[PATCH 01/12] drm/v3d: Prevent out of bounds access in performance query extensions
Maíra Canal
mcanal at igalia.com
Wed Jul 10 16:39:14 UTC 2024
On 7/10/24 10:41, Tvrtko Ursulin wrote:
> From: Tvrtko Ursulin <tvrtko.ursulin at igalia.com>
>
> Check that the number of perfmons userspace is passing in the copy and
> reset extensions is not greater than the internal kernel storage where
> the ids will be copied into.
>
> Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin at igalia.com>
Reviewed-by: Maíra Canal <mcanal at igalia.com>
Best Regards,
- Maíra
> Fixes: bae7cb5d6800 ("drm/v3d: Create a CPU job extension for the reset performance query job"
> Cc: Maíra Canal <mcanal at igalia.com>
> Cc: Iago Toral Quiroga <itoral at igalia.com>
> Cc: <stable at vger.kernel.org> # v6.8+
> ---
> drivers/gpu/drm/v3d/v3d_submit.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/gpu/drm/v3d/v3d_submit.c b/drivers/gpu/drm/v3d/v3d_submit.c
> index 88f63d526b22..263fefc1d04f 100644
> --- a/drivers/gpu/drm/v3d/v3d_submit.c
> +++ b/drivers/gpu/drm/v3d/v3d_submit.c
> @@ -637,6 +637,9 @@ v3d_get_cpu_reset_performance_params(struct drm_file *file_priv,
> if (copy_from_user(&reset, ext, sizeof(reset)))
> return -EFAULT;
>
> + if (reset.nperfmons > V3D_MAX_PERFMONS)
> + return -EINVAL;
> +
> job->job_type = V3D_CPU_JOB_TYPE_RESET_PERFORMANCE_QUERY;
>
> job->performance_query.queries = kvmalloc_array(reset.count,
> @@ -708,6 +711,9 @@ v3d_get_cpu_copy_performance_query_params(struct drm_file *file_priv,
> if (copy.pad)
> return -EINVAL;
>
> + if (copy.nperfmons > V3D_MAX_PERFMONS)
> + return -EINVAL;
> +
> job->job_type = V3D_CPU_JOB_TYPE_COPY_PERFORMANCE_QUERY;
>
> job->performance_query.queries = kvmalloc_array(copy.count,
More information about the dri-devel
mailing list