Re: [PATCH] drm/vkms: fix use-after-free when drm_gem_handle_create() fails

2019-03-10 Thread Rodrigo Siqueira
On 03/05, Dmitry Vyukov wrote: > On Tue, Mar 5, 2019 at 12:23 AM Rodrigo Siqueira > wrote: > > > > On 02/28, Dmitry Vyukov wrote: > > > On Thu, Feb 28, 2019 at 12:12 AM Rodrigo Siqueira > > > wrote: > > > > > > > > On 02/26, Eric Biggers wrote: > > > > > From: Eric Biggers > > > > > > > > > >

Re: [PATCH] drm/vkms: fix use-after-free when drm_gem_handle_create() fails

2019-03-06 Thread Dmitry Vyukov
On Tue, Mar 5, 2019 at 12:23 AM Rodrigo Siqueira wrote: > > On 02/28, Dmitry Vyukov wrote: > > On Thu, Feb 28, 2019 at 12:12 AM Rodrigo Siqueira > > wrote: > > > > > > On 02/26, Eric Biggers wrote: > > > > From: Eric Biggers > > > > > > > > If drm_gem_handle_create() fails in vkms_gem_create(),

Re: [PATCH] drm/vkms: fix use-after-free when drm_gem_handle_create() fails

2019-03-04 Thread Rodrigo Siqueira
On 02/28, Dmitry Vyukov wrote: > On Thu, Feb 28, 2019 at 12:12 AM Rodrigo Siqueira > wrote: > > > > On 02/26, Eric Biggers wrote: > > > From: Eric Biggers > > > > > > If drm_gem_handle_create() fails in vkms_gem_create(), then the > > > vkms_gem_object is freed twice: once when the reference is

Re: [PATCH] drm/vkms: fix use-after-free when drm_gem_handle_create() fails

2019-02-28 Thread Dmitry Vyukov
On Thu, Feb 28, 2019 at 12:12 AM Rodrigo Siqueira wrote: > > On 02/26, Eric Biggers wrote: > > From: Eric Biggers > > > > If drm_gem_handle_create() fails in vkms_gem_create(), then the > > vkms_gem_object is freed twice: once when the reference is dropped by > > drm_gem_object_put_unlocked(),

Re: [PATCH] drm/vkms: fix use-after-free when drm_gem_handle_create() fails

2019-02-27 Thread Rodrigo Siqueira
On 02/26, Eric Biggers wrote: > From: Eric Biggers > > If drm_gem_handle_create() fails in vkms_gem_create(), then the > vkms_gem_object is freed twice: once when the reference is dropped by > drm_gem_object_put_unlocked(), and again by the extra calls to > drm_gem_object_release() and kfree().

Re: [PATCH] drm/vkms: fix use-after-free when drm_gem_handle_create() fails

2019-02-26 Thread Chris Wilson
Quoting Eric Biggers (2019-02-26 22:08:58) > From: Eric Biggers > > If drm_gem_handle_create() fails in vkms_gem_create(), then the > vkms_gem_object is freed twice: once when the reference is dropped by > drm_gem_object_put_unlocked(), and again by the extra calls to > drm_gem_object_release()

[PATCH] drm/vkms: fix use-after-free when drm_gem_handle_create() fails

2019-02-26 Thread Eric Biggers
From: Eric Biggers If drm_gem_handle_create() fails in vkms_gem_create(), then the vkms_gem_object is freed twice: once when the reference is dropped by drm_gem_object_put_unlocked(), and again by the extra calls to drm_gem_object_release() and kfree(). Fix it by skipping the second release and