Re: [Intel-gfx] [PATCH 3/3] drm/vmwgfx: fix potential UAF in vmwgfx_surface.c

2021-07-23 Thread Desmond Cheong Zhi Xi
On 23/7/21 3:17 am, Zack Rusin wrote: On 7/22/21 5:29 AM, Desmond Cheong Zhi Xi wrote: drm_file.master should be protected by either drm_device.master_mutex or drm_file.master_lookup_lock when being dereferenced. However, drm_master_get is called on unprotected file_priv->master pointers in vmw_

Re: [Intel-gfx] [PATCH 3/3] drm/vmwgfx: fix potential UAF in vmwgfx_surface.c

2021-07-22 Thread Zack Rusin
On 7/22/21 5:29 AM, Desmond Cheong Zhi Xi wrote: drm_file.master should be protected by either drm_device.master_mutex or drm_file.master_lookup_lock when being dereferenced. However, drm_master_get is called on unprotected file_priv->master pointers in vmw_surface_define_ioctl and vmw_gb_surface

[Intel-gfx] [PATCH 3/3] drm/vmwgfx: fix potential UAF in vmwgfx_surface.c

2021-07-22 Thread Desmond Cheong Zhi Xi
drm_file.master should be protected by either drm_device.master_mutex or drm_file.master_lookup_lock when being dereferenced. However, drm_master_get is called on unprotected file_priv->master pointers in vmw_surface_define_ioctl and vmw_gb_surface_define_internal. This is fixed by replacing drm_m

Re: [Intel-gfx] [PATCH 3/3] drm/vmwgfx: fix potential UAF in vmwgfx_surface.c

2021-07-22 Thread Daniel Vetter
On Thu, Jul 22, 2021 at 05:29:29PM +0800, Desmond Cheong Zhi Xi wrote: > drm_file.master should be protected by either drm_device.master_mutex > or drm_file.master_lookup_lock when being dereferenced. However, > drm_master_get is called on unprotected file_priv->master pointers in > vmw_surface_def