Re: [PATCH] drm/virtio: Fix capset-id query size

2022-02-15 Thread Gurchetan Singh
On Tue, Feb 15, 2022 at 5:15 PM Rob Clark  wrote:

> From: Rob Clark 
>
> The UABI was already defined for pointer to 64b value, and all the
> userspace users of this ioctl that I could find are already using a
> uint64_t (but zeroing it out to work around kernel only copying 32b).
> Unfortunately this ioctl doesn't have a length field, so out of paranoia
> I restricted the change to copy 64b to the single 64b param that can be
> queried.
>
> Fixes: 78aa20fa4381 ("drm/virtio: implement context init: advertise
> feature to userspace")
> Signed-off-by: Rob Clark 
>

Reviewed-by: Gurchetan Singh 


> ---
>  drivers/gpu/drm/virtio/virtgpu_ioctl.c | 16 
>  1 file changed, 12 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
> b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
> index 0f2f3f54dbf9..0158d27d5645 100644
> --- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
> +++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
> @@ -269,7 +269,8 @@ static int virtio_gpu_getparam_ioctl(struct drm_device
> *dev, void *data,
>  {
> struct virtio_gpu_device *vgdev = dev->dev_private;
> struct drm_virtgpu_getparam *param = data;
> -   int value;
> +   int value, ret, sz = sizeof(int);
> +   uint64_t value64;
>
> switch (param->param) {
> case VIRTGPU_PARAM_3D_FEATURES:
> @@ -291,13 +292,20 @@ static int virtio_gpu_getparam_ioctl(struct
> drm_device *dev, void *data,
> value = vgdev->has_context_init ? 1 : 0;
> break;
> case VIRTGPU_PARAM_SUPPORTED_CAPSET_IDs:
> -   value = vgdev->capset_id_mask;
> +   value64 = vgdev->capset_id_mask;
> +   sz = sizeof(value64);
> break;
> default:
> return -EINVAL;
> }
> -   if (copy_to_user(u64_to_user_ptr(param->value), ,
> sizeof(int)))
> -   return -EFAULT;
> +
> +   if (sz == sizeof(int)) {
> +   if (copy_to_user(u64_to_user_ptr(param->value), ,
> sz))
> +   return -EFAULT;
> +   } else {
> +   if (copy_to_user(u64_to_user_ptr(param->value), ,
> sz))
> +   return -EFAULT;
> +   }
>
> return 0;
>  }
> --
> 2.34.1
>
>
___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization

[PATCH] drm/virtio: Fix capset-id query size

2022-02-15 Thread Rob Clark
From: Rob Clark 

The UABI was already defined for pointer to 64b value, and all the
userspace users of this ioctl that I could find are already using a
uint64_t (but zeroing it out to work around kernel only copying 32b).
Unfortunately this ioctl doesn't have a length field, so out of paranoia
I restricted the change to copy 64b to the single 64b param that can be
queried.

Fixes: 78aa20fa4381 ("drm/virtio: implement context init: advertise feature to 
userspace")
Signed-off-by: Rob Clark 
---
 drivers/gpu/drm/virtio/virtgpu_ioctl.c | 16 
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c 
b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
index 0f2f3f54dbf9..0158d27d5645 100644
--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c
+++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c
@@ -269,7 +269,8 @@ static int virtio_gpu_getparam_ioctl(struct drm_device 
*dev, void *data,
 {
struct virtio_gpu_device *vgdev = dev->dev_private;
struct drm_virtgpu_getparam *param = data;
-   int value;
+   int value, ret, sz = sizeof(int);
+   uint64_t value64;
 
switch (param->param) {
case VIRTGPU_PARAM_3D_FEATURES:
@@ -291,13 +292,20 @@ static int virtio_gpu_getparam_ioctl(struct drm_device 
*dev, void *data,
value = vgdev->has_context_init ? 1 : 0;
break;
case VIRTGPU_PARAM_SUPPORTED_CAPSET_IDs:
-   value = vgdev->capset_id_mask;
+   value64 = vgdev->capset_id_mask;
+   sz = sizeof(value64);
break;
default:
return -EINVAL;
}
-   if (copy_to_user(u64_to_user_ptr(param->value), , sizeof(int)))
-   return -EFAULT;
+
+   if (sz == sizeof(int)) {
+   if (copy_to_user(u64_to_user_ptr(param->value), , sz))
+   return -EFAULT;
+   } else {
+   if (copy_to_user(u64_to_user_ptr(param->value), , sz))
+   return -EFAULT;
+   }
 
return 0;
 }
-- 
2.34.1

___
Virtualization mailing list
Virtualization@lists.linux-foundation.org
https://lists.linuxfoundation.org/mailman/listinfo/virtualization