diff options
| author | Lingkai Dong <Lingkai.Dong@arm.com> | 2023-12-06 13:51:58 +0000 |
|---|---|---|
| committer | Christian König <christian.koenig@amd.com> | 2023-12-07 14:51:37 +0100 |
| commit | 5a6c9a05e55cb2972396cc991af9d74c8c15029a (patch) | |
| tree | 4331ee48189a5124da60e1c9f82e3b9011798e55 | |
| parent | e0f04e41e8eedd4e5a1275f2318df7e1841855f2 (diff) | |
| download | linux-stable-5a6c9a05e55cb2972396cc991af9d74c8c15029a.tar.gz linux-stable-5a6c9a05e55cb2972396cc991af9d74c8c15029a.tar.bz2 linux-stable-5a6c9a05e55cb2972396cc991af9d74c8c15029a.zip | |
drm: Fix FD ownership check in drm_master_check_perm()
The DRM subsystem keeps a record of the owner of a DRM device file
descriptor using thread group ID (TGID) instead of process ID (PID), to
ensures all threads within the same userspace process are considered the
owner. However, the DRM master ownership check compares the current
thread's PID against the record, so the thread is incorrectly considered to
be not the FD owner if the PID is not equal to the TGID. This causes DRM
ioctls to be denied master privileges, even if the same thread that opened
the FD performs an ioctl. Fix this by checking TGID.
Fixes: 4230cea89cafb ("drm: Track clients by tgid and not tid")
Signed-off-by: Lingkai Dong <lingkai.dong@arm.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: <stable@vger.kernel.org> # v6.4+
Link: https://patchwork.freedesktop.org/patch/msgid/PA6PR08MB107665920BE9A96658CDA04CE8884A@PA6PR08MB10766.eurprd08.prod.outlook.com
Signed-off-by: Christian König <christian.koenig@amd.com>
| -rw-r--r-- | drivers/gpu/drm/drm_auth.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c index 2ed2585ded37..6899b3dc1f12 100644 --- a/drivers/gpu/drm/drm_auth.c +++ b/drivers/gpu/drm/drm_auth.c @@ -236,7 +236,7 @@ static int drm_master_check_perm(struct drm_device *dev, struct drm_file *file_priv) { if (file_priv->was_master && - rcu_access_pointer(file_priv->pid) == task_pid(current)) + rcu_access_pointer(file_priv->pid) == task_tgid(current)) return 0; if (!capable(CAP_SYS_ADMIN)) |