• Eric Anholt's avatar
    drm/vc4: Fix an integer overflow in temporary allocation layout. · 0f2ff82e
    Eric Anholt authored
    We copy the unvalidated ioctl arguments from the user into kernel
    temporary memory to run the validation from, to avoid a race where the
    user updates the unvalidate contents in between validating them and
    copying them into the validated BO.
    
    However, in setting up the layout of the kernel side, we failed to
    check one of the additions (the roundup() for shader_rec_offset)
    against integer overflow, allowing a nearly MAX_UINT value of
    bin_cl_size to cause us to under-allocate the temporary space that we
    then copy_from_user into.
    Reported-by: default avatarMurray McAllister <murray.mcallister@insomniasec.com>
    Signed-off-by: default avatarEric Anholt <eric@anholt.net>
    Fixes: d5b1a78a ("drm/vc4: Add support for drawing 3D frames.")
    0f2ff82e
vc4_gem.c 23.2 KB