DRM_IOCTL_VERSION is supposed to update the name_len/date_len/desc_len
fields to user.
Fixes: 012c6741c6aa("switch compat_drm_version() to drm_ioctl_kernel()")
Signed-off-by: Jeffy Chen <[email protected]>
---
drivers/gpu/drm/drm_ioc32.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
index 94acf51..2789356 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -112,6 +112,9 @@ static int compat_drm_version(struct file *file, unsigned int cmd,
v32.version_major = v.version_major;
v32.version_minor = v.version_minor;
v32.version_patchlevel = v.version_patchlevel;
+ v32.name_len = v.name_len;
+ v32.date_len = v.date_len;
+ v32.desc_len = v.desc_len;
if (copy_to_user((void __user *)arg, &v32, sizeof(v32)))
return -EFAULT;
return 0;
--
2.1.4
Hi guys,
i was testing this on arm64 base chromeos(with arm32 userspace).
and the libdrm crashed:
drmVersionPtr drmGetVersion(int fd)
{
...
memclear(*version);
if (drmIoctl(fd, DRM_IOCTL_VERSION, version)) {
...
if (version->name_len)
version->name = drmMalloc(version->name_len + 1); <--
rely on the lengths updated by kernel
if (version->date_len)
version->date = drmMalloc(version->date_len + 1);
if (version->desc_len)
version->desc = drmMalloc(version->desc_len + 1);
...
if (version->name_len) version->name[version->name_len] = '\0';
<-- crashed here, since the name_len would always be zero, so
version->name would be nullptr.
On 07/12/2017 02:18 PM, Jeffy Chen wrote:
> DRM_IOCTL_VERSION is supposed to update the name_len/date_len/desc_len
> fields to user.
>
> Fixes: 012c6741c6aa("switch compat_drm_version() to drm_ioctl_kernel()")
> Signed-off-by: Jeffy Chen <[email protected]>
> ---
>
> drivers/gpu/drm/drm_ioc32.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
> index 94acf51..2789356 100644
> --- a/drivers/gpu/drm/drm_ioc32.c
> +++ b/drivers/gpu/drm/drm_ioc32.c
> @@ -112,6 +112,9 @@ static int compat_drm_version(struct file *file, unsigned int cmd,
> v32.version_major = v.version_major;
> v32.version_minor = v.version_minor;
> v32.version_patchlevel = v.version_patchlevel;
> + v32.name_len = v.name_len;
> + v32.date_len = v.date_len;
> + v32.desc_len = v.desc_len;
> if (copy_to_user((void __user *)arg, &v32, sizeof(v32)))
> return -EFAULT;
> return 0;
>
>
On Wed, Jul 12, 2017 at 02:18:32PM +0800, Jeffy Chen wrote:
> DRM_IOCTL_VERSION is supposed to update the name_len/date_len/desc_len
> fields to user.
>
> Fixes: 012c6741c6aa("switch compat_drm_version() to drm_ioctl_kernel()")
> Signed-off-by: Jeffy Chen <[email protected]>
Reviewed-by: Daniel Vetter <[email protected]>
Linus, since Dave is a bit out with flu and this bug only exists in your
tree (not yet in drm-next), can you pls apply this directly? It's a fumble
in Al's rework. Direct mbox link from patchwork, in case you don't have
that in your archives anywhere:
https://patchwork.freedesktop.org/patch/166318/mbox/
Thanks, Daniel
>
> ---
>
> drivers/gpu/drm/drm_ioc32.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
> index 94acf51..2789356 100644
> --- a/drivers/gpu/drm/drm_ioc32.c
> +++ b/drivers/gpu/drm/drm_ioc32.c
> @@ -112,6 +112,9 @@ static int compat_drm_version(struct file *file, unsigned int cmd,
> v32.version_major = v.version_major;
> v32.version_minor = v.version_minor;
> v32.version_patchlevel = v.version_patchlevel;
> + v32.name_len = v.name_len;
> + v32.date_len = v.date_len;
> + v32.desc_len = v.desc_len;
> if (copy_to_user((void __user *)arg, &v32, sizeof(v32)))
> return -EFAULT;
> return 0;
> --
> 2.1.4
>
>
> _______________________________________________
> dri-devel mailing list
> [email protected]
> https://lists.freedesktop.org/mailman/listinfo/dri-devel
--
Daniel Vetter
Software Engineer, Intel Corporation
http://blog.ffwll.ch
On Thu, Jul 13, 2017 at 02:36:55PM +0200, Daniel Vetter wrote:
> On Wed, Jul 12, 2017 at 02:18:32PM +0800, Jeffy Chen wrote:
> > DRM_IOCTL_VERSION is supposed to update the name_len/date_len/desc_len
> > fields to user.
> >
> > Fixes: 012c6741c6aa("switch compat_drm_version() to drm_ioctl_kernel()")
> > Signed-off-by: Jeffy Chen <[email protected]>
>
> Reviewed-by: Daniel Vetter <[email protected]>
>
> Linus, since Dave is a bit out with flu and this bug only exists in your
> tree (not yet in drm-next), can you pls apply this directly? It's a fumble
> in Al's rework. Direct mbox link from patchwork, in case you don't have
> that in your archives anywhere:
(Belated) ACKed-by: Al Viro <[email protected]>