drm: add a locked version of drm_is_current_master
authorDesmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Sun, 20 Jun 2021 11:03:26 +0000 (19:03 +0800)
committerSasha Levin <sashal@kernel.org>
Wed, 30 Jun 2021 12:47:15 +0000 (08:47 -0400)
commit3ef0ca0ec995fe5012d70a31f01826e12f323d0e
treecdd18b46defc4b22e19b750724442950597db14e
parentfea853aca3210c21dfcf07bb82d501b7fd1900a7
drm: add a locked version of drm_is_current_master

commit 1815d9c86e3090477fbde066ff314a7e9721ee0f upstream.

While checking the master status of the DRM file in
drm_is_current_master(), the device's master mutex should be
held. Without the mutex, the pointer fpriv->master may be freed
concurrently by another process calling drm_setmaster_ioctl(). This
could lead to use-after-free errors when the pointer is subsequently
dereferenced in drm_lease_owner().

The callers of drm_is_current_master() from drm_auth.c hold the
device's master mutex, but external callers do not. Hence, we implement
drm_is_current_master_locked() to be used within drm_auth.c, and
modify drm_is_current_master() to grab the device's master mutex
before checking the master status.

Reported-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/20210620110327.4964-2-desmondcheongzx@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/gpu/drm/drm_auth.c