|
Thomas Zimmermann |
253126 |
From de066e116306baf3a6a62691ac63cfc0b1dabddb Mon Sep 17 00:00:00 2001
|
|
Thomas Zimmermann |
253126 |
From: Daniel Vetter <daniel.vetter@ffwll.ch>
|
|
Thomas Zimmermann |
253126 |
Date: Mon, 22 Feb 2021 11:06:43 +0100
|
|
Thomas Zimmermann |
253126 |
Subject: drm/compat: Clear bounce structures
|
|
Thomas Zimmermann |
253126 |
Git-commit: de066e116306baf3a6a62691ac63cfc0b1dabddb
|
|
Thomas Zimmermann |
253126 |
Patch-mainline: v5.12-rc3
|
|
Thomas Zimmermann |
253126 |
References: bsc#1129770
|
|
Thomas Zimmermann |
253126 |
|
|
Thomas Zimmermann |
253126 |
Some of them have gaps, or fields we don't clear. Native ioctl code
|
|
Thomas Zimmermann |
253126 |
does full copies plus zero-extends on size mismatch, so nothing can
|
|
Thomas Zimmermann |
253126 |
leak. But compat is more hand-rolled so need to be careful.
|
|
Thomas Zimmermann |
253126 |
|
|
Thomas Zimmermann |
253126 |
None of these matter for performance, so just memset.
|
|
Thomas Zimmermann |
253126 |
|
|
Thomas Zimmermann |
253126 |
Also I didn't fix up the CONFIG_DRM_LEGACY or CONFIG_DRM_AGP ioctl, those
|
|
Thomas Zimmermann |
253126 |
are security holes anyway.
|
|
Thomas Zimmermann |
253126 |
|
|
Thomas Zimmermann |
253126 |
Acked-by: Maxime Ripard <mripard@kernel.org>
|
|
Thomas Zimmermann |
253126 |
Reported-by: syzbot+620cf21140fc7e772a5d@syzkaller.appspotmail.com # vblank ioctl
|
|
Thomas Zimmermann |
253126 |
Cc: syzbot+620cf21140fc7e772a5d@syzkaller.appspotmail.com
|
|
Thomas Zimmermann |
253126 |
Cc: stable@vger.kernel.org
|
|
Thomas Zimmermann |
253126 |
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
|
|
Thomas Zimmermann |
253126 |
Link: https://patchwork.freedesktop.org/patch/msgid/20210222100643.400935-1-daniel.vetter@ffwll.ch
|
|
Thomas Zimmermann |
253126 |
(cherry picked from commit e926c474ebee404441c838d18224cd6f246a71b7)
|
|
Thomas Zimmermann |
253126 |
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
|
|
Thomas Zimmermann |
253126 |
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
|
|
Thomas Zimmermann |
253126 |
---
|
|
Thomas Zimmermann |
253126 |
drivers/gpu/drm/drm_ioc32.c | 11 +++++++++++
|
|
Thomas Zimmermann |
253126 |
1 file changed, 11 insertions(+)
|
|
Thomas Zimmermann |
253126 |
|
|
Thomas Zimmermann |
253126 |
--- a/drivers/gpu/drm/drm_ioc32.c
|
|
Thomas Zimmermann |
253126 |
+++ b/drivers/gpu/drm/drm_ioc32.c
|
|
Thomas Zimmermann |
253126 |
@@ -96,6 +96,8 @@ static int compat_drm_version(struct fil
|
|
Thomas Zimmermann |
253126 |
if (copy_from_user(&v32, (void __user *)arg, sizeof(v32)))
|
|
Thomas Zimmermann |
253126 |
return -EFAULT;
|
|
Thomas Zimmermann |
253126 |
|
|
Thomas Zimmermann |
253126 |
+ memset(&v, 0, sizeof(v));
|
|
Thomas Zimmermann |
253126 |
+
|
|
Thomas Zimmermann |
253126 |
v = (struct drm_version) {
|
|
Thomas Zimmermann |
253126 |
.name_len = v32.name_len,
|
|
Thomas Zimmermann |
253126 |
.name = compat_ptr(v32.name),
|
|
Thomas Zimmermann |
253126 |
@@ -134,6 +136,9 @@ static int compat_drm_getunique(struct f
|
|
Thomas Zimmermann |
253126 |
|
|
Thomas Zimmermann |
253126 |
if (copy_from_user(&uq32, (void __user *)arg, sizeof(uq32)))
|
|
Thomas Zimmermann |
253126 |
return -EFAULT;
|
|
Thomas Zimmermann |
253126 |
+
|
|
Thomas Zimmermann |
253126 |
+ memset(&uq, 0, sizeof(uq));
|
|
Thomas Zimmermann |
253126 |
+
|
|
Thomas Zimmermann |
253126 |
uq = (struct drm_unique){
|
|
Thomas Zimmermann |
253126 |
.unique_len = uq32.unique_len,
|
|
Thomas Zimmermann |
253126 |
.unique = compat_ptr(uq32.unique),
|
|
Thomas Zimmermann |
253126 |
@@ -260,6 +265,8 @@ static int compat_drm_getclient(struct f
|
|
Thomas Zimmermann |
253126 |
if (copy_from_user(&c32, argp, sizeof(c32)))
|
|
Thomas Zimmermann |
253126 |
return -EFAULT;
|
|
Thomas Zimmermann |
253126 |
|
|
Thomas Zimmermann |
253126 |
+ memset(&client, 0, sizeof(client));
|
|
Thomas Zimmermann |
253126 |
+
|
|
Thomas Zimmermann |
253126 |
client.idx = c32.idx;
|
|
Thomas Zimmermann |
253126 |
|
|
Thomas Zimmermann |
253126 |
err = drm_ioctl_kernel(file, drm_getclient, &client, DRM_UNLOCKED);
|
|
Thomas Zimmermann |
253126 |
@@ -842,6 +849,8 @@ static int compat_drm_wait_vblank(struct
|
|
Thomas Zimmermann |
253126 |
if (copy_from_user(&req32, argp, sizeof(req32)))
|
|
Thomas Zimmermann |
253126 |
return -EFAULT;
|
|
Thomas Zimmermann |
253126 |
|
|
Thomas Zimmermann |
253126 |
+ memset(&req, 0, sizeof(req));
|
|
Thomas Zimmermann |
253126 |
+
|
|
Thomas Zimmermann |
253126 |
req.request.type = req32.request.type;
|
|
Thomas Zimmermann |
253126 |
req.request.sequence = req32.request.sequence;
|
|
Thomas Zimmermann |
253126 |
req.request.signal = req32.request.signal;
|
|
Thomas Zimmermann |
253126 |
@@ -879,6 +888,8 @@ static int compat_drm_mode_addfb2(struct
|
|
Thomas Zimmermann |
253126 |
struct drm_mode_fb_cmd2 req64;
|
|
Thomas Zimmermann |
253126 |
int err;
|
|
Thomas Zimmermann |
253126 |
|
|
Thomas Zimmermann |
253126 |
+ memset(&req64, 0, sizeof(req64));
|
|
Thomas Zimmermann |
253126 |
+
|
|
Thomas Zimmermann |
253126 |
if (copy_from_user(&req64, argp,
|
|
Thomas Zimmermann |
253126 |
offsetof(drm_mode_fb_cmd232_t, modifier)))
|
|
Thomas Zimmermann |
253126 |
return -EFAULT;
|