[Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-04-11 Thread Tommi Rantala
2013/3/17 Chris Wilson : > On Mon, Mar 18, 2013 at 07:42:58AM +1000, Dave Airlie wrote: >> On Mon, Mar 18, 2013 at 7:40 AM, Chris Wilson >> wrote: >> > On Sun, Mar 17, 2013 at 08:50:03PM +0100, Daniel Vetter wrote: >> >> On Sat, Mar 16, 2013 at 11:19 AM, Chris Wilson > >> chris-wilson.co.uk>

Re: [Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-04-11 Thread Tommi Rantala
2013/3/17 Chris Wilson ch...@chris-wilson.co.uk: On Mon, Mar 18, 2013 at 07:42:58AM +1000, Dave Airlie wrote: On Mon, Mar 18, 2013 at 7:40 AM, Chris Wilson ch...@chris-wilson.co.uk wrote: On Sun, Mar 17, 2013 at 08:50:03PM +0100, Daniel Vetter wrote: On Sat, Mar 16, 2013 at 11:19 AM, Chris

[Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-18 Thread Dave Airlie
On Mon, Mar 18, 2013 at 7:40 AM, Chris Wilson wrote: > On Sun, Mar 17, 2013 at 08:50:03PM +0100, Daniel Vetter wrote: >> On Sat, Mar 16, 2013 at 11:19 AM, Chris Wilson >> wrote: >> > If *userspace* doesn't request either IOC_IN | IOC_OUT in their ioctl >> > command (which are seperate from the

[Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-17 Thread Chris Wilson
On Mon, Mar 18, 2013 at 07:42:58AM +1000, Dave Airlie wrote: > On Mon, Mar 18, 2013 at 7:40 AM, Chris Wilson > wrote: > > On Sun, Mar 17, 2013 at 08:50:03PM +0100, Daniel Vetter wrote: > >> On Sat, Mar 16, 2013 at 11:19 AM, Chris Wilson >> chris-wilson.co.uk> wrote: > >> > If *userspace*

[Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-17 Thread Chris Wilson
On Sun, Mar 17, 2013 at 08:50:03PM +0100, Daniel Vetter wrote: > On Sat, Mar 16, 2013 at 11:19 AM, Chris Wilson > wrote: > > If *userspace* doesn't request either IOC_IN | IOC_OUT in their ioctl > > command (which are seperate from the ioctl number), then kdata is set to > > NULL. > > Doesn't

[Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-17 Thread Daniel Vetter
On Sat, Mar 16, 2013 at 11:19 AM, Chris Wilson wrote: > On Fri, Mar 15, 2013 at 04:49:42PM -0700, Ben Widawsky wrote: >> On Fri, Mar 15, 2013 at 10:06:19PM +, Chris Wilson wrote: >> > On Fri, Mar 15, 2013 at 09:36:07AM -0700, Ben Widawsky wrote: >> > > On Fri, Mar 15, 2013 at 08:24:03AM

[Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-17 Thread Dave Jones
On Sun, Mar 17, 2013 at 08:50:03PM +0100, Daniel Vetter wrote: > Doesn't that mean that we need these checks everywhere? Or at least a > fixup in drm core proper? > > And I think we need to add trinity to our test setup eventually ;-) Note that trinity's ioctl fuzzing is still very new

Re: [Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-17 Thread Daniel Vetter
On Sat, Mar 16, 2013 at 11:19 AM, Chris Wilson ch...@chris-wilson.co.uk wrote: On Fri, Mar 15, 2013 at 04:49:42PM -0700, Ben Widawsky wrote: On Fri, Mar 15, 2013 at 10:06:19PM +, Chris Wilson wrote: On Fri, Mar 15, 2013 at 09:36:07AM -0700, Ben Widawsky wrote: On Fri, Mar 15, 2013 at

Re: [Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-17 Thread Chris Wilson
On Sun, Mar 17, 2013 at 08:50:03PM +0100, Daniel Vetter wrote: On Sat, Mar 16, 2013 at 11:19 AM, Chris Wilson ch...@chris-wilson.co.uk wrote: If *userspace* doesn't request either IOC_IN | IOC_OUT in their ioctl command (which are seperate from the ioctl number), then kdata is set to

Re: [Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-17 Thread Dave Airlie
On Mon, Mar 18, 2013 at 7:40 AM, Chris Wilson ch...@chris-wilson.co.uk wrote: On Sun, Mar 17, 2013 at 08:50:03PM +0100, Daniel Vetter wrote: On Sat, Mar 16, 2013 at 11:19 AM, Chris Wilson ch...@chris-wilson.co.uk wrote: If *userspace* doesn't request either IOC_IN | IOC_OUT in their ioctl

Re: [Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-17 Thread Dave Jones
On Sun, Mar 17, 2013 at 08:50:03PM +0100, Daniel Vetter wrote: Doesn't that mean that we need these checks everywhere? Or at least a fixup in drm core proper? And I think we need to add trinity to our test setup eventually ;-) Note that trinity's ioctl fuzzing is still very new (added

[Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-16 Thread Chris Wilson
On Fri, Mar 15, 2013 at 04:49:42PM -0700, Ben Widawsky wrote: > On Fri, Mar 15, 2013 at 10:06:19PM +, Chris Wilson wrote: > > On Fri, Mar 15, 2013 at 09:36:07AM -0700, Ben Widawsky wrote: > > > On Fri, Mar 15, 2013 at 08:24:03AM +, Chris Wilson wrote: > > > > That's what I thought too.

Re: [Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-16 Thread Chris Wilson
On Fri, Mar 15, 2013 at 04:49:42PM -0700, Ben Widawsky wrote: On Fri, Mar 15, 2013 at 10:06:19PM +, Chris Wilson wrote: On Fri, Mar 15, 2013 at 09:36:07AM -0700, Ben Widawsky wrote: On Fri, Mar 15, 2013 at 08:24:03AM +, Chris Wilson wrote: That's what I thought too. Looking at

[Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-15 Thread Chris Wilson
On Fri, Mar 15, 2013 at 09:36:07AM -0700, Ben Widawsky wrote: > On Fri, Mar 15, 2013 at 08:24:03AM +, Chris Wilson wrote: > > That's what I thought too. Looking at the stack trace, the empirical > > evidence is that we need the check. > > -Chris > > I think we need to investigate the issue

[Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-15 Thread Ben Widawsky
On Fri, Mar 15, 2013 at 10:06:19PM +, Chris Wilson wrote: > On Fri, Mar 15, 2013 at 09:36:07AM -0700, Ben Widawsky wrote: > > On Fri, Mar 15, 2013 at 08:24:03AM +, Chris Wilson wrote: > > > That's what I thought too. Looking at the stack trace, the empirical > > > evidence is that we need

[Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-15 Thread Ben Widawsky
On Fri, Mar 15, 2013 at 08:24:03AM +, Chris Wilson wrote: > On Thu, Mar 14, 2013 at 09:50:04PM -0700, Ben Widawsky wrote: > > On Thu, Mar 14, 2013 at 12:59:57PM +, Chris Wilson wrote: > > > In order to prevent a potential NULL deference with hostile userspace, > > > we need to check

[Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-15 Thread Chris Wilson
On Thu, Mar 14, 2013 at 09:50:04PM -0700, Ben Widawsky wrote: > On Thu, Mar 14, 2013 at 12:59:57PM +, Chris Wilson wrote: > > In order to prevent a potential NULL deference with hostile userspace, > > we need to check whether the ioctl was passed an invalid args pointer. > > > > Reported-by:

Re: [Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-15 Thread Ben Widawsky
On Thu, Mar 14, 2013 at 12:59:57PM +, Chris Wilson wrote: In order to prevent a potential NULL deference with hostile userspace, we need to check whether the ioctl was passed an invalid args pointer. Reported-by: Tommi Rantala tt.rant...@gmail.com Link:

Re: [Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-15 Thread Ben Widawsky
On Thu, Mar 14, 2013 at 12:59:57PM +, Chris Wilson wrote: In order to prevent a potential NULL deference with hostile userspace, we need to check whether the ioctl was passed an invalid args pointer. Reported-by: Tommi Rantala tt.rant...@gmail.com Link:

Re: [Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-15 Thread Chris Wilson
On Thu, Mar 14, 2013 at 09:50:04PM -0700, Ben Widawsky wrote: On Thu, Mar 14, 2013 at 12:59:57PM +, Chris Wilson wrote: In order to prevent a potential NULL deference with hostile userspace, we need to check whether the ioctl was passed an invalid args pointer. Reported-by: Tommi

Re: [Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-15 Thread Chris Wilson
On Fri, Mar 15, 2013 at 09:36:07AM -0700, Ben Widawsky wrote: On Fri, Mar 15, 2013 at 08:24:03AM +, Chris Wilson wrote: That's what I thought too. Looking at the stack trace, the empirical evidence is that we need the check. -Chris I think we need to investigate the issue more then,

Re: [Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-15 Thread Ben Widawsky
On Fri, Mar 15, 2013 at 10:06:19PM +, Chris Wilson wrote: On Fri, Mar 15, 2013 at 09:36:07AM -0700, Ben Widawsky wrote: On Fri, Mar 15, 2013 at 08:24:03AM +, Chris Wilson wrote: That's what I thought too. Looking at the stack trace, the empirical evidence is that we need the

[Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-14 Thread Ben Widawsky
On Thu, Mar 14, 2013 at 12:59:57PM +, Chris Wilson wrote: > In order to prevent a potential NULL deference with hostile userspace, > we need to check whether the ioctl was passed an invalid args pointer. > > Reported-by: Tommi Rantala > Link: >

[Intel-gfx] [PATCH] drm/i915: Sanity check incoming ioctl data for a NULL pointer

2013-03-14 Thread Ben Widawsky
On Thu, Mar 14, 2013 at 12:59:57PM +, Chris Wilson wrote: > In order to prevent a potential NULL deference with hostile userspace, > we need to check whether the ioctl was passed an invalid args pointer. > > Reported-by: Tommi Rantala > Link: >