mirror of
https://git.yoctoproject.org/meta-ti
synced 2026-07-16 22:38:04 +00:00
Koen Kooi
ebbeb55561
Also add script used to generate patches and SRC_URI Signed-off-by: Koen Kooi <koen@dominion.thruhere.net> Signed-off-by: Denys Dmytriyenko <denys@ti.com>
92 lines
3.8 KiB
Diff
92 lines
3.8 KiB
Diff
From 37983212fe7c26155958f760ff006dfe8ce14d0c Mon Sep 17 00:00:00 2001
|
|
From: Thomas Hellstrom <thellstrom@vmware.com>
|
|
Date: Tue, 24 Jan 2012 18:54:21 +0100
|
|
Subject: [PATCH 11/90] drm: Fix authentication kernel crash
|
|
|
|
commit 598781d71119827b454fd75d46f84755bca6f0c6 upstream.
|
|
|
|
If the master tries to authenticate a client using drm_authmagic and
|
|
that client has already closed its drm file descriptor,
|
|
either wilfully or because it was terminated, the
|
|
call to drm_authmagic will dereference a stale pointer into kmalloc'ed memory
|
|
and corrupt it.
|
|
|
|
Typically this results in a hard system hang.
|
|
|
|
This patch fixes that problem by removing any authentication tokens
|
|
(struct drm_magic_entry) open for a file descriptor when that file
|
|
descriptor is closed.
|
|
|
|
Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
|
|
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
|
|
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
---
|
|
drivers/gpu/drm/drm_auth.c | 6 +++++-
|
|
drivers/gpu/drm/drm_fops.c | 5 +++++
|
|
include/drm/drmP.h | 1 +
|
|
3 files changed, 11 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
|
|
index 3f46772..ba23790 100644
|
|
--- a/drivers/gpu/drm/drm_auth.c
|
|
+++ b/drivers/gpu/drm/drm_auth.c
|
|
@@ -101,7 +101,7 @@ static int drm_add_magic(struct drm_master *master, struct drm_file *priv,
|
|
* Searches and unlinks the entry in drm_device::magiclist with the magic
|
|
* number hash key, while holding the drm_device::struct_mutex lock.
|
|
*/
|
|
-static int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
|
|
+int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
|
|
{
|
|
struct drm_magic_entry *pt;
|
|
struct drm_hash_item *hash;
|
|
@@ -136,6 +136,8 @@ static int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
|
|
* If there is a magic number in drm_file::magic then use it, otherwise
|
|
* searches an unique non-zero magic number and add it associating it with \p
|
|
* file_priv.
|
|
+ * This ioctl needs protection by the drm_global_mutex, which protects
|
|
+ * struct drm_file::magic and struct drm_magic_entry::priv.
|
|
*/
|
|
int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
|
|
{
|
|
@@ -173,6 +175,8 @@ int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
|
|
* \return zero if authentication successed, or a negative number otherwise.
|
|
*
|
|
* Checks if \p file_priv is associated with the magic number passed in \arg.
|
|
+ * This ioctl needs protection by the drm_global_mutex, which protects
|
|
+ * struct drm_file::magic and struct drm_magic_entry::priv.
|
|
*/
|
|
int drm_authmagic(struct drm_device *dev, void *data,
|
|
struct drm_file *file_priv)
|
|
diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
|
|
index 4911e1d..828bf65 100644
|
|
--- a/drivers/gpu/drm/drm_fops.c
|
|
+++ b/drivers/gpu/drm/drm_fops.c
|
|
@@ -487,6 +487,11 @@ int drm_release(struct inode *inode, struct file *filp)
|
|
(long)old_encode_dev(file_priv->minor->device),
|
|
dev->open_count);
|
|
|
|
+ /* Release any auth tokens that might point to this file_priv,
|
|
+ (do that under the drm_global_mutex) */
|
|
+ if (file_priv->magic)
|
|
+ (void) drm_remove_magic(file_priv->master, file_priv->magic);
|
|
+
|
|
/* if the master has gone away we can't do anything with the lock */
|
|
if (file_priv->minor->master)
|
|
drm_master_release(dev, filp);
|
|
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
|
|
index 1f9e951..bf4b2dc 100644
|
|
--- a/include/drm/drmP.h
|
|
+++ b/include/drm/drmP.h
|
|
@@ -1328,6 +1328,7 @@ extern int drm_getmagic(struct drm_device *dev, void *data,
|
|
struct drm_file *file_priv);
|
|
extern int drm_authmagic(struct drm_device *dev, void *data,
|
|
struct drm_file *file_priv);
|
|
+extern int drm_remove_magic(struct drm_master *master, drm_magic_t magic);
|
|
|
|
/* Cache management (drm_cache.c) */
|
|
void drm_clflush_pages(struct page *pages[], unsigned long num_pages);
|
|
--
|
|
1.7.9.4
|
|
|