Commit f67e946b authored by David Herrmann's avatar David Herrmann Committed by Dave Airlie

drm: remove minor-id during unplug

Don't delay minor removal to drm_put_minor(). Otherwise, user-space can
still open the minor and cause the kernel to oops. Instead, remove the
minor during unplug so any new open() will fail to access this minor.

Note that open() and drm_unplug_minor() are both protected by the global
DRM mutex so we're fine.
Signed-off-by: default avatarDavid Herrmann <dh.herrmann@gmail.com>
Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
parent 865fb47f
...@@ -346,6 +346,7 @@ static void drm_unplug_minor(struct drm_minor *minor) ...@@ -346,6 +346,7 @@ static void drm_unplug_minor(struct drm_minor *minor)
#endif #endif
drm_sysfs_device_remove(minor); drm_sysfs_device_remove(minor);
idr_remove(&drm_minors_idr, minor->index);
} }
/** /**
...@@ -365,9 +366,6 @@ static void drm_put_minor(struct drm_minor *minor) ...@@ -365,9 +366,6 @@ static void drm_put_minor(struct drm_minor *minor)
DRM_DEBUG("release secondary minor %d\n", minor->index); DRM_DEBUG("release secondary minor %d\n", minor->index);
drm_unplug_minor(minor); drm_unplug_minor(minor);
idr_remove(&drm_minors_idr, minor->index);
kfree(minor); kfree(minor);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment