DivestOS/Patches/Linux_CVEs/CVE-2016-8479/3.18/0001.patch
2017-11-07 17:32:46 -05:00

89 lines
2.7 KiB
Diff

From 1a9d60a353d6c8191cfec089f8cb502626bb0b0e Mon Sep 17 00:00:00 2001
From: Jordan Crouse <jcrouse@codeaurora.org>
Date: Tue, 31 May 2016 11:24:22 -0600
Subject: msm: kgsl: Reserve a context ID slot but don't populate immediately
When creating a context allocate an ID but don't populate the slot
with the context pointer until we are done setup up the rest of the
process. This avoids a race if somebody tries to free the same
identifier before the create operation is complete.
Change-Id: Ic0dedbadca5b4cc4ce567afad48a33078b549439
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>
---
drivers/gpu/msm/kgsl.c | 21 +++++++++++++--------
1 file changed, 13 insertions(+), 8 deletions(-)
diff --git a/drivers/gpu/msm/kgsl.c b/drivers/gpu/msm/kgsl.c
index ccd8a1d..61be1f339 100644
--- a/drivers/gpu/msm/kgsl.c
+++ b/drivers/gpu/msm/kgsl.c
@@ -525,21 +525,18 @@ void kgsl_context_dump(struct kgsl_context *context)
EXPORT_SYMBOL(kgsl_context_dump);
/* Allocate a new context ID */
-static int _kgsl_get_context_id(struct kgsl_device *device,
- struct kgsl_context *context)
+static int _kgsl_get_context_id(struct kgsl_device *device)
{
int id;
idr_preload(GFP_KERNEL);
write_lock(&device->context_lock);
- id = idr_alloc(&device->context_idr, context, 1,
+ /* Allocate the slot but don't put a pointer in it yet */
+ id = idr_alloc(&device->context_idr, NULL, 1,
KGSL_MEMSTORE_MAX, GFP_NOWAIT);
write_unlock(&device->context_lock);
idr_preload_end();
- if (id > 0)
- context->id = id;
-
return id;
}
@@ -563,7 +560,7 @@ int kgsl_context_init(struct kgsl_device_private *dev_priv,
char name[64];
int ret = 0, id;
- id = _kgsl_get_context_id(device, context);
+ id = _kgsl_get_context_id(device);
if (id == -ENOSPC) {
/*
* Before declaring that there are no contexts left try
@@ -572,7 +569,7 @@ int kgsl_context_init(struct kgsl_device_private *dev_priv,
*/
flush_workqueue(device->events_wq);
- id = _kgsl_get_context_id(device, context);
+ id = _kgsl_get_context_id(device);
}
if (id < 0) {
@@ -584,6 +581,8 @@ int kgsl_context_init(struct kgsl_device_private *dev_priv,
return id;
}
+ context->id = id;
+
kref_init(&context->refcount);
/*
* Get a refernce to the process private so its not destroyed, until
@@ -1713,6 +1712,12 @@ long kgsl_ioctl_drawctxt_create(struct kgsl_device_private *dev_priv,
goto done;
}
trace_kgsl_context_create(dev_priv->device, context, param->flags);
+
+ /* Commit the pointer to the context in context_idr */
+ write_lock(&device->context_lock);
+ idr_replace(&device->context_idr, context, context->id);
+ write_unlock(&device->context_lock);
+
param->drawctxt_id = context->id;
done:
return result;
--
cgit v1.1