From mboxrd@z Thu Jan 1 00:00:00 1970 From: Daniel Vetter Subject: Re: [PATCH] drm: Fix authentication kernel crash Date: Tue, 24 Jan 2012 15:47:43 +0100 Message-ID: <20120124144743.GE3980@phenom.ffwll.local> References: <1327397506-2979-1-git-send-email-thellstrom@vmware.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mail-wi0-f177.google.com (mail-wi0-f177.google.com [209.85.212.177]) by gabe.freedesktop.org (Postfix) with ESMTP id B2A069F4DF for ; Tue, 24 Jan 2012 06:47:43 -0800 (PST) Received: by wico1 with SMTP id o1so484019wic.36 for ; Tue, 24 Jan 2012 06:47:42 -0800 (PST) In-Reply-To: <1327397506-2979-1-git-send-email-thellstrom@vmware.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org Errors-To: dri-devel-bounces+sf-dri-devel=m.gmane.org@lists.freedesktop.org To: Thomas Hellstrom Cc: airlied@redhat.com, dri-devel@lists.freedesktop.org, stable@vger.kernel.org List-Id: dri-devel@lists.freedesktop.org On Tue, Jan 24, 2012 at 10:31:46AM +0100, Thomas Hellstrom wrote: > If the master tries to authenticate a client using drm_authmagic and > that client has already closed its drm file descriptor, > either wilfully or because it was terminated, the > call to drm_authmagic will dereference a stale pointer into kmalloc'ed memory > and corrupt it. > > Typically this results in a hard system hang. > > This patch fixes that problem by removing any authentication tokens > (struct drm_magic_entry) open for a file descriptor when that file > descriptor is closed. > > Signed-off-by: Thomas Hellstrom Ok, I've wandered around a bit in this and noticed that the locking is the usual convoluted disaster. We seem to randomly grab dev->struct_mutex in the auth and master ioctl, but all the real protect seems to be due to taking the global mutex in all relevant paths. I guess I can't volunteer you to clean this up ;-) Otherwise I couldn't poke a hole into this, so Reviewed-by: Daniel Vetter > ---- Daniel Vetter Mail: daniel@ffwll.ch Mobile: +41 (0)79 365 57 48