drm: Perform ioctl command validation on the stored kernel values

Commit Message

Chris Wilson April 12, 2013, 9:39 a.m. UTC

Userspace is free to pass in any command bits it feels like through the
ioctl cmd, and for example trinity likes to fuzz those bits to create
conflicting commands. So instead of relying upon userspace to pass along
the correct IN/OUT flags for the ioctl, use the flags as expected by the
kernel.

This does have a side-effect that NULL pointers can not be substituted
by userspace in place of a struct. This feature was not being used by
any driver, but instead exposed all of the command handlers to a user
triggerable OOPS.

Reported-by: Tommi Rantala <[e-mail]>
Link: http://lkml.kernel.org/r/[e-mail]
Signed-off-by: Tommi Rantala <[e-mail]>
Signed-off-by: Chris Wilson <[e-mail]>
---
 drivers/gpu/drm/drm_drv.c |    1 +
 1 file changed, 1 insertion(+)

Comments

Dave Airlie April 16, 2013, 3:18 a.m. UTC | #1

> ioctl cmd, and for example trinity likes to fuzz those bits to create
> conflicting commands. So instead of relying upon userspace to pass along
> the correct IN/OUT flags for the ioctl, use the flags as expected by the
> kernel.
>
> This does have a side-effect that NULL pointers can not be substituted
> by userspace in place of a struct. This feature was not being used by
> any driver, but instead exposed all of the command handlers to a user
> triggerable OOPS.
>
> Reported-by: Tommi Rantala <[e-mail]>
> Link: http://lkml.kernel.org/r/[e-mail]
> Signed-off-by: Tommi Rantala <[e-mail]>
> Signed-off-by: Chris Wilson <[e-mail]>

Applied thanks.

Dave.

Patch

diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 25f91cd..0ac1991 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -408,6 +408,7 @@  long drm_ioctl(struct file *filp,
 		usize = asize = _IOC_SIZE(cmd);
 		if (drv_size > asize)
 			asize = drv_size;
+		cmd = ioctl->cmd_drv;
 	}
 	else if ((nr >= DRM_COMMAND_END) || (nr < DRM_COMMAND_BASE)) {
 		ioctl = &drm_ioctls[nr];