Received: by 2002:a05:6a10:9848:0:0:0:0 with SMTP id x8csp3517573pxf; Mon, 15 Mar 2021 11:18:23 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyXtOspNPvMIyq00G42S1+bhAAWdbXjTNw0Yn+Qv71DrhpFsemEE4y2QliGPnlNE9WTMAfI X-Received: by 2002:aa7:c815:: with SMTP id a21mr31888443edt.38.1615832303500; Mon, 15 Mar 2021 11:18:23 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1615832303; cv=none; d=google.com; s=arc-20160816; b=WNHIH7dza3udOemPAINzNRSxcPF3n4hcpV3rofSX0dkVQTJggCJCrPpCsw812IhG1N d+W8lR0DgLL53zMBgAXGEiYn6lKSSNDvHIkZ6yJRfSufbriKxYyqFfC08i3xEtBeB6MU djKvGTF/9CEa+8sL3LUWYsNeVRlOwmFqgoxh0XLKTHrwIvjY7ufmtN8HSwmg5/o2Eux0 2o32Ra25j5tHacWioqO2lyCphCvUFKkFU/8m/ZglvnKqsgemPvmhxUqfEyj04adifgfv gtxuTT7omG4pC4Mqjn0IObql/nu6ZHKhnDbWR6BBReLq4GwNscTnk2CH7JI/HXekHPTr j3qw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=ghcjVMPxpWaC7ot6KQtMX5psEuAyzW91Wnv90jhIysw=; b=KncyU7K7oP2JAwwchbzUSN+SOwn5pwRVYWRBMNNMrzKy/c6OA/L0obxQzV4NQ5zLlU Y43KQENatNnvcQM1G011HDC/oLlo0M4dzrQ3jM170gISvNsXtAXq0T4zt3uyz7S1JcEL 7vXh9NW3O9+UjbZ0PUTP1I3qmEgDtIyN7rdCI8EnkiYJmx3HX43jLaCVxaiPL/HGFlEc aGiR4KE4gyc4IHEoMr5zi/UA/ve1yeYp9V5W0k+g9gxShxVAuUsebWjinX+ssFMcWb7V nK04Uij110iV7OVSNzsd/s8/zO6LunStE2JSfdoE6ECoNTx45DMe1TrrqfI4K6z03b0d lV8g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Yfg5hqE7; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id gz11si11558637ejc.745.2021.03.15.11.18.00; Mon, 15 Mar 2021 11:18:23 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=Yfg5hqE7; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236664AbhCOOQr (ORCPT + 99 others); Mon, 15 Mar 2021 10:16:47 -0400 Received: from mail.kernel.org ([198.145.29.99]:35446 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232618AbhCON7R (ORCPT ); Mon, 15 Mar 2021 09:59:17 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 8FAC164EEE; Mon, 15 Mar 2021 13:58:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1615816739; bh=gRKwgZktH4u+F9jk1fBKe/Bz8H5BM0x3BycRYvJZzgM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Yfg5hqE7hPf3K1guV40oEe0RnnZAw9flcwWzlEbBvQvm0laQINKD+tbuzwPoa1GEa 3kiRwfvguSCn4u+K5Y3UwySsulcgwxgI5UPck1mEYUg7v6CFsQiWt5QdJdIAUJzpp6 UljhRTIO1rhD4Hr8xgKCTN9jNSyNeD99s+eCSLf4= From: gregkh@linuxfoundation.org To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maxime Ripard , syzbot+620cf21140fc7e772a5d@syzkaller.appspotmail.com, Daniel Vetter , Maarten Lankhorst Subject: [PATCH 5.11 095/306] drm/compat: Clear bounce structures Date: Mon, 15 Mar 2021 14:52:38 +0100 Message-Id: <20210315135510.870783622@linuxfoundation.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210315135507.611436477@linuxfoundation.org> References: <20210315135507.611436477@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Greg Kroah-Hartman From: Daniel Vetter commit de066e116306baf3a6a62691ac63cfc0b1dabddb upstream. Some of them have gaps, or fields we don't clear. Native ioctl code does full copies plus zero-extends on size mismatch, so nothing can leak. But compat is more hand-rolled so need to be careful. None of these matter for performance, so just memset. Also I didn't fix up the CONFIG_DRM_LEGACY or CONFIG_DRM_AGP ioctl, those are security holes anyway. Acked-by: Maxime Ripard Reported-by: syzbot+620cf21140fc7e772a5d@syzkaller.appspotmail.com # vblank ioctl Cc: syzbot+620cf21140fc7e772a5d@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20210222100643.400935-1-daniel.vetter@ffwll.ch (cherry picked from commit e926c474ebee404441c838d18224cd6f246a71b7) Signed-off-by: Maarten Lankhorst Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/drm_ioc32.c | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/drivers/gpu/drm/drm_ioc32.c +++ b/drivers/gpu/drm/drm_ioc32.c @@ -99,6 +99,8 @@ static int compat_drm_version(struct fil if (copy_from_user(&v32, (void __user *)arg, sizeof(v32))) return -EFAULT; + memset(&v, 0, sizeof(v)); + v = (struct drm_version) { .name_len = v32.name_len, .name = compat_ptr(v32.name), @@ -137,6 +139,9 @@ static int compat_drm_getunique(struct f if (copy_from_user(&uq32, (void __user *)arg, sizeof(uq32))) return -EFAULT; + + memset(&uq, 0, sizeof(uq)); + uq = (struct drm_unique){ .unique_len = uq32.unique_len, .unique = compat_ptr(uq32.unique), @@ -265,6 +270,8 @@ static int compat_drm_getclient(struct f if (copy_from_user(&c32, argp, sizeof(c32))) return -EFAULT; + memset(&client, 0, sizeof(client)); + client.idx = c32.idx; err = drm_ioctl_kernel(file, drm_getclient, &client, 0); @@ -852,6 +859,8 @@ static int compat_drm_wait_vblank(struct if (copy_from_user(&req32, argp, sizeof(req32))) return -EFAULT; + memset(&req, 0, sizeof(req)); + req.request.type = req32.request.type; req.request.sequence = req32.request.sequence; req.request.signal = req32.request.signal; @@ -889,6 +898,8 @@ static int compat_drm_mode_addfb2(struct struct drm_mode_fb_cmd2 req64; int err; + memset(&req64, 0, sizeof(req64)); + if (copy_from_user(&req64, argp, offsetof(drm_mode_fb_cmd232_t, modifier))) return -EFAULT;