From mboxrd@z Thu Jan  1 00:00:00 1970
From: Daniel Vetter <daniel@ffwll.ch>
Subject: Re: [PATCH] drm: fix use-after-free read in
 drm_mode_create_lease_ioctl()
Date: Tue, 2 Oct 2018 10:24:50 +0200
Message-ID: <20181002082450.GJ11082@phenom.ffwll.local>
References: <20181001153117.216923-1-jannh@google.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
Return-path: <dri-devel-bounces@lists.freedesktop.org>
Received: from mail-ed1-x541.google.com (mail-ed1-x541.google.com
 [IPv6:2a00:1450:4864:20::541])
 by gabe.freedesktop.org (Postfix) with ESMTPS id 6F6DE6E279
 for <dri-devel@lists.freedesktop.org>; Tue,  2 Oct 2018 08:24:57 +0000 (UTC)
Received: by mail-ed1-x541.google.com with SMTP id q19-v6so1299441edr.1
 for <dri-devel@lists.freedesktop.org>; Tue, 02 Oct 2018 01:24:57 -0700 (PDT)
Content-Disposition: inline
In-Reply-To: <20181001153117.216923-1-jannh@google.com>
List-Unsubscribe: <https://lists.freedesktop.org/mailman/options/dri-devel>,
 <mailto:dri-devel-request@lists.freedesktop.org?subject=unsubscribe>
List-Archive: <https://lists.freedesktop.org/archives/dri-devel>
List-Post: <mailto:dri-devel@lists.freedesktop.org>
List-Help: <mailto:dri-devel-request@lists.freedesktop.org?subject=help>
List-Subscribe: <https://lists.freedesktop.org/mailman/listinfo/dri-devel>,
 <mailto:dri-devel-request@lists.freedesktop.org?subject=subscribe>
Errors-To: dri-devel-bounces@lists.freedesktop.org
Sender: "dri-devel" <dri-devel-bounces@lists.freedesktop.org>
To: Jann Horn <jannh@google.com>
Cc: Keith Packard <keithp@keithp.com>, Kees Cook <keescook@chromium.org>, David Airlie <airlied@linux.ie>, linux-kernel@vger.kernel.org, dri-devel@lists.freedesktop.org, Dave Airlie <airlied@redhat.com>
List-Id: dri-devel@lists.freedesktop.org

T24gTW9uLCBPY3QgMDEsIDIwMTggYXQgMDU6MzE6MTdQTSArMDIwMCwgSmFubiBIb3JuIHdyb3Rl
Ogo+IGZkX2luc3RhbGwoKSBtb3ZlcyB0aGUgcmVmZXJlbmNlIGdpdmVuIHRvIGl0IGludG8gdGhl
IGZpbGUgZGVzY3JpcHRvciB0YWJsZQo+IG9mIHRoZSBjdXJyZW50IHByb2Nlc3MuIElmIHRoZSBj
dXJyZW50IHByb2Nlc3MgaXMgbXVsdGl0aHJlYWRlZCwgdGhlbgo+IGltbWVkaWF0ZWx5IGFmdGVy
IGZkX2luc3RhbGwoKSwgYW5vdGhlciB0aHJlYWQgY2FuIGNsb3NlKCkgdGhlIGZpbGUKPiBkZXNj
cmlwdG9yIGFuZCBjYXVzZSB0aGUgZmlsZSdzIHJlc291cmNlcyB0byBiZSBjbGVhbmVkIHVwLgo+
IAo+IFNpbmNlIHRoZSByZWZlcmVuY2UgdG8gImxlc3NlZSIgaXMgaGVsZCBieSB0aGUgZmlsZSwg
d2UgbXVzdCBub3QgYWNjZXNzCj4gImxlc3NlZSIgYWZ0ZXIgdGhlIGZkX2luc3RhbGwoKSBjYWxs
Lgo+IAo+IEFzIGZhciBhcyBJIGNhbiB0ZWxsLCB0byByZWFjaCB0aGlzIGNvZGVwYXRoLCB0aGUg
Y2FsbGVyIG11c3QgaGF2ZSBhbiBvcGVuCj4gZmlsZSBkZXNjcmlwdG9yIHRvIGEgRFJJIGRldmlj
ZSBpbiBtYXN0ZXIgbW9kZS4gSSdtIG5vdCBzdXJlIHdoYXQgdGhlCj4gcmVxdWlyZW1lbnRzIGZv
ciB0aGF0IGFyZS4KPiAKPiBTaWduZWQtb2ZmLWJ5OiBKYW5uIEhvcm4gPGphbm5oQGdvb2dsZS5j
b20+Cj4gRml4ZXM6IDYyODg0Y2QzODZiOCAoImRybTogQWRkIGZvdXIgaW9jdGxzIGZvciBtYW5h
Z2luZyBkcm0gbW9kZSBvYmplY3QgbGVhc2VzIFt2N10iKQo+IENjOiBzdGFibGVAdmdlci5rZXJu
ZWwub3JnCj4gLS0tCj4gSSdtIG5vdCBzdXJlIGhvdyB0byBhY3R1YWxseSB1c2UgdGhpcyBpb2N0
bCwgc28gSSBoYXZlIG5laXRoZXIgdmVyaWZpZWQKPiB0aGUgYnVnIGV4cGVyaW1lbnRhbGx5IG5v
ciBleHBlcmltZW50YWxseSB2ZXJpZmllZCB0aGUgZml4LiBJIHdvdWxkCj4gYXBwcmVjaWF0ZSBp
dCBpZiBzb21lb25lIGNvdWxkIGNvbmZpcm0gbXkgYW5hbHlzaXMuCj4gCj4gVGhlcmUgaGF2ZSBi
ZWVuIGEgbnVtYmVyIG9mIGZkX2luc3RhbGwoKSBidWdzIG92ZXIgdGltZTsgSSB0aGluayBpdCdz
Cj4gcHJvYmFibHkgdGltZSB0byByZW5hbWUgZmRfaW5zdGFsbCgpIHRvIGZkX2luc3RhbGxfZHJv
cHJlZigpLCBvcgo+IHNvbWV0aGluZyBsaWtlIHRoYXQuCgpQdWJsaXNoaW5nIGFuIG9iamVjdCB0
byB0aGUgd29ybGQgbmVlZHMgdG8gaGFwcGVuIGxhc3QsIG9ubHkgb25jZSBpdCdzCmZ1bGx5IHNl
dCB1cC4gSXQncyB1bmZvcnR1bmF0ZWx5IGEgdmVyeSBjb21tb24gYnVnLCBhbmQgZGVmaW5pdGVs
eSBub3QKbGltaXRlZCB0byB1c2UtYWZ0ZXItZnJlZSBmdW4uIEUuZy4gaGVyZSB5b3UgY291bGQg
YWxzbyBjb25mdXNlIHRoZSBrZXJuZWwKaWYgeW91IG1hbmFnZSB0byBzbmVhayBpbiBhbiBpb2N0
bCBvbiB0aGUgbmV3IGZkLCB3aGlsZSBpdCdzIG5vdCB5ZXQgZnVsbHkKcmVhZHkgZm9yIHRob3Nl
LiBmZF9pbnN0YWxsKCkgaXMganVzdCBvbmUgb2YgdGhlc2UuCgpFeGNlcHQgcmV2aWV3IGFuZCBt
YXliZSBhdXRvbWF0aWMgYW5hbHlzaXMgdG9vbHMgZm9yIHRoZSBjb21tb24gSSdtIG5vdApzdXJl
IGhvdyB0byBjYXRjaCB0aGVzZSBiZXR0ZXIuIEJlY2F1c2UgdGhlIHJhY2UgaXMgZ2VuZXJhbGx5
IHNtYWxsLAp0ZXN0cyZmdXp6aW5nIHRlbmQgdG8gbm90IGhpdCB0aGVzZS4KClRoYW5rcyBhIGxv
dCBmb3Igc3BvdHRpbmcgdGhpcyBpc3N1ZSwgcGF0Y2ggYXBwbGllZC4KCkNoZWVycywgRGFuaWVs
CiAKPiAgZHJpdmVycy9ncHUvZHJtL2RybV9sZWFzZS5jIHwgNiArKystLS0KPiAgMSBmaWxlIGNo
YW5nZWQsIDMgaW5zZXJ0aW9ucygrKSwgMyBkZWxldGlvbnMoLSkKPiAKPiBkaWZmIC0tZ2l0IGEv
ZHJpdmVycy9ncHUvZHJtL2RybV9sZWFzZS5jIGIvZHJpdmVycy9ncHUvZHJtL2RybV9sZWFzZS5j
Cj4gaW5kZXggYjU0ZmI3OGEyODNjLi5iODJkYTk2ZGVkNWMgMTAwNjQ0Cj4gLS0tIGEvZHJpdmVy
cy9ncHUvZHJtL2RybV9sZWFzZS5jCj4gKysrIGIvZHJpdmVycy9ncHUvZHJtL2RybV9sZWFzZS5j
Cj4gQEAgLTU2NiwxNCArNTY2LDE0IEBAIGludCBkcm1fbW9kZV9jcmVhdGVfbGVhc2VfaW9jdGwo
c3RydWN0IGRybV9kZXZpY2UgKmRldiwKPiAgCWxlc3NlZV9wcml2LT5pc19tYXN0ZXIgPSAxOwo+
ICAJbGVzc2VlX3ByaXYtPmF1dGhlbnRpY2F0ZWQgPSAxOwo+ICAKPiAtCS8qIEhvb2sgdXAgdGhl
IGZkICovCj4gLQlmZF9pbnN0YWxsKGZkLCBsZXNzZWVfZmlsZSk7Cj4gLQo+ICAJLyogUGFzcyBm
ZCBiYWNrIHRvIHVzZXJzcGFjZSAqLwo+ICAJRFJNX0RFQlVHX0xFQVNFKCJSZXR1cm5pbmcgZmQg
JWQgaWQgJWRcbiIsIGZkLCBsZXNzZWUtPmxlc3NlZV9pZCk7Cj4gIAljbC0+ZmQgPSBmZDsKPiAg
CWNsLT5sZXNzZWVfaWQgPSBsZXNzZWUtPmxlc3NlZV9pZDsKPiAgCj4gKwkvKiBIb29rIHVwIHRo
ZSBmZCAqLwo+ICsJZmRfaW5zdGFsbChmZCwgbGVzc2VlX2ZpbGUpOwo+ICsKPiAgCURSTV9ERUJV
R19MRUFTRSgiZHJtX21vZGVfY3JlYXRlX2xlYXNlX2lvY3RsIHN1Y2NlZWRlZFxuIik7Cj4gIAly
ZXR1cm4gMDsKPiAgCj4gLS0gCj4gMi4xOS4wLjYwNS5nMDFkMzcxZjc0MS1nb29nCj4gCj4gX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KPiBkcmktZGV2ZWwg
bWFpbGluZyBsaXN0Cj4gZHJpLWRldmVsQGxpc3RzLmZyZWVkZXNrdG9wLm9yZwo+IGh0dHBzOi8v
bGlzdHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vZHJpLWRldmVsCgotLSAKRGFu
aWVsIFZldHRlcgpTb2Z0d2FyZSBFbmdpbmVlciwgSW50ZWwgQ29ycG9yYXRpb24KaHR0cDovL2Js
b2cuZmZ3bGwuY2gKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
X18KZHJpLWRldmVsIG1haWxpbmcgbGlzdApkcmktZGV2ZWxAbGlzdHMuZnJlZWRlc2t0b3Aub3Jn
Cmh0dHBzOi8vbGlzdHMuZnJlZWRlc2t0b3Aub3JnL21haWxtYW4vbGlzdGluZm8vZHJpLWRldmVs
Cg==