Re: [PATCH] drm: Fix use-after-free in the shadow-attache exit code

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi

On Thu, Jan 30, 2014 at 5:58 PM, Daniel Vetter <daniel.vetter@xxxxxxxx> wrote:
> This regression has been introduced in
>
> commit b3f2333de8e81b089262b26d52272911523e605f
> Author: Daniel Vetter <daniel.vetter@xxxxxxxx>
> Date:   Wed Dec 11 11:34:31 2013 +0100
>
>     drm: restrict the device list for shadow attached drivers
>
> Reported-by: Dave Jones <davej@xxxxxxxxxx>
> Cc: Dave Jones <davej@xxxxxxxxxx>
> Cc: Dave Airlie <airlied@xxxxxxxxxx>
> Cc: David Herrmann <dh.herrmann@xxxxxxxxx>
> Signed-off-by: Daniel Vetter <daniel.vetter@xxxxxxxx>
> ---
>  drivers/gpu/drm/drm_pci.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/drm_pci.c b/drivers/gpu/drm/drm_pci.c
> index 5736aaa7e86c..f7af69bcf3f4 100644
> --- a/drivers/gpu/drm/drm_pci.c
> +++ b/drivers/gpu/drm/drm_pci.c
> @@ -468,8 +468,8 @@ void drm_pci_exit(struct drm_driver *driver, struct pci_driver *pdriver)
>         } else {
>                 list_for_each_entry_safe(dev, tmp, &driver->legacy_dev_list,
>                                          legacy_dev_list) {
> -                       drm_put_dev(dev);
>                         list_del(&dev->legacy_dev_list);
> +                       drm_put_dev(dev);

This code-path is the only user of legacy_dev_list (besides ->probe)
and both are locked against each other. So removing the device before
destroying it is fine. So no objections from me:

Reviewed-by: David Herrmann <dh.herrmann@xxxxxxxxx>

Thanks
David

>                 }
>         }
>         DRM_INFO("Module unloaded\n");
> --
> 1.8.5.2
>
_______________________________________________
Intel-gfx mailing list
Intel-gfx@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/intel-gfx




[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]
  Powered by Linux