Messages in this thread Patch in this message | | | Date | Thu, 13 Jul 2017 10:20:20 +0800 | From | jeffy <> | Subject | Re: drm: Add missing field copy in compat_drm_version |
| |
Hi guys,
i was testing this on arm64 base chromeos(with arm32 userspace).
and the libdrm crashed: drmVersionPtr drmGetVersion(int fd) { ... memclear(*version);
if (drmIoctl(fd, DRM_IOCTL_VERSION, version)) { ... if (version->name_len) version->name = drmMalloc(version->name_len + 1); <-- rely on the lengths updated by kernel if (version->date_len) version->date = drmMalloc(version->date_len + 1); if (version->desc_len) version->desc = drmMalloc(version->desc_len + 1); ... if (version->name_len) version->name[version->name_len] = '\0'; <-- crashed here, since the name_len would always be zero, so version->name would be nullptr.
On 07/12/2017 02:18 PM, Jeffy Chen wrote: > DRM_IOCTL_VERSION is supposed to update the name_len/date_len/desc_len > fields to user. > > Fixes: 012c6741c6aa("switch compat_drm_version() to drm_ioctl_kernel()") > Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com> > --- > > drivers/gpu/drm/drm_ioc32.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c > index 94acf51..2789356 100644 > --- a/drivers/gpu/drm/drm_ioc32.c > +++ b/drivers/gpu/drm/drm_ioc32.c > @@ -112,6 +112,9 @@ static int compat_drm_version(struct file *file, unsigned int cmd, > v32.version_major = v.version_major; > v32.version_minor = v.version_minor; > v32.version_patchlevel = v.version_patchlevel; > + v32.name_len = v.name_len; > + v32.date_len = v.date_len; > + v32.desc_len = v.desc_len; > if (copy_to_user((void __user *)arg, &v32, sizeof(v32))) > return -EFAULT; > return 0; > >
| |