diff options
| author | Zack Rusin <zack.rusin@broadcom.com> | 2024-01-10 23:03:05 +0300 |
|---|---|---|
| committer | Zack Rusin <zack.rusin@broadcom.com> | 2024-01-26 21:48:06 +0300 |
| commit | 517621b7060096e48e42f545fa6646fc00252eac (patch) | |
| tree | c4724f2cd5883d83de739fbaf0ba7881a4918980 /drivers/gpu/drm/ttm/ttm_tt.c | |
| parent | f3e17b42b28d2b71f54cfcf4530690bcbdaf23ed (diff) | |
| download | linux-517621b7060096e48e42f545fa6646fc00252eac.tar.xz | |
drm/vmwgfx: Fix possible null pointer derefence with invalid contexts
vmw_context_cotable can return either an error or a null pointer and its
usage sometimes went unchecked. Subsequent code would then try to access
either a null pointer or an error value.
The invalid dereferences were only possible with malformed userspace
apps which never properly initialized the rendering contexts.
Check the results of vmw_context_cotable to fix the invalid derefs.
Thanks:
ziming zhang(@ezrak1e) from Ant Group Light-Year Security Lab
who was the first person to discover it.
Niels De Graef who reported it and helped to track down the poc.
Fixes: 9c079b8ce8bf ("drm/vmwgfx: Adapt execbuf to the new validation api")
Cc: <stable@vger.kernel.org> # v4.20+
Reported-by: Niels De Graef <ndegraef@redhat.com>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Cc: Martin Krastev <martin.krastev@broadcom.com>
Cc: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
Cc: Ian Forbes <ian.forbes@broadcom.com>
Cc: Broadcom internal kernel review list <bcm-kernel-feedback-list@broadcom.com>
Cc: dri-devel@lists.freedesktop.org
Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
Reviewed-by: Martin Krastev <martin.krastev@broadcom.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240110200305.94086-1-zack.rusin@broadcom.com
Diffstat (limited to 'drivers/gpu/drm/ttm/ttm_tt.c')
0 files changed, 0 insertions, 0 deletions