On Sat, 12 Jun 2021 at 13:55, Desmond Cheong Zhi Xi <desmondcheon...@gmail.com> wrote: > > While checking the master status of the DRM file in > drm_is_current_master(), the device's master mutex should be > held. Without the mutex, the pointer fpriv->master may be freed > concurrently by another process calling drm_setmaster_ioctl(). This > could lead to use-after-free errors when the pointer is subsequently > dereferenced in drm_lease_owner(). > > The callers of drm_is_current_master() from drm_auth.c hold the > device's master mutex, but external callers do not. Hence, we implement > drm_is_current_master_locked() to be used within drm_auth.c, and > modify drm_is_current_master() to grab the device's master mutex > before checking the master status. > > Reported-by: Daniel Vetter <daniel.vet...@ffwll.ch> > Signed-off-by: Desmond Cheong Zhi Xi <desmondcheon...@gmail.com>
Reviewed-by: Emil Velikov <emil.l.veli...@gmail.com> -Emil
