exynos_g2d_set_cmdlist_ioctl() accepts cmd_buf_nr from userspace and
later uses it to index the fixed reg_types array while validating GEM
mapping commands. The existing G2D command-page limit is much larger
than that array.
Keep ordinary commands bounded by the command-page capacity, but bound
GEM mapping commands by MAX_REG_TYPE_NR before storing or validating
them. Perform the checks before taking a command-list node so an invalid
request cannot consume an entry from the free list.
Fixes: d7f1642c90ab ("drm/exynos: add G2D driver")
Signed-off-by: Pengpeng Hou <[email protected]>
---
drivers/gpu/drm/exynos/exynos_drm_g2d.c | 16 ++++++----------
1 file changed, 6 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index e92a4d872c41..2dfea16f32cb 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -1151,21 +1151,17 @@ int exynos_g2d_set_cmdlist_ioctl(struct drm_device
*drm_dev, void *data,
int size;
int ret;
- node = g2d_get_cmdlist(g2d);
- if (!node)
- return -ENOMEM;
-
- /*
- * To avoid an integer overflow for the later size computations, we
- * enforce a maximum number of submitted commands here. This limit is
- * sufficient for all conceivable usage cases of the G2D.
- */
+ /* GEM mapping commands also populate fixed-size buf_info arrays. */
if (req->cmd_nr > G2D_CMDLIST_DATA_NUM ||
- req->cmd_buf_nr > G2D_CMDLIST_DATA_NUM) {
+ req->cmd_buf_nr > MAX_REG_TYPE_NR) {
dev_err(g2d->dev, "number of submitted G2D commands exceeds
limit\n");
return -EINVAL;
}
+ node = g2d_get_cmdlist(g2d);
+ if (!node)
+ return -ENOMEM;
+
node->event = NULL;
if (req->event_type != G2D_EVENT_NOT) {
--
2.50.1 (Apple Git-155)
