drm/nouveau: prevent userspace from deleting client object
authorBen Skeggs <bskeggs@redhat.com>
Wed, 25 May 2016 07:11:40 +0000 (17:11 +1000)
committerBen Skeggs <bskeggs@redhat.com>
Tue, 31 Jan 2017 10:05:25 +0000 (20:05 +1000)
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
drivers/gpu/drm/nouveau/nouveau_usif.c

index 08f9c6f..1fba386 100644 (file)
@@ -313,7 +313,8 @@ usif_ioctl(struct drm_file *filp, void __user *user, u32 argc)
        if (!(ret = nvif_unpack(-ENOSYS, &data, &size, argv->v0, 0, 0, true))) {
                /* block access to objects not created via this interface */
                owner = argv->v0.owner;
-               if (argv->v0.object == 0ULL)
+               if (argv->v0.object == 0ULL &&
+                   argv->v0.type != NVIF_IOCTL_V0_DEL)
                        argv->v0.owner = NVDRM_OBJECT_ANY; /* except client */
                else
                        argv->v0.owner = NVDRM_OBJECT_USIF;