drm: remove minor-id during unplug
Don't delay minor removal to drm_put_minor(). Otherwise, user-space can
still open the minor and cause the kernel to oops. Instead, remove the
minor during unplug so any new open() will fail to access this minor.
Note that open() and drm_unplug_minor() are both protected by the global
DRM mutex so we're fine.
Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index b37b0d9..e7c31e8 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -346,6 +346,7 @@
#endif
drm_sysfs_device_remove(minor);
+ idr_remove(&drm_minors_idr, minor->index);
}
/**
@@ -365,9 +366,6 @@
DRM_DEBUG("release secondary minor %d\n", minor->index);
drm_unplug_minor(minor);
-
- idr_remove(&drm_minors_idr, minor->index);
-
kfree(minor);
}