lkml.org 
[lkml]   [2010]   [Oct]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[062/103] drm/i915: Sanity check pread/pwrite
2.6.35-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Chris Wilson <chris@chris-wilson.co.uk>

commit ce9d419dbecc292cc3e06e8b1d6d123d3fa813a4 upstream.

Move the access control up from the fast paths, which are no longer
universally taken first, up into the caller. This then duplicates some
sanity checking along the slow paths, but is much simpler.
Tracked as CVE-2010-2962.

Reported-by: Kees Cook <kees@ubuntu.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
drivers/gpu/drm/i915/i915_gem.c | 28 ++++++++++++++++++++--------
1 file changed, 20 insertions(+), 8 deletions(-)

--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -465,8 +465,15 @@ i915_gem_pread_ioctl(struct drm_device *
*/
if (args->offset > obj->size || args->size > obj->size ||
args->offset + args->size > obj->size) {
- drm_gem_object_unreference_unlocked(obj);
- return -EINVAL;
+ ret = -EINVAL;
+ goto err;
+ }
+
+ if (!access_ok(VERIFY_WRITE,
+ (char __user *)(uintptr_t)args->data_ptr,
+ args->size)) {
+ ret = -EFAULT;
+ goto err;
}

if (i915_gem_object_needs_bit17_swizzle(obj)) {
@@ -478,8 +485,8 @@ i915_gem_pread_ioctl(struct drm_device *
file_priv);
}

+err:
drm_gem_object_unreference_unlocked(obj);
-
return ret;
}

@@ -568,8 +575,6 @@ i915_gem_gtt_pwrite_fast(struct drm_devi

user_data = (char __user *) (uintptr_t) args->data_ptr;
remain = args->size;
- if (!access_ok(VERIFY_READ, user_data, remain))
- return -EFAULT;


mutex_lock(&dev->struct_mutex);
@@ -928,8 +933,15 @@ i915_gem_pwrite_ioctl(struct drm_device
*/
if (args->offset > obj->size || args->size > obj->size ||
args->offset + args->size > obj->size) {
- drm_gem_object_unreference_unlocked(obj);
- return -EINVAL;
+ ret = -EINVAL;
+ goto err;
+ }
+
+ if (!access_ok(VERIFY_READ,
+ (char __user *)(uintptr_t)args->data_ptr,
+ args->size)) {
+ ret = -EFAULT;
+ goto err;
}

/* We can only do the GTT pwrite on untiled buffers, as otherwise
@@ -963,8 +975,8 @@ i915_gem_pwrite_ioctl(struct drm_device
DRM_INFO("pwrite failed %d\n", ret);
#endif

+err:
drm_gem_object_unreference_unlocked(obj);
-
return ret;
}




\
 
 \ /
  Last update: 2010-10-22 21:11    [W:0.208 / U:28.020 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site