| Message ID | 20240328134351.298050-1-korotkov.maxim.s@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drm/virtio: add driver_priv validation in virtio_gpu_create_context | expand |
On 3/28/24 16:43, Maxim Korotkov wrote: > The pointer file->driver_priv was dereferenced without checking > against NULL, but in the "virtio_gpu_transfer_to_host_ioctl" function > it was checked against NULL after calling virtio_gpu_create_context > function. > > Found by Security Code and Linux Verification Center(linuxtesting.org) > Fixes: 72b48ae800da ("drm/virtio: enqueue virtio_gpu_create_context after the first 3D ioctl") > Signed-off-by: Maxim Korotkov <korotkov.maxim.s@gmail.com> > --- > drivers/gpu/drm/virtio/virtgpu_ioctl.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c > index e4f76f315550..98fe9ad4ed15 100644 > --- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c > +++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c > @@ -64,6 +64,9 @@ void virtio_gpu_create_context(struct drm_device *dev, struct drm_file *file) > struct virtio_gpu_device *vgdev = dev->dev_private; > struct virtio_gpu_fpriv *vfpriv = file->driver_priv; > > + if (!vfpriv) > + return; > + > mutex_lock(&vfpriv->context_lock); > if (vfpriv->context_created) > goto out_unlock; NULL check in virtio_gpu_transfer_to_host_ioctl() is bogus, vfpriv can't be NULL there.
diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c index e4f76f315550..98fe9ad4ed15 100644 --- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c +++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c @@ -64,6 +64,9 @@ void virtio_gpu_create_context(struct drm_device *dev, struct drm_file *file) struct virtio_gpu_device *vgdev = dev->dev_private; struct virtio_gpu_fpriv *vfpriv = file->driver_priv; + if (!vfpriv) + return; + mutex_lock(&vfpriv->context_lock); if (vfpriv->context_created) goto out_unlock;
The pointer file->driver_priv was dereferenced without checking against NULL, but in the "virtio_gpu_transfer_to_host_ioctl" function it was checked against NULL after calling virtio_gpu_create_context function. Found by Security Code and Linux Verification Center(linuxtesting.org) Fixes: 72b48ae800da ("drm/virtio: enqueue virtio_gpu_create_context after the first 3D ioctl") Signed-off-by: Maxim Korotkov <korotkov.maxim.s@gmail.com> --- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 3 +++ 1 file changed, 3 insertions(+)