From: davidriley@chromium.org To: dri-devel@lists.freedesktop.org, virtualization@lists.linux-foundation.org Cc: David Airlie <airlied@linux.ie>, Gerd Hoffmann <kraxel@redhat.com>, Daniel Vetter <daniel@ffwll.ch>, linux-kernel@vger.kernel.org, David Riley <davidriley@chromium.org> Subject: [PATCH 1/4] drm/virtio: Ensure cached capset entries are valid before copying. Date: Wed, 5 Jun 2019 16:44:20 -0700 [thread overview] Message-ID: <20190605234423.11348-1-davidriley@chromium.org> (raw) From: David Riley <davidriley@chromium.org> virtio_gpu_get_caps_ioctl could return success with invalid data if a second caller to the function occurred after the entry was created in virtio_gpu_cmd_get_capset but prior to the virtio_gpu_cmd_capset_cb callback being called. This could leak contents of memory as well since the caps_cache allocation is done without zeroing. Signed-off-by: David Riley <davidriley@chromium.org> --- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c index 949a264985fc..88c1ed57a3c5 100644 --- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c +++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c @@ -526,7 +526,6 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev, list_for_each_entry(cache_ent, &vgdev->cap_cache, head) { if (cache_ent->id == args->cap_set_id && cache_ent->version == args->cap_set_ver) { - ptr = cache_ent->caps_cache; spin_unlock(&vgdev->display_info_lock); goto copy_exit; } @@ -537,6 +536,7 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev, virtio_gpu_cmd_get_capset(vgdev, found_valid, args->cap_set_ver, &cache_ent); +copy_exit: ret = wait_event_timeout(vgdev->resp_wq, atomic_read(&cache_ent->is_valid), 5 * HZ); if (!ret) @@ -544,7 +544,6 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev, ptr = cache_ent->caps_cache; -copy_exit: if (copy_to_user((void __user *)(unsigned long)args->addr, ptr, size)) return -EFAULT; -- 2.22.0.rc1.311.g5d7573a151-goog
WARNING: multiple messages have this Message-ID (diff)
From: davidriley@chromium.org To: dri-devel@lists.freedesktop.org, virtualization@lists.linux-foundation.org Cc: David Airlie <airlied@linux.ie>, Gerd Hoffmann <kraxel@redhat.com>, linux-kernel@vger.kernel.org Subject: [PATCH 1/4] drm/virtio: Ensure cached capset entries are valid before copying. Date: Wed, 5 Jun 2019 16:44:20 -0700 [thread overview] Message-ID: <20190605234423.11348-1-davidriley@chromium.org> (raw) From: David Riley <davidriley@chromium.org> virtio_gpu_get_caps_ioctl could return success with invalid data if a second caller to the function occurred after the entry was created in virtio_gpu_cmd_get_capset but prior to the virtio_gpu_cmd_capset_cb callback being called. This could leak contents of memory as well since the caps_cache allocation is done without zeroing. Signed-off-by: David Riley <davidriley@chromium.org> --- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c index 949a264985fc..88c1ed57a3c5 100644 --- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c +++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c @@ -526,7 +526,6 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev, list_for_each_entry(cache_ent, &vgdev->cap_cache, head) { if (cache_ent->id == args->cap_set_id && cache_ent->version == args->cap_set_ver) { - ptr = cache_ent->caps_cache; spin_unlock(&vgdev->display_info_lock); goto copy_exit; } @@ -537,6 +536,7 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev, virtio_gpu_cmd_get_capset(vgdev, found_valid, args->cap_set_ver, &cache_ent); +copy_exit: ret = wait_event_timeout(vgdev->resp_wq, atomic_read(&cache_ent->is_valid), 5 * HZ); if (!ret) @@ -544,7 +544,6 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev, ptr = cache_ent->caps_cache; -copy_exit: if (copy_to_user((void __user *)(unsigned long)args->addr, ptr, size)) return -EFAULT; -- 2.22.0.rc1.311.g5d7573a151-goog _______________________________________________ dri-devel mailing list dri-devel@lists.freedesktop.org https://lists.freedesktop.org/mailman/listinfo/dri-devel
next reply other threads:[~2019-06-05 23:44 UTC|newest] Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-06-05 23:44 davidriley [this message] 2019-06-05 23:44 ` [PATCH 1/4] drm/virtio: Ensure cached capset entries are valid before copying davidriley 2019-06-05 23:44 ` [PATCH 2/4] drm/virtio: Wake up all waiters when capset response comes in davidriley 2019-06-05 23:44 ` davidriley 2019-06-05 23:44 ` [PATCH 3/4] drm/virtio: Fix cache entry creation race davidriley 2019-06-05 23:44 ` davidriley 2019-06-05 23:44 ` [PATCH 4/4] drm/virtio: Add memory barriers for capset cache davidriley 2019-06-05 23:44 ` davidriley 2019-06-06 7:41 ` Gerd Hoffmann 2019-06-06 7:41 ` Gerd Hoffmann 2019-06-05 23:44 ` davidriley 2019-06-10 21:18 ` [PATCH v2 0/4] drm/virtio: Ensure cached capset entries are valid before copying davidriley 2019-06-10 21:18 ` davidriley 2019-06-10 21:18 ` [PATCH v2 1/4] " davidriley 2019-06-10 21:18 ` davidriley 2019-06-10 21:18 ` [PATCH v2 2/4] drm/virtio: Wake up all waiters when capset response comes in davidriley 2019-06-10 21:18 ` davidriley 2019-06-10 21:18 ` [PATCH v2 3/4] drm/virtio: Fix cache entry creation race davidriley 2019-06-10 21:18 ` davidriley 2019-06-10 21:18 ` [PATCH v2 4/4] drm/virtio: Add memory barriers for capset cache davidriley 2019-06-13 6:59 ` Gerd Hoffmann 2019-06-13 6:59 ` Gerd Hoffmann 2019-06-13 6:59 ` Gerd Hoffmann 2019-06-10 21:18 ` davidriley -- strict thread matches above, loose matches on Subject: below -- 2019-06-05 23:44 [PATCH 1/4] drm/virtio: Ensure cached capset entries are valid before copying davidriley
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190605234423.11348-1-davidriley@chromium.org \ --to=davidriley@chromium.org \ --cc=airlied@linux.ie \ --cc=daniel@ffwll.ch \ --cc=dri-devel@lists.freedesktop.org \ --cc=kraxel@redhat.com \ --cc=linux-kernel@vger.kernel.org \ --cc=virtualization@lists.linux-foundation.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.