If the master tries to authenticate a client using drm_authmagic and
that client has already closed its drm file descriptor,
either wilfully or because it was terminated, the
call to drm_authmagic will dereference a stale pointer into kmalloc'ed memory
and corrupt it.
Typically this results in a hard system hang.
This patch fixes that problem by removing any authentication tokens
(struct drm_magic_entry) open for a file descriptor when that file
descriptor is closed.
Signed-off-by: Thomas Hellstrom <[email protected]>
Reviewed-by: Daniel Vetter <[email protected]>
Cc: [email protected]
Signed-off-by: Dave Airlie <[email protected]>
Thomas Hellstrom
598781d711