Re: [PATCH] drm: Prevent overwriting from userspace underallocating core ioctl structs

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, Oct 16, 2013 at 11:22:44AM +0100, Chris Wilson wrote:
> Apply the protections from
> 
> commit 1b2f1489633888d4a06028315dc19d65768a1c05
> Author: Dave Airlie <airlied@xxxxxxxxxx>
> Date:   Sat Aug 14 20:20:34 2010 +1000
> 
>     drm: block userspace under allocating buffer and having drivers overwrite it (v2)
> 
> to the core ioctl structs as well, for we found one instance where there
> is a 32-/64-bit size mismatch and were guilty of writing beyond the end
> of the user's buffer.
> 
> Signed-off-by: Chris Wilson <chris@xxxxxxxxxxxxxxxxxx>
> Cc: Dave Airlie <airlied@xxxxxxxxxx>
> Cc: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx>
> Cc: dri-devel@xxxxxxxxxxxxxxxxxxxxx
> Cc: stable@xxxxxxxxxxxxxxx

Looks good.

Reviewed-by: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx>

> ---
>  drivers/gpu/drm/drm_drv.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
> index e572dd20bdee..05ad9ba0a67e 100644
> --- a/drivers/gpu/drm/drm_drv.c
> +++ b/drivers/gpu/drm/drm_drv.c
> @@ -402,9 +402,16 @@ long drm_ioctl(struct file *filp,
>  		cmd = ioctl->cmd_drv;
>  	}
>  	else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) {
> +		u32 drv_size;
> +
>  		ioctl = &drm_ioctls[nr];
> -		cmd = ioctl->cmd;
> +
> +		drv_size = _IOC_SIZE(ioctl->cmd);
>  		usize = asize = _IOC_SIZE(cmd);
> +		if (drv_size > asize)
> +			asize = drv_size;
> +
> +		cmd = ioctl->cmd;
>  	} else
>  		goto err_i1;
>  
> -- 
> 1.8.4.rc3

-- 
Ville Syrjälä
Intel OTC
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/dri-devel





[Index of Archives]     [Linux DRI Users]     [Linux Intel Graphics]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [XFree86]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux