diff options
| author | Ben Skeggs <bskeggs@redhat.com> | 2016-05-25 17:11:40 +1000 |
|---|---|---|
| committer | Ben Skeggs <bskeggs@redhat.com> | 2017-01-31 19:52:21 +1000 |
| commit | 7f68a4fb63234722dcf67b1e7a56eb0b5d660151 (patch) | |
| tree | 6dba001fad5ea56431114e03c08a4f156c5dbab8 | |
| parent | 9b913fade82627755f5df8a7708f88b8f8c50e4e (diff) | |
| download | nouveau-7f68a4fb63234722dcf67b1e7a56eb0b5d660151.tar.gz | |
drm: prevent userspace from deleting client object
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
| -rw-r--r-- | drm/nouveau/nouveau_usif.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drm/nouveau/nouveau_usif.c b/drm/nouveau/nouveau_usif.c index 08f9c6fa0..1fba38622 100644 --- a/drm/nouveau/nouveau_usif.c +++ b/drm/nouveau/nouveau_usif.c @@ -313,7 +313,8 @@ usif_ioctl(struct drm_file *filp, void __user *user, u32 argc) if (!(ret = nvif_unpack(-ENOSYS, &data, &size, argv->v0, 0, 0, true))) { /* block access to objects not created via this interface */ owner = argv->v0.owner; - if (argv->v0.object == 0ULL) + if (argv->v0.object == 0ULL && + argv->v0.type != NVIF_IOCTL_V0_DEL) argv->v0.owner = NVDRM_OBJECT_ANY; /* except client */ else argv->v0.owner = NVDRM_OBJECT_USIF; |