On Wed, Oct 16, 2013 at 11:22:44AM +0100, Chris Wilson wrote:
> Apply the protections from
>
> commit 1b2f1489633888d4a06028315dc19d65768a1c05
> Author: Dave Airlie <airlied@xxxxxxxxxx>
> Date: Sat Aug 14 20:20:34 2010 +1000
>
> drm: block userspace under allocating buffer and having drivers overwrite it (v2)
>
> to the core ioctl structs as well, for we found one instance where there
> is a 32-/64-bit size mismatch and were guilty of writing beyond the end
> of the user's buffer.
>
> Signed-off-by: Chris Wilson <chris@xxxxxxxxxxxxxxxxxx>
> Cc: Dave Airlie <airlied@xxxxxxxxxx>
> Cc: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx>
> Cc: dri-devel@xxxxxxxxxxxxxxxxxxxxx
> Cc: stable@xxxxxxxxxxxxxxx
Looks good.
Reviewed-by: Ville Syrjälä <ville.syrjala@xxxxxxxxxxxxxxx>
> ---
> drivers/gpu/drm/drm_drv.c | 9 ++++++++-
> 1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
> index e572dd20bdee..05ad9ba0a67e 100644
> --- a/drivers/gpu/drm/drm_drv.c
> +++ b/drivers/gpu/drm/drm_drv.c
> @@ -402,9 +402,16 @@ long drm_ioctl(struct file *filp,
> cmd = ioctl->cmd_drv;
> }
> else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) {
> + u32 drv_size;
> +
> ioctl = &drm_ioctls[nr];
> - cmd = ioctl->cmd;
> +
> + drv_size = _IOC_SIZE(ioctl->cmd);
> usize = asize = _IOC_SIZE(cmd);
> + if (drv_size > asize)
> + asize = drv_size;
> +
> + cmd = ioctl->cmd;
> } else
> goto err_i1;
>
> --
> 1.8.4.rc3
--
Ville Syrjälä
Intel OTC
_______________________________________________
dri-devel mailing list
dri-devel@xxxxxxxxxxxxxxxxxxxxx
http://lists.freedesktop.org/mailman/listinfo/dri-devel
