| commit | d78d383ab354b0b9e1d23404ae0d9fbdeb9aa035 | [log] [tgz] |
|---|---|---|
| author | Rob Clark <robdclark@gmail.com> | Mon Aug 22 15:28:38 2016 -0400 |
| committer | Rob Clark <robdclark@gmail.com> | Sun Aug 28 12:49:39 2016 -0400 |
| tree | aee4580ca0766d3be40c2b574dd7816aabc3d080 | |
| parent | 89f82cbb0d5c0ab768c8d02914188aa2211cd2e3 [diff] |
drm/msm: protect against faults from copy_from_user() in submit ioctl An evil userspace could try to cause deadlock by passing an unfaulted-in GEM bo as submit->bos (or submit->cmds) table. Which will trigger msm_gem_fault() while we already hold struct_mutex. See: https://github.com/freedreno/msmtest/blob/master/evilsubmittest.c Cc: stable@vger.kernel.org Signed-off-by: Rob Clark <robdclark@gmail.com>