| Message ID | 20181107151811.28423-2-colin.king@canonical.com |
|---|---|
| State | New |
| Headers | show |
| Series | drm: fix NULL pointer access by wrong ioctl | expand |
On 07.11.18 16:18, Colin King wrote: > From: Colin Ian King <colin.king@canonical.com> > > BugLink: https://bugs.launchpad.net/bugs/1797546 > > If user uses wrong ioctl command with _IOC_NONE and argument size > greater than 0, it can cause NULL pointer access from memset of line > 463. If _IOC_NONE, don't memset to 0 for kdata. > > Signed-off-by: Zhaowei Yuan <zhaowei.yuan@samsung.com> > Reviewed-by: David Herrmann <dh.herrmann@gmail.com> > Cc: <stable@vger.kernel.org> > Signed-off-by: Dave Airlie <airlied@redhat.com> > (backported from commit 1539fb9bd405ee32282ea0a38404f9e008ac5b7a) > Signed-off-by: Colin Ian King <colin.king@canonical.com> Acked-by: Stefan Bader <stefan.bader@canonical.com> > --- > drivers/gpu/drm/drm_drv.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c > index d9137e4..ef65779 100644 > --- a/drivers/gpu/drm/drm_drv.c > +++ b/drivers/gpu/drm/drm_drv.c > @@ -383,8 +383,9 @@ long drm_ioctl(struct file *filp, > retcode = -EFAULT; > goto err_i1; > } > - } else > + } else if (cmd & IOC_OUT) { > memset(kdata, 0, usize); > + } > > if (ioctl->flags & DRM_UNLOCKED) > retcode = func(dev, kdata, file_priv); >
On 11/07/18 16:18, Colin King wrote: > From: Colin Ian King <colin.king@canonical.com> > > BugLink: https://bugs.launchpad.net/bugs/1797546 > > If user uses wrong ioctl command with _IOC_NONE and argument size > greater than 0, it can cause NULL pointer access from memset of line > 463. If _IOC_NONE, don't memset to 0 for kdata. > > Signed-off-by: Zhaowei Yuan <zhaowei.yuan@samsung.com> > Reviewed-by: David Herrmann <dh.herrmann@gmail.com> > Cc: <stable@vger.kernel.org> > Signed-off-by: Dave Airlie <airlied@redhat.com> > (backported from commit 1539fb9bd405ee32282ea0a38404f9e008ac5b7a) > Signed-off-by: Colin Ian King <colin.king@canonical.com> Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> > --- > drivers/gpu/drm/drm_drv.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c > index d9137e4..ef65779 100644 > --- a/drivers/gpu/drm/drm_drv.c > +++ b/drivers/gpu/drm/drm_drv.c > @@ -383,8 +383,9 @@ long drm_ioctl(struct file *filp, > retcode = -EFAULT; > goto err_i1; > } > - } else > + } else if (cmd & IOC_OUT) { > memset(kdata, 0, usize); > + } > > if (ioctl->flags & DRM_UNLOCKED) > retcode = func(dev, kdata, file_priv);
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c index d9137e4..ef65779 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -383,8 +383,9 @@ long drm_ioctl(struct file *filp, retcode = -EFAULT; goto err_i1; } - } else + } else if (cmd & IOC_OUT) { memset(kdata, 0, usize); + } if (ioctl->flags & DRM_UNLOCKED) retcode = func(dev, kdata, file_priv);