diff options
| author | Steve Cohen <cohens@codeaurora.org> | 2020-07-20 18:30:50 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-08-21 10:52:52 +0200 |
| commit | 0625c6e8d091438d3bd79c3e4e0d2ae367d0d14f (patch) | |
| tree | 43e12dd6c1a5675ae8663e2eb3fe1d438c72d031 /tools/perf/scripts/python/bin | |
| parent | f74cf1a0cd769b810cc41a0570a7119f26ee9ddf (diff) | |
drm: hold gem reference until object is no longer accessed
commit 8490d6a7e0a0a6fab5c2d82d57a3937306660864 upstream.
A use-after-free in drm_gem_open_ioctl can happen if the
GEM object handle is closed between the idr lookup and
retrieving the size from said object since a local reference
is not being held at that point. Hold the local reference
while the object can still be accessed to fix this and
plug the potential security hole.
Signed-off-by: Steve Cohen <cohens@codeaurora.org>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools/perf/scripts/python/bin')
0 files changed, 0 insertions, 0 deletions