| Message ID | 1427789375-2213-3-git-send-email-peter.antoine@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Tested-By: PRC QA PRTS (Patch Regression Test System Contact: shuang.he@intel.com)
Task id: 6100
-------------------------------------Summary-------------------------------------
Platform Delta drm-intel-nightly Series Applied
PNV 276/276 276/276
ILK 303/303 303/303
SNB -1 304/304 303/304
IVB 338/338 338/338
BYT 287/287 287/287
HSW -1 361/361 360/361
BDW 309/309 309/309
-------------------------------------Detailed-------------------------------------
Platform Test drm-intel-nightly Series Applied
*SNB igt@kms_rotation_crc@sprite-rotation PASS(2) FAIL(1)PASS(1)
*HSW igt@pm_rpm@drm-resources-equal PASS(4) DMESG_WARN(1)PASS(1)
(dmesg patch applied)WARNING:at_drivers/gpu/drm/i915/intel_uncore.c:#assert_device_not_suspended[i915]()@WARNING:.* at .* assert_device_not_suspended+0x
Note: You need to pay more attention to line start with '*'
diff --git a/drivers/gpu/drm/drm_context.c b/drivers/gpu/drm/drm_context.c index a4b017b..4754e79 100644 --- a/drivers/gpu/drm/drm_context.c +++ b/drivers/gpu/drm/drm_context.c @@ -252,7 +252,13 @@ static int drm_context_switch_complete(struct drm_device *dev, { dev->last_context = new; /* PRE/POST: This is the _only_ writer. */ - if (!_DRM_LOCK_IS_HELD(file_priv->master->lock.hw_lock->lock)) { + if (file_priv->master->lock.hw_lock == NULL) { + DRM_ERROR( + "Device has been unregistered. Hard exit. Process %d\n", + task_pid_nr(current)); + send_sig(SIGTERM, current, 0); + return -EINTR; + } else if (!_DRM_LOCK_IS_HELD(file_priv->master->lock.hw_lock->lock)) { DRM_ERROR("Lock isn't held after context switch\n"); }
This patch fixes an unsafe deference in the DRM_IOCTL_NEW_CTX. If the ioctl is called before the lock is created or after it has been destroyed. The code will deference a NULL pointer. This ioctl is a root ioctl so exploitation is limited. Issue: GMINL-7409 Change-Id: Icabf814abe8225d616fdf4f981cd36d2b27f7ad5 Signed-off-by: Peter Antoine <peter.antoine@intel.com> --- drivers/gpu/drm/drm_context.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)