Messages in this thread | | | From | Rob Clark <> | Date | Mon, 9 Jan 2023 17:47:34 -0800 | Subject | Re: [PATCH] drm/virtio: Fix GEM handle creation UAF |
| |
On Mon, Jan 9, 2023 at 3:28 PM Dmitry Osipenko <dmitry.osipenko@collabora.com> wrote: > > On 12/17/22 02:33, Rob Clark wrote: > > From: Rob Clark <robdclark@chromium.org> > > > > Userspace can guess the handle value and try to race GEM object creation > > with handle close, resulting in a use-after-free if we dereference the > > object after dropping the handle's reference. For that reason, dropping > > the handle's reference must be done *after* we are done dereferencing > > the object. > > > > Signed-off-by: Rob Clark <robdclark@chromium.org> > > --- > > drivers/gpu/drm/virtio/virtgpu_ioctl.c | 19 +++++++++++++++++-- > > 1 file changed, 17 insertions(+), 2 deletions(-) > > Added fixes/stable tags and applied this virtio-gpu patch to misc-fixes. > The Panfrost patch is untouched.
Thanks.. the panfrost patch was not intended to be part of the same series (but apparently that is what happens when I send them at the same time), and was superceded by a patch from Steven Price (commit 4217c6ac8174 ("drm/panfrost: Fix GEM handle creation ref-counting") already applied to misc-fixes
BR, -R
| |