github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-11 08:03:05 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
099bdfba32
linux/drivers/gpu/drm/xen
History
Lv Yunlong 7a1cd9044d gpu/xen: Fix a use after free in xen_drm_drv_init 
[ Upstream commit 52762efa2b ]

In function displback_changed, has the call chain
displback_connect(front_info)->xen_drm_drv_init(front_info).
We can see that drm_info is assigned to front_info->drm_info
and drm_info is freed in fail branch in xen_drm_drv_init().

Later displback_disconnect(front_info) is called and it calls
xen_drm_drv_fini(front_info) cause a use after free by
drm_info = front_info->drm_info statement.

My patch has done two things. First fixes the fail label which
drm_info = kzalloc() failed and still free the drm_info.
Second sets front_info->drm_info to NULL to avoid uaf.

Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Reviewed-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
Signed-off-by: Oleksandr Andrushchenko <oleksandr_andrushchenko@epam.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20210323014656.10068-1-lyl2019@mail.ustc.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-04-21 13:00:52 +02:00
..
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile drm/xen-front: Use Xen common shared buffer implementation 2018-12-18 12:16:13 -05:00
xen_drm_front_cfg.c drm/xen: drop use of drmP.h 2019-07-15 18:11:30 +02:00
xen_drm_front_cfg.h
xen_drm_front_conn.c drm/xen-front: Add YUYV to supported formats 2020-08-13 12:50:27 +02:00
xen_drm_front_conn.h drm/xen: drop use of drmP.h 2019-07-15 18:11:30 +02:00
xen_drm_front_evtchnl.c drm/xen: drop use of drmP.h 2019-07-15 18:11:30 +02:00
xen_drm_front_evtchnl.h
xen_drm_front_gem.c drm-misc-next for 5.10: 2020-09-23 09:52:24 +10:00
xen_drm_front_gem.h drm/xen: drop use of drmP.h 2019-07-15 18:11:30 +02:00
xen_drm_front_kms.c drm/xen-front: Fix misused IS_ERR_OR_NULL checks 2020-08-13 12:50:25 +02:00
xen_drm_front_kms.h
xen_drm_front.c gpu/xen: Fix a use after free in xen_drm_drv_init 2021-04-21 13:00:52 +02:00
xen_drm_front.h drm/xen-front: Pass dumb buffer data offset to the backend 2020-08-13 17:15:21 +02:00