On Wed, Oct 16, 2013 at 11:22:44AM +0100, Chris Wilson wrote: > Apply the protections from > > commit 1b2f1489633888d4a06028315dc19d65768a1c05 > Author: Dave Airlie <[email protected]> > Date: Sat Aug 14 20:20:34 2010 +1000 > > drm: block userspace under allocating buffer and having drivers overwrite > it (v2) > > to the core ioctl structs as well, for we found one instance where there > is a 32-/64-bit size mismatch and were guilty of writing beyond the end > of the user's buffer. > > Signed-off-by: Chris Wilson <[email protected]> > Cc: Dave Airlie <[email protected]> > Cc: Ville Syrjälä <[email protected]> > Cc: [email protected] > Cc: [email protected]
Looks good. Reviewed-by: Ville Syrjälä <[email protected]> > --- > drivers/gpu/drm/drm_drv.c | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c > index e572dd20bdee..05ad9ba0a67e 100644 > --- a/drivers/gpu/drm/drm_drv.c > +++ b/drivers/gpu/drm/drm_drv.c > @@ -402,9 +402,16 @@ long drm_ioctl(struct file *filp, > cmd = ioctl->cmd_drv; > } > else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) { > + u32 drv_size; > + > ioctl = &drm_ioctls[nr]; > - cmd = ioctl->cmd; > + > + drv_size = _IOC_SIZE(ioctl->cmd); > usize = asize = _IOC_SIZE(cmd); > + if (drv_size > asize) > + asize = drv_size; > + > + cmd = ioctl->cmd; > } else > goto err_i1; > > -- > 1.8.4.rc3 -- Ville Syrjälä Intel OTC -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html
