Revision a37eef63bc9e16e06361b539e528058146af80ab authored by Daniel Vetter on 19 January 2021, 13:03:18 UTC, committed by Daniel Vetter on 20 January 2021, 09:28:39 UTC
While reviewing Christian's annotation patch I noticed that we have a
user-after-free for the WAIT_FOR_SUBMIT case: We drop the syncobj
reference before we've completed the waiting.
Of course usually there's nothing bad happening here since userspace
keeps the reference, but we can't rely on userspace to play nice here!
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Fixes: bc9c80fe01a2 ("drm/syncobj: use the timeline point in drm_syncobj_find_fence v4")
Reviewed-by: Christian König <christian.koenig@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@linux.ie>
Cc: Daniel Vetter <daniel@ffwll.ch>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v5.2+
Link: https://patchwork.freedesktop.org/patch/msgid/20210119130318.615145-1-daniel.vetter@ffwll.ch
1 parent abbc4d6
| File | Mode | Size |
|---|---|---|
| 9p | ||
| adfs | ||
| affs | ||
| afs | ||
| autofs | ||
| befs | ||
| bfs | ||
| btrfs | ||
| cachefiles | ||
| ceph | ||
| cifs | ||
| coda | ||
| configfs | ||
| cramfs | ||
| crypto | ||
| debugfs | ||
| devpts | ||
| dlm | ||
| ecryptfs | ||
| efivarfs | ||
| efs | ||
| erofs | ||
| exfat | ||
| exportfs | ||
| ext2 | ||
| ext4 | ||
| f2fs | ||
| fat | ||
| freevxfs | ||
| fscache | ||
| fuse | ||
| gfs2 | ||
| hfs | ||
| hfsplus | ||
| hostfs | ||
| hpfs | ||
| hugetlbfs | ||
| iomap | ||
| isofs | ||
| jbd2 | ||
| jffs2 | ||
| jfs | ||
| kernfs | ||
| lockd | ||
| minix | ||
| nfs | ||
| nfs_common | ||
| nfsd | ||
| nilfs2 | ||
| nls | ||
| notify | ||
| ntfs | ||
| ocfs2 | ||
| omfs | ||
| openpromfs | ||
| orangefs | ||
| overlayfs | ||
| proc | ||
| pstore | ||
| qnx4 | ||
| qnx6 | ||
| quota | ||
| ramfs | ||
| reiserfs | ||
| romfs | ||
| squashfs | ||
| sysfs | ||
| sysv | ||
| tracefs | ||
| ubifs | ||
| udf | ||
| ufs | ||
| unicode | ||
| vboxsf | ||
| verity | ||
| xfs | ||
| zonefs | ||
| Kconfig | -rw-r--r-- | 8.5 KB |
| Kconfig.binfmt | -rw-r--r-- | 7.6 KB |
| Makefile | -rw-r--r-- | 4.5 KB |
| aio.c | -rw-r--r-- | 56.4 KB |
| anon_inodes.c | -rw-r--r-- | 4.6 KB |
| attr.c | -rw-r--r-- | 9.7 KB |
| bad_inode.c | -rw-r--r-- | 5.3 KB |
| binfmt_aout.c | -rw-r--r-- | 8.3 KB |
| binfmt_elf.c | -rw-r--r-- | 60.5 KB |
| binfmt_elf_fdpic.c | -rw-r--r-- | 44.1 KB |
| binfmt_em86.c | -rw-r--r-- | 2.7 KB |
| binfmt_flat.c | -rw-r--r-- | 28.3 KB |
| binfmt_misc.c | -rw-r--r-- | 17.3 KB |
| binfmt_script.c | -rw-r--r-- | 4.2 KB |
| block_dev.c | -rw-r--r-- | 47.9 KB |
| buffer.c | -rw-r--r-- | 89.1 KB |
| char_dev.c | -rw-r--r-- | 16.5 KB |
| compat_binfmt_elf.c | -rw-r--r-- | 3.8 KB |
| coredump.c | -rw-r--r-- | 27.7 KB |
| d_path.c | -rw-r--r-- | 11.4 KB |
| dax.c | -rw-r--r-- | 46.4 KB |
| dcache.c | -rw-r--r-- | 84.7 KB |
| dcookies.c | -rw-r--r-- | 7.1 KB |
| direct-io.c | -rw-r--r-- | 39.5 KB |
| drop_caches.c | -rw-r--r-- | 1.8 KB |
| eventfd.c | -rw-r--r-- | 12.1 KB |
| eventpoll.c | -rw-r--r-- | 63.8 KB |
| exec.c | -rw-r--r-- | 49.3 KB |
| fcntl.c | -rw-r--r-- | 23.4 KB |
| fhandle.c | -rw-r--r-- | 6.8 KB |
| file.c | -rw-r--r-- | 28.7 KB |
| file_table.c | -rw-r--r-- | 10.2 KB |
| filesystems.c | -rw-r--r-- | 6.4 KB |
| fs-writeback.c | -rw-r--r-- | 74.6 KB |
| fs_context.c | -rw-r--r-- | 17.2 KB |
| fs_parser.c | -rw-r--r-- | 10.1 KB |
| fs_pin.c | -rw-r--r-- | 1.9 KB |
| fs_struct.c | -rw-r--r-- | 3.4 KB |
| fs_types.c | -rw-r--r-- | 2.5 KB |
| fsopen.c | -rw-r--r-- | 11.0 KB |
| init.c | -rw-r--r-- | 5.9 KB |
| inode.c | -rw-r--r-- | 63.1 KB |
| internal.h | -rw-r--r-- | 5.1 KB |
| io-wq.c | -rw-r--r-- | 29.6 KB |
| io-wq.h | -rw-r--r-- | 3.6 KB |
| io_uring.c | -rw-r--r-- | 244.2 KB |
| ioctl.c | -rw-r--r-- | 20.9 KB |
| kernel_read_file.c | -rw-r--r-- | 4.4 KB |
| libfs.c | -rw-r--r-- | 39.6 KB |
| locks.c | -rw-r--r-- | 80.0 KB |
| mbcache.c | -rw-r--r-- | 12.0 KB |
| mount.h | -rw-r--r-- | 4.2 KB |
| mpage.c | -rw-r--r-- | 20.5 KB |
| namei.c | -rw-r--r-- | 120.0 KB |
| namespace.c | -rw-r--r-- | 98.5 KB |
| no-block.c | -rw-r--r-- | 478 bytes |
| nsfs.c | -rw-r--r-- | 6.6 KB |
| open.c | -rw-r--r-- | 33.3 KB |
| pipe.c | -rw-r--r-- | 33.7 KB |
| pnode.c | -rw-r--r-- | 15.1 KB |
| pnode.h | -rw-r--r-- | 1.9 KB |
| posix_acl.c | -rw-r--r-- | 21.5 KB |
| proc_namespace.c | -rw-r--r-- | 8.1 KB |
| read_write.c | -rw-r--r-- | 39.2 KB |
| readdir.c | -rw-r--r-- | 13.7 KB |
| remap_range.c | -rw-r--r-- | 13.9 KB |
| select.c | -rw-r--r-- | 34.7 KB |
| seq_file.c | -rw-r--r-- | 24.7 KB |
| signalfd.c | -rw-r--r-- | 9.0 KB |
| splice.c | -rw-r--r-- | 38.7 KB |
| stack.c | -rw-r--r-- | 2.5 KB |
| stat.c | -rw-r--r-- | 19.8 KB |
| statfs.c | -rw-r--r-- | 9.6 KB |
| super.c | -rw-r--r-- | 45.2 KB |
| sync.c | -rw-r--r-- | 10.5 KB |
| timerfd.c | -rw-r--r-- | 13.6 KB |
| userfaultfd.c | -rw-r--r-- | 52.0 KB |
| utimes.c | -rw-r--r-- | 7.6 KB |
| xattr.c | -rw-r--r-- | 26.2 KB |
Computing file changes ...
