| Message ID | 1381918964-2797-1-git-send-email-chris@chris-wilson.co.uk (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Wed, Oct 16, 2013 at 11:22:44AM +0100, Chris Wilson wrote: > Apply the protections from > > commit 1b2f1489633888d4a06028315dc19d65768a1c05 > Author: Dave Airlie <airlied@redhat.com> > Date: Sat Aug 14 20:20:34 2010 +1000 > > drm: block userspace under allocating buffer and having drivers overwrite it (v2) > > to the core ioctl structs as well, for we found one instance where there > is a 32-/64-bit size mismatch and were guilty of writing beyond the end > of the user's buffer. > > Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> > Cc: Dave Airlie <airlied@redhat.com> > Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> > Cc: dri-devel@lists.freedesktop.org > Cc: stable@vger.kernel.org Looks good. Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com> > --- > drivers/gpu/drm/drm_drv.c | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c > index e572dd20bdee..05ad9ba0a67e 100644 > --- a/drivers/gpu/drm/drm_drv.c > +++ b/drivers/gpu/drm/drm_drv.c > @@ -402,9 +402,16 @@ long drm_ioctl(struct file *filp, > cmd = ioctl->cmd_drv; > } > else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) { > + u32 drv_size; > + > ioctl = &drm_ioctls[nr]; > - cmd = ioctl->cmd; > + > + drv_size = _IOC_SIZE(ioctl->cmd); > usize = asize = _IOC_SIZE(cmd); > + if (drv_size > asize) > + asize = drv_size; > + > + cmd = ioctl->cmd; > } else > goto err_i1; > > -- > 1.8.4.rc3
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c index e572dd20bdee..05ad9ba0a67e 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -402,9 +402,16 @@ long drm_ioctl(struct file *filp, cmd = ioctl->cmd_drv; } else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) { + u32 drv_size; + ioctl = &drm_ioctls[nr]; - cmd = ioctl->cmd; + + drv_size = _IOC_SIZE(ioctl->cmd); usize = asize = _IOC_SIZE(cmd); + if (drv_size > asize) + asize = drv_size; + + cmd = ioctl->cmd; } else goto err_i1;
Apply the protections from commit 1b2f1489633888d4a06028315dc19d65768a1c05 Author: Dave Airlie <airlied@redhat.com> Date: Sat Aug 14 20:20:34 2010 +1000 drm: block userspace under allocating buffer and having drivers overwrite it (v2) to the core ioctl structs as well, for we found one instance where there is a 32-/64-bit size mismatch and were guilty of writing beyond the end of the user's buffer. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Cc: Dave Airlie <airlied@redhat.com> Cc: Ville Syrjälä <ville.syrjala@linux.intel.com> Cc: dri-devel@lists.freedesktop.org Cc: stable@vger.kernel.org --- drivers/gpu/drm/drm_drv.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)