drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl
Userspace can race to free the gobj(robj converted from), robj should not be accessed again after drm_gem_object_put, otherwith it will result in use-after-free. Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Min Li <lm0963hack@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
This commit is contained in:
parent
5a03159ab7
commit
e6850f98ef
|
@ -459,7 +459,6 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data,
|
||||||
struct radeon_device *rdev = dev->dev_private;
|
struct radeon_device *rdev = dev->dev_private;
|
||||||
struct drm_radeon_gem_set_domain *args = data;
|
struct drm_radeon_gem_set_domain *args = data;
|
||||||
struct drm_gem_object *gobj;
|
struct drm_gem_object *gobj;
|
||||||
struct radeon_bo *robj;
|
|
||||||
int r;
|
int r;
|
||||||
|
|
||||||
/* for now if someone requests domain CPU -
|
/* for now if someone requests domain CPU -
|
||||||
|
@ -472,13 +471,12 @@ int radeon_gem_set_domain_ioctl(struct drm_device *dev, void *data,
|
||||||
up_read(&rdev->exclusive_lock);
|
up_read(&rdev->exclusive_lock);
|
||||||
return -ENOENT;
|
return -ENOENT;
|
||||||
}
|
}
|
||||||
robj = gem_to_radeon_bo(gobj);
|
|
||||||
|
|
||||||
r = radeon_gem_set_domain(gobj, args->read_domains, args->write_domain);
|
r = radeon_gem_set_domain(gobj, args->read_domains, args->write_domain);
|
||||||
|
|
||||||
drm_gem_object_put(gobj);
|
drm_gem_object_put(gobj);
|
||||||
up_read(&rdev->exclusive_lock);
|
up_read(&rdev->exclusive_lock);
|
||||||
r = radeon_gem_handle_lockup(robj->rdev, r);
|
r = radeon_gem_handle_lockup(rdev, r);
|
||||||
return r;
|
return r;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue