TWxSoftware/twx-linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
b0cf0beeb6619a7e876e101bcb044eb803b876fa
twx-linux/drivers/gpu/drm
T
History
Steve Cohen 00cf08b009 drm: hold gem reference until object is no longer accessed 
commit 8490d6a7e0 upstream.

A use-after-free in drm_gem_open_ioctl can happen if the
GEM object handle is closed between the idr lookup and
retrieving the size from said object since a local reference
is not being held at that point. Hold the local reference
while the object can still be accessed to fix this and
plug the potential security hole.

Signed-off-by: Steve Cohen <cohens@codeaurora.org>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/1595284250-31580-1-git-send-email-cohens@codeaurora.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-08-05 10:06:49 +02:00
..
amd
drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl()
2020-08-05 10:06:48 +02:00
arc
…
arm
…
armada
…
ast
drm/ast: Fixed reboot test may cause system hanged
2019-09-06 10:20:45 +02:00
atmel-hlcdc
drm: atmel-hlcdc: enable clock before configuring timing engine
2020-02-14 16:32:19 -05:00
bochs
drm/bochs: downgrade pci_request_region failure from error to warning
2020-04-13 10:34:18 +02:00
bridge
drm: bridge: adv7511: Extend list of audio sample rates
2020-06-20 10:25:06 +02:00
cirrus
…
etnaviv
drm/etnaviv: replace MMU flush marker with flush sequence
2020-04-13 10:34:20 +02:00
exynos
drm/exynos: fix ref count leak in mic_pre_enable
2020-07-22 09:22:21 +02:00
fsl-dcu
…
gma500
drm/gma500: Fixup fbdev stolen size usage evaluation
2020-02-28 16:35:55 +01:00
hisilicon
drm/hisilicon: hibmc: Don't overwrite fb helper surface depth
2020-01-27 14:46:04 +01:00
i2c
…
i810
drm/i810: Prevent underflow in ioctl
2019-12-17 20:38:51 +01:00
i915
drm/i915: Whitelist context-local timestamp in the gen9 cmdparser
2020-06-25 15:41:46 +02:00
imx
…
lib
…
mediatek
drm/mediatek: handle events when enabling/disabling crtc
2020-02-28 16:36:01 +01:00
meson
drm/meson: Add support for XBGR8888 & ABGR8888 formats
2019-09-19 09:08:05 +02:00
mga
…
mgag200
…
msm
drm/msm/mdp5: Fix mdp5_init error path for failed mdp5_kms allocation
2020-06-25 15:41:53 +02:00
mxsfb
…
nouveau
drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout
2020-07-29 07:42:52 +02:00
omapdrm
drm/omap: fix max fclk divider for omap36xx
2019-10-11 18:18:35 +02:00
panel
drm/panel: simple: fix AUO g185han01 horizontal blanking
2019-10-07 18:54:57 +02:00
pl111
…
qxl
drm/qxl: Use correct notify port address when creating cursor ring
2020-06-25 15:41:59 +02:00
r128
…
radeon
drm/radeon: fix double free
2020-07-22 09:22:19 +02:00
rcar-du
…
rockchip
drm/rockchip: Properly adjust to a true clock in adjusted_mode
2019-07-31 07:28:51 +02:00
savage
…
selftests
…
shmobile
drm/shmob: Fix return value check in shmob_drm_probe
2020-01-27 14:46:12 +01:00
sis
…
sti
drm/sti: do not remove the drm_bridge that was never added
2020-01-27 14:46:03 +01:00
stm
drm/stm: attach gem fence to atomic state
2019-10-07 18:54:58 +02:00
sun4i
drm: sun4i: hdmi: Fix inverted HPD result
2020-07-29 07:42:53 +02:00
tdfx
…
tegra
…
tilcdc
drm/tilcdc: Register cpufreq notifier after we have initialized crtc
2019-09-06 10:20:49 +02:00
tinydrm
…
ttm
…
udl
…
vc4
…
vgem
…
via
…
virtio
drm/virtio: fix bounds check in virtio_gpu_cmd_get_capset()
2020-01-27 14:46:03 +01:00
vmwgfx
drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add
2020-02-28 16:36:04 +01:00
zte
…
ati_pcigart.c
…
drm_agpsupport.c
…
drm_atomic_helper.c
…
drm_atomic.c
…
drm_auth.c
…
drm_blend.c
…
drm_bridge.c
…
drm_bufs.c
…
drm_cache.c
…
drm_color_mgmt.c
…
drm_connector.c
…
drm_context.c
…
drm_crtc_helper_internal.h
…
drm_crtc_helper.c
…
drm_crtc_internal.h
…
drm_crtc.c
…
drm_debugfs_crc.c
drm: remove the newline for CRC source name.
2020-02-28 16:36:02 +01:00
drm_debugfs.c
…
drm_dma.c
…
drm_dp_aux_dev.c
…
drm_dp_dual_mode_helper.c
…
drm_dp_helper.c
…
drm_dp_mst_topology.c
drm/dp_mst: Increase ACT retry timeout to 3s
2020-06-25 15:41:59 +02:00
drm_drv.c
…
drm_dumb_buffers.c
…
drm_edid_load.c
…
drm_edid.c
drm/edid: Fix off-by-one in DispID DTD pixel clock
2020-05-05 19:15:47 +02:00
drm_encoder_slave.c
drm: encoder_slave: fix refcouting error for modules
2020-06-25 15:41:59 +02:00
drm_encoder.c
…
drm_fb_cma_helper.c
…
drm_fb_helper.c
drm/fb-helper: Round up bits_per_pixel if possible
2020-01-14 20:05:44 +01:00
drm_file.c
…
drm_flip_work.c
…
drm_fourcc.c
…
drm_framebuffer.c
drm: silence variable 'conn' set but not used
2019-08-16 10:13:52 +02:00
drm_gem_cma_helper.c
…
drm_gem_framebuffer_helper.c
…
drm_gem.c
drm: hold gem reference until object is no longer accessed
2020-08-05 10:06:49 +02:00
drm_global.c
…
drm_hashtab.c
…
drm_info.c
…
drm_internal.h
…
drm_ioc32.c
…
drm_ioctl.c
…
drm_irq.c
…
drm_kms_helper_common.c
…
drm_legacy.h
…
drm_lock.c
…
drm_memory.c
…
drm_mipi_dsi.c
…
drm_mm.c
…
drm_mode_config.c
…
drm_mode_object.c
…
drm_modes.c
…
drm_modeset_helper.c
…
drm_modeset_lock.c
…
drm_of.c
…
drm_panel.c
…
drm_pci.c
drm: Remove PageReserved manipulation from drm_pci_alloc
2020-04-24 08:00:50 +02:00
drm_plane_helper.c
…
drm_plane.c
…
drm_prime.c
…
drm_print.c
…
drm_probe_helper.c
drm: Flush output polling on shutdown
2019-10-05 12:47:38 +02:00
drm_property.c
drm: limit to INT_MAX in create_blob ioctl
2020-01-09 10:17:53 +01:00
drm_rect.c
…
drm_scatter.c
…
drm_scdc_helper.c
…
drm_simple_kms_helper.c
…
drm_syncobj.c
…
drm_sysfs.c
…
drm_trace_points.c
…
drm_trace.h
…
drm_vblank.c
…
drm_vm.c
…
drm_vma_manager.c
…
Kconfig
…
Makefile
…