5253125831
Userspace can guess the handle value and try to race GEM object creation
with handle close, resulting in a use-after-free if we dereference the
object after dropping the handle's reference. For that reason, dropping
the handle's reference must be done *after* we are done dereferencing
the object.
Signed-off-by: Rob Clark <robdclark@chromium.org>
Reviewed-by: Chia-I Wu <olvaffe@gmail.com>
Fixes:
|
||
|---|---|---|
| .. | ||
| Kconfig | ||
| Makefile | ||
| virtgpu_debugfs.c | ||
| virtgpu_display.c | ||
| virtgpu_drv.c | ||
| virtgpu_drv.h | ||
| virtgpu_fence.c | ||
| virtgpu_gem.c | ||
| virtgpu_ioctl.c | ||
| virtgpu_kms.c | ||
| virtgpu_object.c | ||
| virtgpu_plane.c | ||
| virtgpu_prime.c | ||
| virtgpu_trace.h | ||
| virtgpu_trace_points.c | ||
| virtgpu_vq.c | ||
| virtgpu_vram.c | ||