From: Loic <hackurx@opensec.fr>
To: stable@vger.kernel.org
Cc: matthew.auld@intel.com
Subject: [PATCH] drm/i915/userptr: reject zero user_size
Date: Sun, 02 Sep 2018 23:55:52 +0200 [thread overview]
Message-ID: <96064ba53fbbc69be28c7e7116eaa398@opensec.fr> (raw)
Hello,
Tested without any problem so please picked up this.
From: Matthew Auld
[ Upstream commit c11c7bfd213495784b22ef82a69b6489f8d0092f ]
Operating on a zero sized GEM userptr object will lead to explosions.
Fixes: 5cc9ed4b9a7a ("drm/i915: Introduce mapping of user pages into
video memory (userptr) ioctl")
Testcase: igt/gem_userptr_blits/input-checking
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Link:
https://patchwork.freedesktop.org/patch/msgid/20180502195021.30900-1-matthew.auld@intel.com
---
drivers/gpu/drm/i915/i915_gem_userptr.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/i915/i915_gem_userptr.c
b/drivers/gpu/drm/i915/i915_gem_userptr.c
index d596a8302ca3c..854bd51b9478a 100644
--- a/drivers/gpu/drm/i915/i915_gem_userptr.c
+++ b/drivers/gpu/drm/i915/i915_gem_userptr.c
@@ -778,6 +778,9 @@ i915_gem_userptr_ioctl(struct drm_device *dev,
I915_USERPTR_UNSYNCHRONIZED))
return -EINVAL;
+ if (!args->user_size)
+ return -EINVAL;
+
if (offset_in_page(args->user_ptr | args->user_size))
return -EINVAL;
--
2.17.1
next reply other threads:[~2018-09-03 2:19 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-02 21:55 Loic [this message]
2018-09-03 16:17 ` [PATCH] drm/i915/userptr: reject zero user_size Greg KH
2018-09-03 19:56 ` Loic
2018-09-07 9:01 ` Greg KH
-- strict thread matches above, loose matches on Subject: below --
2018-05-02 18:16 Matthew Auld
2018-05-02 18:45 ` Chris Wilson
2018-05-02 18:53 ` Chris Wilson
2018-05-02 19:50 ` Matthew Auld
2018-05-08 11:25 ` Chris Wilson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=96064ba53fbbc69be28c7e7116eaa398@opensec.fr \
--to=hackurx@opensec.fr \
--cc=matthew.auld@intel.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.