drm: add a locked version of drm_is_current_master
authorDesmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Mon, 12 Jul 2021 04:35:06 +0000 (12:35 +0800)
committerDaniel Vetter <daniel.vetter@ffwll.ch>
Tue, 20 Jul 2021 18:15:20 +0000 (20:15 +0200)
commit1f7ef07cfa14fb8557d1f1b7a14c76926142a4fb
tree80f9c64f2c46217e2107a408ebf618dea7fc4772
parent5eff9585de220cdd131237f5665db5e6c6bdf590
drm: add a locked version of drm_is_current_master

While checking the master status of the DRM file in
drm_is_current_master(), the device's master mutex should be
held. Without the mutex, the pointer fpriv->master may be freed
concurrently by another process calling drm_setmaster_ioctl(). This
could lead to use-after-free errors when the pointer is subsequently
dereferenced in drm_lease_owner().

The callers of drm_is_current_master() from drm_auth.c hold the
device's master mutex, but external callers do not. Hence, we implement
drm_is_current_master_locked() to be used within drm_auth.c, and
modify drm_is_current_master() to grab the device's master mutex
before checking the master status.

Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210712043508.11584-4-desmondcheongzx@gmail.com
drivers/gpu/drm/drm_auth.c