diff options
| author | Mathias Krause <minipli@grsecurity.net> | 2022-01-27 11:34:19 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-01-29 12:58:25 +0300 |
| commit | 6066977961fc6f437bc064f628cf9b0e4571c56c (patch) | |
| tree | 73194d940d1c3822abd215235317c069a5af5228 /Makefile | |
| parent | 9c82ce59362672e0e5b38cff1e9dbdb52ec62b4f (diff) | |
| download | linux-6066977961fc6f437bc064f628cf9b0e4571c56c.tar.xz | |
drm/vmwgfx: Fix stale file descriptors on failed usercopy
commit a0f90c8815706981c483a652a6aefca51a5e191c upstream.
A failing usercopy of the fence_rep object will lead to a stale entry in
the file descriptor table as put_unused_fd() won't release it. This
enables userland to refer to a dangling 'file' object through that still
valid file descriptor, leading to all kinds of use-after-free
exploitation scenarios.
Fix this by deferring the call to fd_install() until after the usercopy
has succeeded.
Fixes: c906965dee22 ("drm/vmwgfx: Add export fence to file descriptor support")
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
Signed-off-by: Zack Rusin <zackr@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'Makefile')
0 files changed, 0 insertions, 0 deletions