[PATCH] drm: Prevent overwriting from userspace underallocating core ioctl structs

[Ville Syrjälä]

On Wed, Oct 16, 2013 at 11:22:44AM +0100, Chris Wilson wrote:
> Apply the protections from
> 
> commit 1b2f1489633888d4a06028315dc19d65768a1c05
> Author: Dave Airlie <airlied at redhat.com>
> Date:   Sat Aug 14 20:20:34 2010 +1000
> 
>     drm: block userspace under allocating buffer and having drivers overwrite it (v2)
> 
> to the core ioctl structs as well, for we found one instance where there
> is a 32-/64-bit size mismatch and were guilty of writing beyond the end
> of the user's buffer.
> 
> Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
> Cc: Dave Airlie <airlied at redhat.com>
> Cc: Ville Syrjälä <ville.syrjala at linux.intel.com>
> Cc: dri-devel at lists.freedesktop.org
> Cc: stable at vger.kernel.org

Looks good.

Reviewed-by: Ville Syrjälä <ville.syrjala at linux.intel.com>

> ---
>  drivers/gpu/drm/drm_drv.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
> index e572dd20bdee..05ad9ba0a67e 100644
> --- a/drivers/gpu/drm/drm_drv.c
> +++ b/drivers/gpu/drm/drm_drv.c
> @@ -402,9 +402,16 @@ long drm_ioctl(struct file *filp,
>  		cmd = ioctl->cmd_drv;
>  	}
>  	else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) {
> +		u32 drv_size;
> +
>  		ioctl = &drm_ioctls[nr];
> -		cmd = ioctl->cmd;
> +
> +		drv_size = _IOC_SIZE(ioctl->cmd);
>  		usize = asize = _IOC_SIZE(cmd);
> +		if (drv_size > asize)
> +			asize = drv_size;
> +
> +		cmd = ioctl->cmd;
>  	} else
>  		goto err_i1;
>  
> -- 
> 1.8.4.rc3

-- 
Ville Syrjälä
Intel OTC