xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
bc3e73ebb79b01abc121703669c65f54f0023cfe
android_kernel_xiaomi_sm8450/drivers/gpu/drm/vmwgfx
History
Desmond Cheong Zhi Xi d6c9142399 drm/vmwgfx: fix potential UAF in vmwgfx_surface.c 
[ Upstream commit 2bc5da528dd570c5ecabc107e6fbdbc55974276f ]

drm_file.master should be protected by either drm_device.master_mutex
or drm_file.master_lookup_lock when being dereferenced. However,
drm_master_get is called on unprotected file_priv->master pointers in
vmw_surface_define_ioctl and vmw_gb_surface_define_internal.

This is fixed by replacing drm_master_get with drm_file_get_master.

Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Zack Rusin <zackr@vmware.com>
Signed-off-by: Zack Rusin <zackr@vmware.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210724111824.59266-4-desmondcheongzx@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-09-18 13:40:27 +02:00
..
device_include
drm/vmwgfx: Fix cpu updates of coherent multisample surfaces
2021-07-14 16:56:16 +02:00
Kconfig
…
Makefile
…
ttm_lock.c
…
ttm_lock.h
…
ttm_object.c
…
ttm_object.h
…
vmwgfx_binding.c
…
vmwgfx_binding.h
…
vmwgfx_blit.c
drm/ttm/tt: add wrappers to set tt state.
2020-09-16 09:33:24 +10:00
vmwgfx_bo.c
drm/ttm: nuke memory type flags
2020-09-11 13:31:23 +02:00
vmwgfx_cmdbuf_res.c
…
vmwgfx_cmdbuf.c
…
vmwgfx_context.c
…
vmwgfx_cotable.c
…
vmwgfx_drv.c
drm/ttm: remove available_caching
2020-09-15 16:05:19 +02:00
vmwgfx_drv.h
drm/ttm: nuke memory type flags
2020-09-11 13:31:23 +02:00
vmwgfx_execbuf.c
drm/vmwgfx: Mark a surface gpu-dirty after the SVGA3dCmdDXGenMips command
2021-07-14 16:56:16 +02:00
vmwgfx_fb.c
…
vmwgfx_fence.c
…
vmwgfx_fence.h
…
vmwgfx_fifo.c
drm/vmwgfx: don't use ttm bo->offset
2020-06-26 14:00:41 +02:00
vmwgfx_gmr.c
…
vmwgfx_gmrid_manager.c
Merge tag 'drm-next-2020-10-15' of git://anongit.freedesktop.org/drm/drm
2020-10-15 10:46:16 -07:00
vmwgfx_ioctl.c
…
vmwgfx_irq.c
…
vmwgfx_kms.c
drm/vmwgfx: fix spelling mistake "Cant" -> "Can't"
2020-08-11 03:16:03 +02:00
vmwgfx_kms.h
…
vmwgfx_ldu.c
drm/vmwgfx/ldu: Use drm_mode_config_reset
2020-08-11 03:16:03 +02:00
vmwgfx_marker.c
…
vmwgfx_mob.c
drm/vmwgfx: consolidate ttm object creation and populate
2020-08-06 12:16:22 +10:00
vmwgfx_msg.c
objtool: Rename frame.h -> objtool.h
2020-09-10 10:43:13 -05:00
vmwgfx_msg.h
…
vmwgfx_overlay.c
…
vmwgfx_page_dirty.c
…
vmwgfx_prime.c
…
vmwgfx_reg.h
…
vmwgfx_resource_priv.h
…
vmwgfx_resource.c
drm/ttm: rename ttm_mem_reg to ttm_resource.
2020-08-06 13:19:21 +10:00
vmwgfx_scrn.c
drm/vmwgfx/sou: Use drm_mode_config_reset
2020-08-11 03:16:02 +02:00
vmwgfx_shader.c
…
vmwgfx_simple_resource.c
…
vmwgfx_so.c
…
vmwgfx_so.h
…
vmwgfx_stdu.c
drm/vmwgfx/stdu: Use drm_mode_config_reset
2020-08-11 03:16:02 +02:00
vmwgfx_streamoutput.c
…
vmwgfx_surface.c
drm/vmwgfx: fix potential UAF in vmwgfx_surface.c
2021-09-18 13:40:27 +02:00
vmwgfx_thp.c
Merge tag 'drm-next-2020-10-15' of git://anongit.freedesktop.org/drm/drm
2020-10-15 10:46:16 -07:00
vmwgfx_ttm_buffer.c
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma
2020-10-17 11:18:18 -07:00
vmwgfx_ttm_glue.c
…
vmwgfx_va.c
…
vmwgfx_validation.c
…
vmwgfx_validation.h
…