Desmond Cheong Zhi Xi 34609faad0 drm: protect drm_master pointers in drm_lease.c ... [ Upstream commit 56f0729a51 ] drm_file->master pointers should be protected by drm_device.master_mutex or drm_file.master_lookup_lock when being dereferenced. However, in drm_lease.c, there are multiple instances where drm_file->master is accessed and dereferenced while neither lock is held. This makes drm_lease.c vulnerable to use-after-free bugs. We address this issue in 2 ways: 1. Add a new drm_file_get_master() function that calls drm_master_get on drm_file->master while holding on to drm_file.master_lookup_lock. Since drm_master_get increments the reference count of master, this prevents master from being freed until we unreference it with drm_master_put. 2. In each case where drm_file->master is directly accessed and eventually dereferenced in drm_lease.c, we wrap the access in a call to the new drm_file_get_master function, then unreference the master pointer once we are done using it. Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch> Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com> Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com> Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20210712043508.11584-6-desmondcheongzx@gmail.com Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-09-18 13:40:19 +02:00
..
acpi	ACPI: fix NULL pointer dereference	2021-08-08 09:05:23 +02:00
asm-generic	vmlinux.lds.h: Handle clang's module.{c,d}tor sections	2021-08-18 08:59:18 +02:00
clocksource	clocksource/drivers/timer-ti-dm: Save and restore timer TIOCP_CFG	2021-07-14 16:56:12 +02:00
crypto	crypto: public_key: fix overflow during implicit conversion	2021-09-18 13:40:08 +02:00
drm	drm: protect drm_master pointers in drm_lease.c	2021-09-18 13:40:19 +02:00
dt-bindings	clk: imx8mq: remove SYS PLL 1/2 clock gates	2021-07-14 16:56:20 +02:00
keys	certs: Add EFI_CERT_X509_GUID support for dbx entries	2021-06-30 08:47:30 -04:00
kunit
kvm
linux	iommu/vt-d: Update the virtual command related registers	2021-09-18 13:40:14 +02:00
math-emu
media	media: subdev: disallow ioctl for saa6588/davinci	2021-07-19 09:45:02 +02:00
memory
misc
net	Revert "flow_offload: action should not be NULL when it is referenced"	2021-08-26 08:35:52 -04:00
pcmcia
ras
rdma
scsi	scsi: iscsi: Fix conn use after free during resets	2021-07-20 16:05:41 +02:00
soc	firmware: raspberrypi: Keep count of all consumers	2021-09-15 09:50:41 +02:00
sound
target
trace	afs: Fix tracepoint string placement with built-in AFS	2021-07-28 14:35:41 +02:00
uapi	bpf: Fix a typo of reuseport map in bpf.h.	2021-09-15 09:50:31 +02:00
vdso
video
xen