lkml.org 
[lkml]   [2021]   [Jul]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 3/3] drm/vmwgfx: fix potential UAF in vmwgfx_surface.c
    On Thu, Jul 22, 2021 at 05:29:29PM +0800, Desmond Cheong Zhi Xi wrote:
    > drm_file.master should be protected by either drm_device.master_mutex
    > or drm_file.master_lookup_lock when being dereferenced. However,
    > drm_master_get is called on unprotected file_priv->master pointers in
    > vmw_surface_define_ioctl and vmw_gb_surface_define_internal.
    >
    > This is fixed by replacing drm_master_get with drm_file_get_master.
    >
    > Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>

    Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>

    I'll let Zack take a look at this and expect him to push this patch to
    drm-misc.git.
    -Daniel

    > ---
    > drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 4 ++--
    > 1 file changed, 2 insertions(+), 2 deletions(-)
    >
    > diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
    > index 0eba47762bed..5d53a5f9d123 100644
    > --- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
    > +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c
    > @@ -865,7 +865,7 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
    > user_srf->prime.base.shareable = false;
    > user_srf->prime.base.tfile = NULL;
    > if (drm_is_primary_client(file_priv))
    > - user_srf->master = drm_master_get(file_priv->master);
    > + user_srf->master = drm_file_get_master(file_priv);
    >
    > /**
    > * From this point, the generic resource management functions
    > @@ -1534,7 +1534,7 @@ vmw_gb_surface_define_internal(struct drm_device *dev,
    >
    > user_srf = container_of(srf, struct vmw_user_surface, srf);
    > if (drm_is_primary_client(file_priv))
    > - user_srf->master = drm_master_get(file_priv->master);
    > + user_srf->master = drm_file_get_master(file_priv);
    >
    > res = &user_srf->srf.res;
    >
    > --
    > 2.25.1
    >

    --
    Daniel Vetter
    Software Engineer, Intel Corporation
    http://blog.ffwll.ch

    \
     
     \ /
      Last update: 2021-07-22 19:34    [W:2.272 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site