diff options
| author | Mathias Krause <[email protected]> | 2022-01-27 18:34:19 +1000 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2022-01-27 17:55:20 +0200 |
| commit | a0f90c8815706981c483a652a6aefca51a5e191c (patch) | |
| tree | 4a6833bd11235602d4c8986c77bfa35936b98fd3 /tools/perf/util/scripting-engines/trace-event-perl.c | |
| parent | 626b2dda7651a7c766108db4cdc0825db05b980d (diff) | |
drm/vmwgfx: Fix stale file descriptors on failed usercopy
A failing usercopy of the fence_rep object will lead to a stale entry in
the file descriptor table as put_unused_fd() won't release it. This
enables userland to refer to a dangling 'file' object through that still
valid file descriptor, leading to all kinds of use-after-free
exploitation scenarios.
Fix this by deferring the call to fd_install() until after the usercopy
has succeeded.
Fixes: c906965dee22 ("drm/vmwgfx: Add export fence to file descriptor support")
Signed-off-by: Mathias Krause <[email protected]>
Signed-off-by: Zack Rusin <[email protected]>
Signed-off-by: Dave Airlie <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Diffstat (limited to 'tools/perf/util/scripting-engines/trace-event-perl.c')
0 files changed, 0 insertions, 0 deletions