projects / platform / kernel / linux-amlogic.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 4c08261) | patch
Fix use after free in get_capset_info callback.
authorDoug Horn <doughorn@google.com>
Wed, 2 Sep 2020 21:08:25 +0000 (14:08 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 29 Oct 2020 08:05:45 +0000 (09:05 +0100)
commit466de4edf4c2f5b1e77b98249b627915877bbda5
tree172847ceace60cbba37e34085530ecf7e33ac53atree | snapshot
parent4c082618998436ce8154089fad673300bbbad0c3commit | diff
Fix use after free in get_capset_info callback.

[ Upstream commit e219688fc5c3d0d9136f8d29d7e0498388f01440 ]

If a response to virtio_gpu_cmd_get_capset_info takes longer than
five seconds to return, the callback will access freed kernel memory
in vg->capsets.

Signed-off-by: Doug Horn <doughorn@google.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20200902210847.2689-2-gurchetansingh@chromium.org
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/gpu/drm/virtio/virtgpu_kms.c diff | blob | history
drivers/gpu/drm/virtio/virtgpu_vq.c diff | blob | history
Domain: System / Kernel;