]> git.baikalelectronics.ru Git - kernel.git/commit
drm: Don't overwrite user ioctl arg unless requested
authorChris Wilson <chris@chris-wilson.co.uk>
Tue, 12 Jul 2016 14:59:50 +0000 (15:59 +0100)
committerDaniel Vetter <daniel.vetter@ffwll.ch>
Thu, 14 Jul 2016 08:12:50 +0000 (10:12 +0200)
commit36ea210975ea0b94dbaea9b9fcac847d99d7c6b4
treede49d3013d23ea9e3b235b0e66d05c228b6b5147
parent507353bc10e36551d71efb6ffbc6ef8347bb2187
drm: Don't overwrite user ioctl arg unless requested

Currently, we completely ignore the user when it comes to the in/out
direction of the ioctl argument, as we simply cannot trust userspace.
(For example, they might request a copy of the modified ioctl argument
when the driver is not expecting such and so leak kernel stack.)
However, blindly copying over the target address may also lead to a
spurious EFAULT, and a failure after the ioctl was completed
successfully. This is important in order to avoid an ABI break when
extending an ioctl from IOR to IORW. Similar to how we only copy the
intersection of the kernel arg size and the user arg size, we only want
to copy back the kernel arg data iff both the kernel and userspace
request the copy.

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1468335590-21023-1-git-send-email-chris@chris-wilson.co.uk
drivers/gpu/drm/drm_ioctl.c