Skip to content

Commit

Permalink
drm/compat: Clear bounce structures
Browse files Browse the repository at this point in the history
commit de066e116306baf3a6a62691ac63cfc0b1dabddb upstream.

Some of them have gaps, or fields we don't clear. Native ioctl code
does full copies plus zero-extends on size mismatch, so nothing can
leak. But compat is more hand-rolled so need to be careful.

None of these matter for performance, so just memset.

Also I didn't fix up the CONFIG_DRM_LEGACY or CONFIG_DRM_AGP ioctl, those
are security holes anyway.

Acked-by: Maxime Ripard <[email protected]>
Reported-by: [email protected] # vblank ioctl
Cc: [email protected]
Cc: [email protected]
Signed-off-by: Daniel Vetter <[email protected]>
Link: https://patchwork.freedesktop.org/patch/msgid/[email protected]
(cherry picked from commit e926c474ebee404441c838d18224cd6f246a71b7)
Signed-off-by: Maarten Lankhorst <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
  • Loading branch information
danvet authored and gregkh committed Mar 17, 2021
1 parent 21d62e8 commit e8cd674
Showing 1 changed file with 11 additions and 0 deletions.
11 changes: 11 additions & 0 deletions drivers/gpu/drm/drm_ioc32.c
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,8 @@ static int compat_drm_version(struct file *file, unsigned int cmd,
if (copy_from_user(&v32, (void __user *)arg, sizeof(v32)))
return -EFAULT;

memset(&v, 0, sizeof(v));

v = (struct drm_version) {
.name_len = v32.name_len,
.name = compat_ptr(v32.name),
Expand Down Expand Up @@ -134,6 +136,9 @@ static int compat_drm_getunique(struct file *file, unsigned int cmd,

if (copy_from_user(&uq32, (void __user *)arg, sizeof(uq32)))
return -EFAULT;

memset(&uq, 0, sizeof(uq));

uq = (struct drm_unique){
.unique_len = uq32.unique_len,
.unique = compat_ptr(uq32.unique),
Expand Down Expand Up @@ -260,6 +265,8 @@ static int compat_drm_getclient(struct file *file, unsigned int cmd,
if (copy_from_user(&c32, argp, sizeof(c32)))
return -EFAULT;

memset(&client, 0, sizeof(client));

client.idx = c32.idx;

err = drm_ioctl_kernel(file, drm_getclient, &client, DRM_UNLOCKED);
Expand Down Expand Up @@ -842,6 +849,8 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
if (copy_from_user(&req32, argp, sizeof(req32)))
return -EFAULT;

memset(&req, 0, sizeof(req));

req.request.type = req32.request.type;
req.request.sequence = req32.request.sequence;
req.request.signal = req32.request.signal;
Expand Down Expand Up @@ -879,6 +888,8 @@ static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
struct drm_mode_fb_cmd2 req64;
int err;

memset(&req64, 0, sizeof(req64));

if (copy_from_user(&req64, argp,
offsetof(drm_mode_fb_cmd232_t, modifier)))
return -EFAULT;
Expand Down

0 comments on commit e8cd674

Please sign in to comment.