: Drop drm_gem_prime_export/import
2019-06-21 20:02:10 +02:00
arm
drm/arm/mali: make malidp_mw_connector_helper_funcs static
2020-01-17 19:49:05 +01:00
armada
drm/armada: drop use of drmP.h
2019-08-14 18:31:10 +02:00
aspeed
drm/aspeed: gfc_crtc: Make structure aspeed_gfx_funcs constant
2019-08-14 19:27:26 +02:00
ast
drm main pull for 5.4-rc1
2019-09-19 16:24:24 -07:00
atmel-hlcdc
drm: atmel-hlcdc: prefer a lower pixel-clock than requested
2020-02-11 04:35:36 -08:00
bochs
drm/bochs: downgrade pci_request_region failure from error to warning
2020-04-08 09:08:38 +02:00
bridge
drm: bridge: adv7511: Extend list of audio sample rates
2020-06-22 09:30:49 +02:00
cirrus
drm/prime: Actually remove DRIVER_PRIME everywhere
2019-06-21 17:30:32 +02:00
etnaviv
drm/etnaviv: Fix a leak in submit_pin_objects()
2020-05-27 17:46:42 +02:00
exynos
drm/exynos: fix ref count leak in mic_pre_enable
2020-07-22 09:32:51 +02:00
fsl-dcu
drm/fsl-dcu: fix opencoded use of drm_panel_*
2019-08-10 15:41:48 +02:00
gma500
drm/gma500: Fixup fbdev stolen size usage evaluation
2020-02-24 08:36:22 +01:00
hisilicon
drm: kirin: Revert "Fix for hikey620 display offset problem"
2020-03-12 13:00:26 +01:00
i2c
drm/i2c/tda998x: drop use of drmP.h
2019-08-14 18:30:52 +02:00
i810
drm/i810: Prevent underflow in ioctl
2019-12-13 08:42:56 +01:00
i915
drm/i915/gvt: Fix two CFL MMIO handling caused by regression.
2020-07-22 09:33:18 +02:00
imx
drm/imx: IPUv3 image converter fixes and improvements
2019-08-27 16:52:12 +10:00
ingenic
gpu/drm: Ingenic: Fix opaque pointer casted to wrong type
2020-06-03 08:21:19 +02:00
lib
…
lima
drm main pull for 5.4-rc1
2019-09-19 16:24:24 -07:00
mcde
drm: mcde: Fix display initialization problem
2020-07-16 08:16:33 +02:00
mediatek
drm/mediatek: Check plane visibility in atomic_update
2020-07-16 08:16:37 +02:00
meson
drm/meson: vclk: use the correct G12A frac max value
2019-12-31 16:43:09 +01:00
mga
drm/mga: drop use of drmP.h
2019-06-30 09:48:05 +02:00
mgag200
drm/mgag200: Flag all G200 SE A machines as broken wrt <startadd>
2019-12-21 11:04:54 +01:00
msm
drm/msm/dpu: allow initialization of encoder locks during encoder init
2020-07-22 09:32:51 +02:00
mxsfb
dma-buf: rename reservation_object to dma_resv
2019-08-13 09:09:30 +02:00
nouveau
drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout
2020-07-29 10:18:27 +02:00
omapdrm
Merge drm/drm-fixes into drm-misc-fixes
2019-10-03 09:59:29 +02:00
panel
drm/panel: simple: Add Logic PD Type 28 display support
2020-02-24 08:36:33 +01:00
panfrost
drm/panfrost: Don't try to map on error faults
2020-03-12 13:00:26 +01:00
pl111
drm/pl111: Support grayscale
2019-08-09 09:15:05 +02:00
qxl
drm/qxl: Use correct notify port address when creating cursor ring
2020-06-24 17:50:48 +02:00
r128
drm/r128: drop use of drmP.h
2019-07-17 12:52:55 +02:00
radeon
drm/radeon: fix double free
2020-07-16 08:16:45 +02:00
rcar-du
drm: rcar-du: Fix build error
2020-06-30 15:37:11 -04:00
rockchip
drm/bridge: analogix_dp: Split bind() into probe() and real bind()
2020-05-10 10:31:22 +02:00
savage
drm/savage: drop use of drmP.h
2019-06-05 20:31:04 +02:00
scheduler
drm/scheduler: fix rare NULL ptr race
2020-04-17 10:49:59 +02:00
selftests
drm/modes: Make sure to parse valid rotation value from cmdline
2020-03-12 13:00:11 +01:00
shmobile
drm/shmobile: drop use of drmP.h
2019-07-15 18:11:31 +02:00
sis
drm/sis: drop drmP.h use
2019-06-05 20:29:57 +02:00
sti
drm/sti: fix opencoded use of drm_panel_*
2019-08-07 13:54:17 +02:00
stm
drm/stm: attach gem fence to atomic state
2019-07-25 12:00:09 +02:00
sun4i
drm: sun4i: hdmi: Fix inverted HPD result
2020-07-29 10:18:32 +02:00
tdfx
drm/tdfx: drop use of drmP.h
2019-07-17 12:52:55 +02:00
tegra
drm/tegra: hub: Do not enable orphaned window group
2020-07-16 08:16:33 +02:00
tilcdc
drm/tilcdc: include linux/pinctrl/consumer.h again
2019-09-30 19:24:47 +03:00
tiny
drm/tiny: Kconfig: Remove always-y THERMAL dep. from TINYDRM_REPAPER
2019-10-10 15:15:51 +02:00
ttm
drm/ttm: Fix dma_fence refcnt leak when adding move fence
2020-07-16 08:16:33 +02:00
tve200
drm/tve200: drop use of drmP.h
2019-07-15 18:11:30 +02:00
udl
drm/udl: drop use of drmP.h
2019-07-17 12:52:55 +02:00
v3d
drm/v3d: Fix memory leak in v3d_submit_cl_ioctl
2019-10-23 20:57:05 +02:00
vboxvideo
drm/vboxvideo: Make structure vbox_fb_helper_funcs constant
2019-08-18 12:52:52 +02:00
vc4
drm/vc4: Fix HDMI mode validation
2020-04-23 10:36:39 +02:00
vgem
drm/vgem: Close use-after-free race in vgem_gem_create
2020-02-19 19:53:04 +01:00
via
drivers/gpu/drm/via: convert put_page() to put_user_page*()
2019-09-24 15:54:08 -07:00
virtio
drm/virtio: module_param_named() requires linux/moduleparam.h
2020-03-12 13:00:32 +01:00
vkms
drm/vkms: Hold gem object while still in-use
2020-06-17 16:40:36 +02:00
vmwgfx
drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add
2020-02-24 08:36:49 +01:00
xen
xen: fixes for 5.4-rc3
2019-10-12 14:11:21 -07:00
zte
Linus 5.3-rc1
2019-07-22 21:24:10 +02:00
ati_pcigart.c
drm/ati_pcigart: drop dependency on drm_os_linux.h
2019-07-19 23:24:16 +02:00
drm_agpsupport.c
gpu/drm: fix a few kernel-doc "/**" mark warnings
2019-07-16 11:25:02 +02:00
drm_atomic_helper.c
drm/atomic: fix self-refresh helpers crtc state dereference
2019-11-06 13:00:21 -05:00
drm_atomic_state_helper.c
drm/atomic: Rename crtc_state->pageflip_flags to async_flip
2019-09-18 18:43:36 +02:00
drm_atomic_uapi.c
drm/atomic: Reject FLIP_ASYNC unconditionally
2019-09-18 18:42:57 +02:00
drm_atomic.c
drm: Free the writeback_job when it with an empty fb
2019-09-23 15:31:53 +08:00
drm_auth.c
drm: drop use of drmP.h in drm/*
2019-05-27 18:07:03 +02:00
drm_blend.c
drm: drop use of drmP.h in drm/*
2019-05-27 18:07:03 +02:00
drm_bridge.c
drm: Add atomic variants for bridge enable/disable
2019-06-13 13:00:29 -04:00
drm_bufs.c
drm main pull request for v5.3-rc1 (sans mm changes)
2019-07-15 19:04:27 -07:00
drm_cache.c
…
drm_client_modeset.c
Revert "drm/fbdev: Fallback to non tiled mode if all tiles not present"
2020-03-25 08:25:50 +01:00
drm_client.c
drm/fb-helper: Map DRM client buffer only when required
2019-08-01 15:01:29 +02:00
drm_color_mgmt.c
drm: drop use of drmP.h in drm/*
2019-05-27 18:07:03 +02:00
drm_connector.c
drm/connector: notify userspace on hotplug after register complete
2020-06-24 17:50:50 +02:00
drm_context.c
drm: drop use of drmP.h in drm/*
2019-05-27 18:07:03 +02:00
drm_crtc_helper_internal.h
…
drm_crtc_helper.c
drm: Remove bridge support from legacy helpers
2019-08-16 15:50:27 +03:00
drm_crtc_internal.h
drm/atomic: Move __drm_atomic_helper_disable_plane/set_config()
2019-06-08 16:46:37 +02:00
drm_crtc.c
drm: no need to check return value of debugfs_create functions
2019-06-13 16:39:16 +02:00
drm_damage_helper.c
drm: damage_helper: Fix race checking plane->state->fb
2019-12-13 08:42:55 +01:00
drm_debugfs_crc.c
drm: remove the newline for CRC source name.
2020-02-24 08:36:44 +01:00
drm_debugfs.c
drm: debugfs: make drm_debugfs_create_files() never fail
2019-06-14 16:59:51 +02:00
drm_dma.c
gpu/drm: fix a few kernel-doc "/**" mark warnings
2019-07-16 11:25:02 +02:00
drm_dp_aux_dev.c
drm/dp_mst: Enable registration of AUX devices for MST ports
2019-07-25 16:39:35 -04:00
drm_dp_cec.c
…
drm_dp_dual_mode_helper.c
drm/dp: drmP.h include removal
2019-05-06 16:00:48 +03:00
drm_dp_helper.c
drm: Make the bw/link rate calculations more forgiving
2019-07-17 12:45:30 -04:00
drm_dp_mst_topology.c
drm/dp_mst: Increase ACT retry timeout to 3s
2020-06-24 17:50:49 +02:00
drm_drv.c
drm/kms: Duct-tape for mode object lifetime checks
2019-09-18 11:27:18 +02:00
drm_dsc.c
…
drm_dumb_buffers.c
Revert "drm/gem: Rename drm_gem_dumb_map_offset() to drm_gem_map_offset()"
2019-08-07 11:56:48 -04:00
drm_edid_load.c
Merge remote-tracking branch 'drm/drm-next' into drm-misc-next
2019-05-28 09:39:08 +02:00
drm_edid.c
drm/edid: Add Oculus Rift S to non-desktop list
2020-06-07 13:18:51 +02:00
drm_encoder_slave.c
drm: encoder_slave: fix refcouting error for modules
2020-06-24 17:50:47 +02:00
drm_encoder.c
drm: drop use of drmP.h in drm/*
2019-05-27 18:07:03 +02:00
drm_fb_cma_helper.c
treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157
2019-05-30 11:26:37 -07:00
drm_fb_helper.c
drm/fb-helper: Round up bits_per_pixel if possible
2020-01-14 20:08:25 +01:00
drm_file.c
drm/prime: Unconditionally set up the prime file private
2019-06-21 11:48:09 +02:00
drm_flip_work.c
drm: drop use of drmP.h in drm/*
2019-05-27 18:07:03 +02:00
drm_format_helper.c
drm: Remove users of drm_format_info_plane_cpp
2019-05-20 13:35:56 +02:00
drm_fourcc.c
drm: drop use of drmP.h in drm/*
2019-05-27 18:07:03 +02:00
drm_framebuffer.c
drm: silence variable 'conn' set but not used
2019-07-22 16:04:53 -04:00
drm_gem_cma_helper.c
Linux 5.2-rc5
2019-06-19 12:07:29 +02:00
drm_gem_framebuffer_helper.c
dma-buf: rename reservation_object to dma_resv
2019-08-13 09:09:30 +02:00
drm_gem_shmem_helper.c
drm/shmem: Use mutex_trylock in drm_gem_shmem_purge
2019-08-28 10:02:39 -05:00
drm_gem_vram_helper.c
drm/ttm: use gem vma_node
2019-08-06 08:21:54 +02:00
drm_gem.c
drm: hold gem reference until object is no longer accessed
2020-08-05 09:59:44 +02:00
drm_hashtab.c
drm: drop use of drmP.h in drm/*
2019-05-27 18:07:03 +02:00
drm_hdcp.c
drm/hdcp: reference for srm file format
2019-08-06 13:18:42 +05:30
drm_internal.h
drm/gem: Unexport drm_gem_(un)pin/v(un)map
2019-06-17 17:37:01 +02:00
drm_ioc32.c
Linus 5.3-rc1
2019-07-22 21:24:10 +02:00
drm_ioctl.c
drm/atomic: Take the atomic toys away from X
2019-09-18 18:42:21 +02:00
drm_irq.c
drm: drop use of drmP.h in drm/*
2019-05-27 18:07:03 +02:00
drm_kms_helper_common.c
drm: fix module name in edid_firmware log message
2019-08-22 10:41:06 +03:00
drm_lease.c
drm/lease: fix WARNING in idr_destroy
2020-03-25 08:25:56 +01:00
drm_legacy_misc.c
gpu/drm: fix a few kernel-doc "/**" mark warnings
2019-07-16 11:25:02 +02:00
drm_legacy.h
drm: make drm_legacy.h self-contained
2019-05-27 18:06:47 +02:00
drm_lock.c
gpu/drm: fix a few kernel-doc "/**" mark warnings
2019-07-16 11:25:02 +02:00
drm_memory.c
gpu/drm: fix a few kernel-doc "/**" mark warnings
2019-07-16 11:25:02 +02:00
drm_mipi_dbi.c
drm/dbi: Fix SPI Type 1 (9-bit) transfer
2020-08-05 09:59:44 +02:00
drm_mipi_dsi.c
drivers: Introduce device lookup variants by of_node
2019-07-30 13:07:41 +02:00
drm_mm.c
drm: Allow range of 0 for drm_mm_insert_node_in_range()
2019-06-26 21:13:12 +01:00
drm_mode_config.c
drm: drop use of drmP.h in drm/*
2019-05-27 18:07:03 +02:00
drm_mode_object.c
drm/kms: Duct-tape for mode object lifetime checks
2019-09-18 11:27:18 +02:00
drm_modes.c
drm/modes: Make sure to parse valid rotation value from cmdline
2020-03-12 13:00:11 +01:00
drm_modeset_helper.c
…
drm_modeset_lock.c
docs conversion for v5.3-rc1
2019-07-16 12:21:41 -07:00
drm_of.c
Merge remote-tracking branch 'drm/drm-next' into drm-misc-next
2019-05-28 09:39:08 +02:00
drm_panel_orientation_quirks.c
drm: panel-orientation-quirks: Use generic orientation-data for Acer S1003
2020-07-16 08:16:35 +02:00
drm_panel.c
drm/panel: drop return code from drm_panel_detach()
2019-08-10 15:41:48 +02:00
drm_pci.c
drm: Remove PageReserved manipulation from drm_pci_alloc
2020-04-17 10:50:20 +02:00
drm_plane_helper.c
drm: drop use of drmP.h in drm/*
2019-05-27 18:07:03 +02:00
drm_plane.c
…
drm_prime.c
drm/prime: Ditch gem_prime_res_obj hook
2019-07-31 10:19:23 +02:00
drm_print.c
drm: drop use of drmP.h in drm/*
2019-05-27 18:07:03 +02:00
drm_probe_helper.c
Linux 5.2-rc5
2019-06-19 12:07:29 +02:00
drm_property.c
drm: limit to INT_MAX in create_blob ioctl
2020-01-04 19:18:43 +01:00
drm_rect.c
drm/rect: Avoid division by zero
2020-02-11 04:35:36 -08:00
drm_scatter.c
gpu/drm: fix a few kernel-doc "/**" mark warnings
2019-07-16 11:25:02 +02:00
drm_scdc_helper.c
drm: drop use of drmP.h in drm/*
2019-05-27 18:07:03 +02:00
drm_self_refresh_helper.c
drm/atomic: fix self-refresh helpers crtc state dereference
2019-11-06 13:00:21 -05:00
drm_simple_kms_helper.c
Linux 5.2-rc5
2019-06-19 12:07:29 +02:00
drm_syncobj.c
drm/syncobj: Add better overview documentation for syncobj (v2)
2019-08-12 16:58:52 +02:00
drm_sysfs.c
drm/connector: notify userspace on hotplug after register complete
2020-06-24 17:50:50 +02:00
drm_trace_points.c
drm: drop use of drmP.h in drm/*
2019-05-27 18:07:03 +02:00
drm_trace.h
drm: make drm_trace.h self-contained
2019-05-27 18:06:54 +02:00
drm_vblank.c
drm/drm_vblank: Change EINVAL by the correct errno
2019-12-31 16:43:50 +01:00
drm_vm.c
gpu/drm: fix a few kernel-doc "/**" mark warnings
2019-07-16 11:25:02 +02:00
drm_vma_manager.c
drm: drop use of drmP.h in drm/*
2019-05-27 18:07:03 +02:00
drm_vram_helper_common.c
drm: Replace drm_gem_vram_push_to_system() with kunmap + unpin
2019-05-22 12:43:29 +02:00
drm_vram_mm_helper.c
drm: drop use of drmP.h in drm/*
2019-05-27 18:07:03 +02:00
drm_writeback.c
drm: Clear the fence pointer when writeback job signaled
2019-09-23 15:32:53 +08:00
Kconfig
drm-misc-next for 5.4:
2019-08-09 16:04:31 +10:00
Makefile
drm/amd: remove meaningless descending into amd/amdkfd/
2019-08-27 10:09:12 -05:00