lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 10 Apr 2017 16:31:26 -0400 From: Sean Paul <seanpaul@...omium.org> To: Jeffy Chen <jeffy.chen@...k-chips.com> Cc: linux-kernel@...r.kernel.org, briannorris@...omium.org, dianders@...omium.org, tfiga@...omium.org, seanpaul@...omium.org, zyw@...k-chips.com, marcheu@...omium.org, mark.yao@...k-chips.com, hshi@...omium.org, Daniel Vetter <daniel.vetter@...el.com>, Jani Nikula <jani.nikula@...ux.intel.com>, dri-devel@...ts.freedesktop.org, David Airlie <airlied@...ux.ie> Subject: Re: [PATCH v6 2/2] drm: Prevent release fb after cleanup mode config On Mon, Apr 10, 2017 at 06:00:45PM +0800, Jeffy Chen wrote: > After unbinding drm, the user space may still owns the drm dev fd, > and may trigger fb release after cleanup mode config. > > Add a sanity check to prevent that. > > Signed-off-by: Jeffy Chen <jeffy.chen@...k-chips.com> > --- > > Changes in v6: None > Changes in v5: None > Changes in v2: None > > drivers/gpu/drm/drm_framebuffer.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c > index e8f9c13..03c1632 100644 > --- a/drivers/gpu/drm/drm_framebuffer.c > +++ b/drivers/gpu/drm/drm_framebuffer.c > @@ -583,6 +583,11 @@ void drm_fb_release(struct drm_file *priv) > { > struct drm_framebuffer *fb, *tfb; > struct drm_mode_rmfb_work arg; > + struct drm_minor *minor = priv->minor; > + struct drm_device *dev = minor->dev; > + > + if (WARN_ON(!dev->mode_config.num_fb && !list_empty(&priv->fbs))) Have you actually seen this happen? num_fb should be tightly couple to priv->fbs, so it seems like this could only result from a driver bug (or I'm not reading the code correctly). Sean > + return; > > INIT_LIST_HEAD(&arg.fbs); > > -- > 2.1.4 > -- Sean Paul, Software Engineer, Google / Chromium OS
Powered by blists - more mailing lists