mirror of https://github.com/torvalds/linux.git
598781d711
If the master tries to authenticate a client using drm_authmagic and that client has already closed its drm file descriptor, either wilfully or because it was terminated, the call to drm_authmagic will dereference a stale pointer into kmalloc'ed memory and corrupt it. Typically this results in a hard system hang. This patch fixes that problem by removing any authentication tokens (struct drm_magic_entry) open for a file descriptor when that file descriptor is closed. Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie <airlied@redhat.com> |
||
|---|---|---|
| .. | ||
| i2c | ||
| ttm | ||
| Kbuild | ||
| drm.h | ||
| drmP.h | ||
| drm_buffer.h | ||
| drm_cache.h | ||
| drm_core.h | ||
| drm_crtc.h | ||
| drm_crtc_helper.h | ||
| drm_dp_helper.h | ||
| drm_edid.h | ||
| drm_encoder_slave.h | ||
| drm_fb_helper.h | ||
| drm_fixed.h | ||
| drm_fourcc.h | ||
| drm_global.h | ||
| drm_hashtab.h | ||
| drm_mem_util.h | ||
| drm_memory.h | ||
| drm_mm.h | ||
| drm_mode.h | ||
| drm_os_linux.h | ||
| drm_pciids.h | ||
| drm_sarea.h | ||
| drm_sysfs.h | ||
| drm_usb.h | ||
| exynos_drm.h | ||
| gma_drm.h | ||
| i810_drm.h | ||
| i915_drm.h | ||
| intel-gtt.h | ||
| mga_drm.h | ||
| nouveau_drm.h | ||
| r128_drm.h | ||
| radeon_drm.h | ||
| savage_drm.h | ||
| sis_drm.h | ||
| via_drm.h | ||
| vmwgfx_drm.h | ||