Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-18 03:06:43 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'vmwgfx-fixes-3.15' of git://people.freedesktop.org/~thomash/linux into drm-next

Browse Source 
single security fix, cc'd stable.

* 'vmwgfx-fixes-3.15' of git://people.freedesktop.org/~thomash/linux:
  drm/vmwgfx: Make sure user-space can't DMA across buffer object boundaries v2
This commit is contained in:
Dave Airlie 2014-04-30 09:43:43 +10:00
commit d8af20bcae
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
View File

@ -1214,14 +1214,36 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
SVGA3dCmdSurfaceDMA dma; SVGA3dCmdSurfaceDMA dma;
} *cmd; } *cmd;
int ret; int ret;
SVGA3dCmdSurfaceDMASuffix *suffix;
uint32_t bo_size;
cmd = container_of(header, struct vmw_dma_cmd, header); cmd = container_of(header, struct vmw_dma_cmd, header);
suffix = (SVGA3dCmdSurfaceDMASuffix *)((unsigned long) &cmd->dma +
header->size - sizeof(*suffix));
/* Make sure device and verifier stays in sync. */
if (unlikely(suffix->suffixSize != sizeof(*suffix))) {
DRM_ERROR("Invalid DMA suffix size.\n");
return -EINVAL;
}
ret = vmw_translate_guest_ptr(dev_priv, sw_context, ret = vmw_translate_guest_ptr(dev_priv, sw_context,
&cmd->dma.guest.ptr, &cmd->dma.guest.ptr,
&vmw_bo); &vmw_bo);
if (unlikely(ret != 0)) if (unlikely(ret != 0))
return ret; return ret;
/* Make sure DMA doesn't cross BO boundaries. */
bo_size = vmw_bo->base.num_pages * PAGE_SIZE;
if (unlikely(cmd->dma.guest.ptr.offset > bo_size)) {
DRM_ERROR("Invalid DMA offset.\n");
return -EINVAL;
}
bo_size -= cmd->dma.guest.ptr.offset;
if (unlikely(suffix->maximumOffset > bo_size))
suffix->maximumOffset = bo_size;
ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
user_surface_converter, &cmd->dma.host.sid, user_surface_converter, &cmd->dma.host.sid,
NULL); NULL);