diff options
| author | Zhaowei Yuan <zhaowei.yuan@samsung.com> | 2014-06-18 14:33:59 +0800 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2014-07-11 13:33:55 +0100 |
| commit | 2c1ec4bfa383ddf85459a3c299db27377ac537d0 (patch) | |
| tree | 58563470035b059135bb44d9fc84493479f5cea9 /drivers/gpu | |
| parent | e0b2508d7d22cca58322a7d29f6339df0c01bf54 (diff) | |
drm: fix NULL pointer access by wrong ioctl
commit 1539fb9bd405ee32282ea0a38404f9e008ac5b7a upstream.
If user uses wrong ioctl command with _IOC_NONE and argument size
greater than 0, it can cause NULL pointer access from memset of line
463. If _IOC_NONE, don't memset to 0 for kdata.
Signed-off-by: Zhaowei Yuan <zhaowei.yuan@samsung.com>
Reviewed-by: David Herrmann <dh.herrmann@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
[bwh: Backported to 3.2: adjust indentation]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'drivers/gpu')
| -rw-r--r-- | drivers/gpu/drm/drm_drv.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c index acfe56787e5..0731d437e7f 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -456,8 +456,9 @@ long drm_ioctl(struct file *filp, retcode = -EFAULT; goto err_i1; } - } else + } else if (cmd & IOC_OUT) { memset(kdata, 0, usize); + } if (ioctl->flags & DRM_UNLOCKED) retcode = func(dev, kdata, file_priv); |