Re: [PATCH] drm/virtio: Fix capset-id query size

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On Tue, Feb 15, 2022 at 5:15 PM Rob Clark <robdclark@xxxxxxxxx> wrote:
From: Rob Clark <robdclark@xxxxxxxxxxxx>

The UABI was already defined for pointer to 64b value, and all the
userspace users of this ioctl that I could find are already using a
uint64_t (but zeroing it out to work around kernel only copying 32b).
Unfortunately this ioctl doesn't have a length field, so out of paranoia
I restricted the change to copy 64b to the single 64b param that can be
queried.

Fixes: 78aa20fa4381 ("drm/virtio: implement context init: advertise feature to userspace")
Signed-off-by: Rob Clark <robdclark@xxxxxxxxxxxx>

Reviewed-byGurchetan Singh <gurchetansingh@xxxxxxxxxxxx>
 
---
 drivers/gpu/drm/virtio/virtgpu_ioctl.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
index 0f2f3f54dbf9..0158d27d5645 100644
--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
@@ -269,7 +269,8 @@ static int virtio_gpu_getparam_ioctl(struct drm_device *dev, void *data,
 {
        struct virtio_gpu_device *vgdev = dev->dev_private;
        struct drm_virtgpu_getparam *param = data;
-       int value;
+       int value, ret, sz = sizeof(int);
+       uint64_t value64;

        switch (param->param) {
        case VIRTGPU_PARAM_3D_FEATURES:
@@ -291,13 +292,20 @@ static int virtio_gpu_getparam_ioctl(struct drm_device *dev, void *data,
                value = vgdev->has_context_init ? 1 : 0;
                break;
        case VIRTGPU_PARAM_SUPPORTED_CAPSET_IDs:
-               value = vgdev->capset_id_mask;
+               value64 = vgdev->capset_id_mask;
+               sz = sizeof(value64);
                break;
        default:
                return -EINVAL;
        }
-       if (copy_to_user(u64_to_user_ptr(param->value), &value, sizeof(int)))
-               return -EFAULT;
+
+       if (sz == sizeof(int)) {
+               if (copy_to_user(u64_to_user_ptr(param->value), &value, sz))
+                       return -EFAULT;
+       } else {
+               if (copy_to_user(u64_to_user_ptr(param->value), &value64, sz))
+                       return -EFAULT;
+       }

        return 0;
 }
--
2.34.1


[Index of Archives]     [Linux DRI Users]     [Linux Intel Graphics]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [XFree86]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux