drm/vmwgfx: Fix stale file descriptors on failed usercopy

Browse source

A failing usercopy of the fence_rep object will lead to a stale entry in
the file descriptor table as put_unused_fd() won't release it. This
enables userland to refer to a dangling 'file' object through that still
valid file descriptor, leading to all kinds of use-after-free
exploitation scenarios.

Fix this by deferring the call to fd_install() until after the usercopy
has succeeded.

Fixes: c906965dee ("drm/vmwgfx: Add export fence to file descriptor support")
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
Signed-off-by: Zack Rusin <zackr@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

...

This commit is contained in:

Mathias Krause 2022-01-27 18:34:19 +10:00 • committed by Linus Torvalds

parent 626b2dda76

commit a0f90c8815

4 changed files with 21 additions and 21 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

drivers/gpu/drm/vmwgfx/vmwgfx_drv.h

View file

33

drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c

View file

2

drivers/gpu/drm/vmwgfx/vmwgfx_fence.c

View file

2

drivers/gpu/drm/vmwgfx/vmwgfx_kms.c

View file